Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
34s -
max time network
21s -
platform
debian-9_mips -
resource
debian9-mipsbe-20231215-en -
resource tags
arch:mipsimage:debian9-mipsbe-20231215-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
20/12/2023, 15:18
Static task
static1
Behavioral task
behavioral1
Sample
d547d86ce86849f33031d8a3643148aa
Resource
debian9-mipsbe-20231215-en
General
-
Target
d547d86ce86849f33031d8a3643148aa
-
Size
62KB
-
MD5
d547d86ce86849f33031d8a3643148aa
-
SHA1
5b8054686bc9f986af7b145388aa9bf2f07420f5
-
SHA256
f199d3f16a1475ef2395898c8b102db6756c8f2a3ab7eda2b613430ea003acb1
-
SHA512
da20d1cdc82cec1ef87ecfb5e67e62f1ec31f2fbfe78341842557bb4131991c83b2e3d1a697ac382990162b24ea58dccc3041676e3fc54d7adb08590682fb4bb
-
SSDEEP
768:vYPjLmGo1TW7QXgdRv4r5J8+/DBW1DR/WhUiDH1kWsLnJgGlzDpYuR1JQHRkAg3:AvmG8i7Qwn4lJTC9YUaVkWqlVGu2RW
Malware Config
Signatures
-
Detects Kaiten/Tsunami Payload 1 IoCs
resource yara_rule behavioral1/memory/717-1-0x00400000-0x0045fbf4-memory.dmp family_kaiten2 -
Writes DNS configuration 1 TTPs 1 IoCs
Writes data to DNS resolver config file.
description ioc File opened for modification /etc/resolv.conf -
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
description ioc Process File opened for modification /var/spool/cron/crontabs/tmp.dgZd5a crontab -
Enumerates running processes
Discovers information about currently running processes on the system
-
Enumerates kernel/hardware configuration 1 TTPs 45 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/74/stat killall File opened for reading /proc/13/stat killall File opened for reading /proc/11/stat killall File opened for reading /proc/37/stat killall File opened for reading /proc/710/stat killall File opened for reading /proc/332/stat killall File opened for reading /proc/325/stat killall File opened for reading /proc/112/stat killall File opened for reading /proc/710/stat killall File opened for reading /proc/717/cmdline killall File opened for reading /proc/24/stat killall File opened for reading /proc/122/stat killall File opened for reading /proc/self/stat systemctl File opened for reading /proc/156/stat killall File opened for reading /proc/389/stat killall File opened for reading /proc/15/stat killall File opened for reading /proc/self/stat systemctl File opened for reading /proc/1/environ systemctl File opened for reading /proc/332/stat killall File opened for reading /proc/704/stat killall File opened for reading /proc/17/stat killall File opened for reading /proc/10/stat killall File opened for reading /proc/704/stat killall File opened for reading /proc/559/stat killall File opened for reading /proc/74/stat killall File opened for reading /proc/filesystems systemctl File opened for reading /proc/687/stat killall File opened for reading /proc/706/stat killall File opened for reading /proc/77/stat killall File opened for reading /proc/13/stat killall File opened for reading /proc/706/stat killall File opened for reading /proc/filesystems systemctl File opened for reading /proc/70/stat killall File opened for reading /proc/7/stat killall File opened for reading /proc/112/stat killall File opened for reading /proc/559/stat killall File opened for reading /proc/787/stat killall File opened for reading /proc/701/cmdline killall File opened for reading /proc/filesystems systemctl File opened for reading /proc/filesystems systemctl File opened for reading /proc/6/stat killall File opened for reading /proc/406/stat killall File opened for reading /proc/832/stat killall File opened for reading /proc/406/stat killall File opened for reading /proc/561/stat