Analysis
-
max time kernel
29s -
max time network
16s -
platform
debian-9_armhf -
resource
debian9-armhf-20231215-en -
resource tags
arch:armhfimage:debian9-armhf-20231215-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
07-02-2024 01:13
Static task
static1
Behavioral task
behavioral1
Sample
8e27b76b3903312cc5e93f250d7cf90b7b999592d70dcf2922bb450023014006.sh
Resource
ubuntu1804-amd64-20231222-en
Behavioral task
behavioral2
Sample
8e27b76b3903312cc5e93f250d7cf90b7b999592d70dcf2922bb450023014006.sh
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral3
Sample
8e27b76b3903312cc5e93f250d7cf90b7b999592d70dcf2922bb450023014006.sh
Resource
debian9-mipsbe-20231222-en
Behavioral task
behavioral4
Sample
8e27b76b3903312cc5e93f250d7cf90b7b999592d70dcf2922bb450023014006.sh
Resource
debian9-mipsel-20231221-en
General
-
Target
8e27b76b3903312cc5e93f250d7cf90b7b999592d70dcf2922bb450023014006.sh
-
Size
35KB
-
MD5
2550990d2d52581b213e7c9305c392d3
-
SHA1
f7f069915c9b97550dc1fb6cf631f6222416dcf5
-
SHA256
8e27b76b3903312cc5e93f250d7cf90b7b999592d70dcf2922bb450023014006
-
SHA512
a30d4a39203e6a98937e8670b7b3caaa63d2141fdf404bb28ca240d95cb7420bdfb8c695db81cc9c799e8818266600c137b8b0df2dfc69d7566bae64eee2ad50
-
SSDEEP
768:X87XzQ5VFNcDAFLcIwgnoYq0xFB6ytguz:X3VF+D6cIwgos/z
Malware Config
Signatures
-
Deletes system logs 1 TTPs 1 IoCs
Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.
description ioc Process File deleted /var/log/syslog rm -
Flushes firewall rules 1 IoCs
Flushes/ disables firewall rules inside the Linux kernel.
pid Process 683 iptables -
Attempts to change immutable files 6 IoCs
Modifies inode attributes on the filesystem to allow changing of immutable files.
pid Process 681 chattr 682 chattr 701 chattr 702 chattr 677 chattr 679 chattr -
Reads CPU attributes 1 TTPs 3 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online exim4 File opened for reading /sys/devices/system/cpu/online sysctl File opened for reading /sys/devices/system/cpu/online exim4 -
Reads runtime system information 48 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/141 ls File opened for reading /proc/filesystems sudo File opened for reading /proc/sys/kernel/osrelease sysctl File opened for reading /proc/filesystems userdel File opened for reading /proc/100 ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/13 ls File opened for reading /proc/filesystems ls File opened for reading /proc/sys/kernel/ngroups_max sudo File opened for reading /proc/filesystems sysctl File opened for reading /proc/sys/kernel/ngroups_max sendmail File opened for reading /proc/filesystems userdel File opened for reading /proc/111 ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/1 ls File opened for reading /proc/109 ls File opened for reading /proc/filesystems ls File opened for reading /proc/144 ls File opened for reading /proc/15 ls File opened for reading /proc/169 ls File opened for reading /proc/filesystems ls File opened for reading /proc/11 ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/151 ls File opened for reading /proc/154 ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/16 ls File opened for reading /proc/17 ls File opened for reading /proc/self/fd Process not Found File opened for reading /proc/sys/kernel/ngroups_max sendmail File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/18 ls File opened for reading /proc/filesystems ls File opened for reading /proc/10 ls File opened for reading /proc/filesystems ls File opened for reading /proc/14 ls File opened for reading /proc/filesystems ls