killall File opened for reading /proc/361/stat killall File opened for reading /proc/235/stat killall File opened for reading /proc/2/stat killall File opened for reading /proc/24/stat killall File opened for reading /proc/self/stat systemctl File opened for reading /proc/332/stat killall File opened for reading /proc/511/stat killall File opened for reading /proc/781/stat killall File opened for reading /proc/21/stat killall File opened for reading /proc/72/stat killall File opened for reading /proc/702/cmdline killall File opened for reading /proc/1/stat killall File opened for reading /proc/122/stat killall File opened for reading /proc/self/stat systemctl File opened for reading /proc/5/stat killall File opened for reading /proc/525/stat killall File opened for reading /proc/1/stat killall File opened for reading /proc/14/stat killall File opened for reading /proc/380/stat killall
Processes
-
/tmp/d547d86ce86849f33031d8a3643148aa/tmp/d547d86ce86849f33031d8a3643148aa1⤵PID:717
-
/bin/shsh -c "rm -rf /var/run/wgsh > /dev/null 2>&1 &"2⤵PID:718
-
-
/bin/shsh -c "rm -rf /var/run/bbsh > /dev/null 2>&1 &"2⤵PID:721
-
-
/bin/shsh -c "rm -rf /var/run/tty0 > /dev/null 2>&1 &"2⤵PID:725
-
-
/bin/shsh -c "rm -rf /var/run/tty2 > /dev/null 2>&1 &"2⤵PID:730
-
-
/bin/shsh -c "rm -rf /var/run/tty3 > /dev/null 2>&1 &"2⤵PID:733
-
-
/bin/shsh -c "rm -rf /var/run/tty4 > /dev/null 2>&1 &"2⤵PID:735
-
-
/bin/shsh -c "rm -rf /var/run/tty5 > /dev/null 2>&1 &"2⤵PID:738
-
-
/bin/shsh -c "rm -rf /var/run/tty6 > /dev/null 2>&1 &"2⤵PID:741
-
-
/bin/shsh -c "rm -rf /tmp/tty0 > /dev/null 2>&1 &"2⤵PID:743
-
-
/bin/shsh -c "rm -rf /tmp/tty2 > /dev/null 2>&1 &"2⤵PID:746
-
-
/bin/shsh -c "rm -rf /tmp/tty3 > /dev/null 2>&1 &"2⤵PID:748
-
-
/bin/shsh -c "rm -rf /tmp/tty4 > /dev/null 2>&1 &"2⤵PID:750
-
-
/bin/shsh -c "rm -rf /tmp/tty5 > /dev/null 2>&1 &"2⤵PID:752
-
-
/bin/shsh -c "rm -rf /tmp/tty6 > /dev/null 2>&1 &"2⤵PID:754
-
-
/bin/shsh -c "rm -rf /var/run/pty > /dev/null 2>&1 &"2⤵PID:757
-
-
/bin/shsh -c "killall -9 arm > /dev/null 2>&1 &"2⤵PID:759
-
-
/bin/shsh -c "killall -9 mips > /dev/null 2>&1 &"2⤵PID:762
-
-
/bin/shsh -c "killall -9 mipsel > /dev/null 2>&1 &"2⤵PID:764
-
-
/bin/shsh -c "killall -9 powerpc > /dev/null 2>&1 &"2⤵PID:766
-
-
/bin/shsh -c "killall -9 ppc > /dev/null 2>&1 &"2⤵PID:768
-
-
/bin/shsh -c "killall -9 daemon.armv4l.mod > /dev/null 2>&1 &"2⤵PID:770
-
-
/bin/shsh -c "killall -9 daemon.i686.mod > /dev/null 2>&1 &"2⤵PID:773
-
-
/bin/shsh -c "killall -9 daemon.mips.mod > /dev/null 2>&1 &"2⤵PID:775
-
-
/bin/shsh -c "killall -9 daemon.mipsel.mod > /dev/null 2>&1 &"2⤵PID:778
-
-
/bin/shsh -c "kill -9 `cat /tmp/.xs/*.pid` > /dev/null 2>&1 &"2⤵PID:780
-
-
/bin/shsh -c "rm -rf /tmp/.xs/* > /dev/null 2>&1 &"2⤵PID:784
-
-
/bin/shsh -c "sleep 432000 && reboot &"2⤵PID:786
-
-
/bin/shsh -c "echo \"nameserver 8.8.8.8\" > /etc/resolv.conf &"2⤵PID:788
-
-
/bin/shsh -c "chmod 700 /tmp/d547d86ce86849f33031d8a3643148aa > /dev/null 2>&1 &"2⤵PID:791
-
-
/bin/shsh -c "touch -acmr /bin/ls /tmp/d547d86ce86849f33031d8a3643148aa"2⤵PID:793
-
/usr/bin/touchtouch -acmr /bin/ls /tmp/d547d86ce86849f33031d8a3643148aa3⤵PID:795
-
-
-
/bin/shsh -c "(crontab -l | grep -v \"/tmp/d547d86ce86849f33031d8a3643148aa\" | grep -v \"no cron\" | grep -v \"lesshts/run.sh\" > /var/run/.x001804289383) > /dev/null 2>&1"2⤵PID:796
-
-
/bin/shsh -c "echo \"* * * * * /tmp/d547d86ce86849f33031d8a3643148aa > /dev/null 2>&1 &\" >> /var/run/.x001804289383"2⤵PID:802
-
-
/bin/shsh -c "crontab /var/run/.x001804289383"2⤵PID:803
-
/usr/bin/crontabcrontab /var/run/.x0018042893833⤵
- Creates/modifies Cron job
PID:804
-
-
-
/bin/shsh -c "rm -rf /var/run/.x001804289383"2⤵PID:806
-
/bin/rmrm -rf /var/run/.x0018042893833⤵PID:807
-
-
-
/bin/shsh -c "/bin/uname -n"2⤵PID:808
-
/bin/uname/bin/uname -n3⤵PID:809
-
-
-
/bin/shsh -c "/bin/uname -n"2⤵PID:810
-
/bin/uname/bin/uname -n3⤵PID:811
-
-
-
/bin/shsh -c "kill -9 `cat /var/run/httpd.pid` > /dev/null 2>&1 &"2⤵PID:812
-
-
/bin/shsh -c "service httpd stop > /dev/null 2>&1 &"2⤵PID:814
-
-
/bin/shsh -c "killall -9 mini_httpd > /dev/null 2>&1 &"2⤵PID:817
-
-
/bin/shsh -c "killall -9 minihttpd > /dev/null 2>&1 &"2⤵PID:819
-
-
/bin/shsh -c "kill -9 `cat /var/run/thttpd.pid` > /dev/null 2>&1 &"2⤵PID:822
-
-
/bin/shsh -c "nvram set httpd_enable=0 > /dev/null 2>&1"2⤵PID:826
-
-
/bin/shsh -c "nvram set http_enable=0 > /dev/null 2>&1"2⤵PID:828
-
-
/bin/shsh -c "killall -9 httpd > /dev/null 2>&1 &"2⤵PID:829
-
-
/bin/shsh -c "service telnetd stop > /dev/null 2>&1 &"2⤵PID:831
-
-
/bin/shsh -c "service sshd stop > /dev/null 2>&1 &"2⤵PID:833
-
-
/bin/shsh -c "killall -9 telnetd > /dev/null 2>&1 &"2⤵PID:838
-
-
/bin/shsh -c "killall -9 utelnetd > /dev/null 2>&1 &"2⤵PID:841
-
-
/bin/shsh -c "killall -9 dropbear > /dev/null 2>&1 &"2⤵PID:845
-
-
/bin/shsh -c "killall -9 sshd > /dev/null 2>&1 &"2⤵PID:849
-
-
/bin/shsh -c "killall -9 lighttpd > /dev/null 2>&1 &"2⤵PID:851
-
-
/bin/rmrm -rf /var/run/wgsh1⤵PID:720
-
/bin/rmrm -rf /var/run/bbsh1⤵PID:724
-
/bin/rmrm -rf /var/run/tty01⤵PID:729
-
/bin/rmrm -rf /var/run/tty21⤵PID:732
-
/bin/rmrm -rf /var/run/tty31⤵PID:734
-
/bin/rmrm -rf /var/run/tty41⤵PID:737
-
/bin/rmrm -rf /var/run/tty51⤵PID:740
-
/bin/rmrm -rf /var/run/tty61⤵PID:742
-
/bin/rmrm -rf /tmp/tty01⤵PID:745
-
/bin/rmrm -rf /tmp/tty21⤵PID:747
-
/bin/rmrm -rf /tmp/tty31⤵PID:749
-
/bin/rmrm -rf /tmp/tty41⤵PID:751
-
/bin/rmrm -rf /tmp/tty51⤵PID:753
-
/bin/rmrm -rf /tmp/tty61⤵PID:756
-
/bin/rmrm -rf /var/run/pty1⤵PID:758
-
/usr/bin/killallkillall -9 arm1⤵
- Reads runtime system information
PID:761
-
/usr/bin/killallkillall -9 mips1⤵
- Reads runtime system information
PID:763
-
/usr/bin/killallkillall -9 mipsel1⤵
- Reads runtime system information
PID:765
-
/usr/bin/killallkillall -9 powerpc1⤵
- Reads runtime system information
PID:767
-
/usr/bin/killallkillall -9 ppc1⤵
- Reads runtime system information
PID:769
-
/usr/bin/killallkillall -9 daemon.armv4l.mod1⤵
- Reads runtime system information
PID:772
-
/usr/bin/killallkillall -9 daemon.i686.mod1⤵
- Reads runtime system information
PID:774
-
/usr/bin/killallkillall -9 daemon.mips.mod1⤵
- Reads runtime system information
PID:776
-
/usr/bin/killallkillall -9 daemon.mipsel.mod1⤵
- Reads runtime system information
PID:779
-
/bin/catcat "/tmp/.xs/*.pid"1⤵PID:783
-
/bin/rmrm -rf "/tmp/.xs/*"1⤵PID:785
-
/bin/sleepsleep 4320001⤵PID:789
-
/bin/chmodchmod 700 /tmp/d547d86ce86849f33031d8a3643148aa1⤵PID:792
-
/usr/bin/crontabcrontab -l1⤵PID:798
-
/bin/grepgrep -v /tmp/d547d86ce86849f33031d8a3643148aa1⤵PID:799
-
/bin/grepgrep -v "no cron"1⤵PID:800
-
/bin/grepgrep -v lesshts/run.sh1⤵PID:801
-
/bin/catcat /var/run/httpd.pid1⤵PID:815
-
/usr/sbin/serviceservice httpd stop1⤵PID:816
-
/usr/bin/basenamebasename /usr/sbin/service2⤵PID:820
-
-
/usr/bin/basenamebasename /usr/sbin/service2⤵PID:823
-
-
/bin/systemctlsystemctl --quiet is-active multi-user.target2⤵
- Enumerates kernel/hardware configuration
PID:827
-
-
/bin/systemctlsystemctl -p Triggers show dbus.socket2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:854
-
-
/bin/systemctlsystemctl -p Triggers show ssh.socket2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:863
-
-
/bin/systemctlsystemctl -p Triggers show syslog.socket2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:870
-
-
/bin/systemctlsystemctl -p Triggers show systemd-fsckd.socket2⤵
- Enumerates kernel/hardware configuration
PID:874
-
-
/bin/systemctlsystemctl -p Triggers show systemd-initctl.socket2⤵
- Enumerates kernel/hardware configuration
PID:878
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-audit.socket2⤵
- Enumerates kernel/hardware configuration
PID:881
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-dev-log.socket2⤵
- Enumerates kernel/hardware configuration
PID:885
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald.socket2⤵
- Enumerates kernel/hardware configuration
PID:889
-
-
/bin/systemctlsystemctl -p Triggers show systemd-networkd.socket2⤵
- Enumerates kernel/hardware configuration
PID:897
-
-
/bin/systemctlsystemctl -p Triggers show systemd-rfkill.socket2⤵
- Enumerates kernel/hardware configuration
PID:901
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-control.socket2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:905
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-kernel.socket2⤵
- Enumerates kernel/hardware configuration
PID:910
-
-
/usr/bin/killallkillall -9 mini_httpd1⤵PID:818
-
/usr/bin/killallkillall -9 minihttpd1⤵
- Reads runtime system information
PID:821
-
/bin/catcat /var/run/thttpd.pid1⤵PID:825
-
/usr/bin/killallkillall -9 httpd1⤵
- Reads runtime system information
PID:830
-
/usr/sbin/serviceservice telnetd stop1⤵PID:832
-
/usr/bin/basenamebasename /usr/sbin/service2⤵PID:839
-
-
/usr/bin/basenamebasename /usr/sbin/service2⤵PID:843
-
-
/bin/systemctlsystemctl --quiet is-active multi-user.target2⤵
- Enumerates kernel/hardware configuration
PID:848
-
-
/bin/systemctlsystemctl -p Triggers show dbus.socket2⤵
- Enumerates kernel/hardware configuration
PID:864
-
-
/bin/systemctlsystemctl -p Triggers show ssh.socket2⤵
- Enumerates kernel/hardware configuration
PID:869
-
-
/bin/systemctlsystemctl -p Triggers show syslog.socket2⤵
- Enumerates kernel/hardware configuration
PID:875
-
-
/bin/systemctlsystemctl -p Triggers show systemd-fsckd.socket2⤵
- Enumerates kernel/hardware configuration
PID:877
-
-
/bin/systemctlsystemctl -p Triggers show systemd-initctl.socket2⤵
- Enumerates kernel/hardware configuration
PID:882
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-audit.socket2⤵
- Enumerates kernel/hardware configuration
PID:886
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-dev-log.socket2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:890
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald.socket2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:895
-
-
/bin/systemctlsystemctl -p Triggers show systemd-networkd.socket2⤵
- Enumerates kernel/hardware configuration
PID:899
-
-
/bin/systemctlsystemctl -p Triggers show systemd-rfkill.socket2⤵
- Enumerates kernel/hardware configuration
PID:903
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-control.socket2⤵
- Enumerates kernel/hardware configuration
PID:908
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-kernel.socket2⤵
- Enumerates kernel/hardware configuration
PID:911
-
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"1⤵
- Enumerates kernel/hardware configuration
PID:835
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"1⤵PID:836
-
/usr/sbin/serviceservice sshd stop1⤵PID:837
-
/usr/bin/basenamebasename /usr/sbin/service2⤵PID:842
-
-
/usr/bin/basenamebasename /usr/sbin/service2⤵PID:846
-
-
/bin/systemctlsystemctl --quiet is-active multi-user.target2⤵
- Enumerates kernel/hardware configuration
PID:852
-
-
/bin/systemctlsystemctl -p Triggers show dbus.socket2⤵
- Enumerates kernel/hardware configuration
PID:868
-
-
/bin/systemctlsystemctl -p Triggers show ssh.socket2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:873
-
-
/bin/systemctlsystemctl -p Triggers show syslog.socket2⤵
- Enumerates kernel/hardware configuration
PID:879
-
-
/bin/systemctlsystemctl -p Triggers show systemd-fsckd.socket2⤵
- Enumerates kernel/hardware configuration
PID:883
-
-
/bin/systemctlsystemctl -p Triggers show systemd-initctl.socket2⤵
- Enumerates kernel/hardware configuration
PID:887
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-audit.socket2⤵
- Enumerates kernel/hardware configuration
PID:891
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-dev-log.socket2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:898
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald.socket2⤵
- Enumerates kernel/hardware configuration
PID:902
-
-
/bin/systemctlsystemctl -p Triggers show systemd-networkd.socket2⤵
- Enumerates kernel/hardware configuration
PID:906
-
-
/bin/systemctlsystemctl -p Triggers show systemd-rfkill.socket2⤵
- Enumerates kernel/hardware configuration
PID:909
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-control.socket2⤵
- Enumerates kernel/hardware configuration
PID:913
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-kernel.socket2⤵
- Enumerates kernel/hardware configuration
PID:915
-
-
/usr/bin/killallkillall -9 telnetd1⤵
- Reads runtime system information
PID:840
-
/usr/bin/killallkillall -9 utelnetd1⤵
- Reads runtime system information
PID:844
-
/usr/bin/killallkillall -9 dropbear1⤵
- Reads runtime system information
PID:847
-
/usr/bin/killallkillall -9 sshd1⤵
- Reads runtime system information
PID:850
-
/usr/bin/killallkillall -9 lighttpd1⤵
- Reads runtime system information
PID:853
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"1⤵
- Enumerates kernel/hardware configuration
PID:857
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"1⤵PID:858
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"1⤵
- Enumerates kernel/hardware configuration
PID:861
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"1⤵PID:862
-
/usr/local/sbin/systemctlsystemctl stop httpd.service1⤵PID:816
-
/usr/local/bin/systemctlsystemctl stop httpd.service1⤵PID:816
-
/usr/sbin/systemctlsystemctl stop httpd.service1⤵PID:816
-
/usr/bin/systemctlsystemctl stop httpd.service1⤵PID:816
-
/sbin/systemctlsystemctl stop httpd.service1⤵PID:816
-
/bin/systemctlsystemctl stop httpd.service1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:816
-
/usr/local/sbin/systemctlsystemctl stop telnetd.service1⤵PID:832
-
/usr/local/bin/systemctlsystemctl stop telnetd.service1⤵PID:832
-
/usr/sbin/systemctlsystemctl stop telnetd.service1⤵PID:832
-
/usr/bin/systemctlsystemctl stop telnetd.service1⤵PID:832
-
/sbin/systemctlsystemctl stop telnetd.service1⤵PID:832
-
/bin/systemctlsystemctl stop telnetd.service1⤵
- Enumerates kernel/hardware configuration
PID:832
-
/usr/local/sbin/systemctlsystemctl stop sshd.service1⤵PID:837
-
/usr/local/bin/systemctlsystemctl stop sshd.service1⤵PID:837
-
/usr/sbin/systemctlsystemctl stop sshd.service1⤵PID:837
-
/usr/bin/systemctlsystemctl stop sshd.service1⤵PID:837
-
/sbin/systemctlsystemctl stop sshd.service1⤵PID:837
-
/bin/systemctlsystemctl stop sshd.service1⤵
- Enumerates kernel/hardware configuration
PID:837
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67B
MD5e8bd99a54103ed1b59e754f2bf75845f
SHA196dab37a27a53b25b7009c31c99e0baf66cca08e
SHA2568a7065b9dba1bd78e6b99eb7eb9b88f486dda18a12a7e1c03d85c25efb59c423
SHA5122cf90c914a3baf9ef8e3f0db0b8c8c9e95389d6e6b7187f27b14de8c2127d19373af4818955c959bc00ebc7a78384a862c6a4d10b4fc10b5b600eaf20d0e65b7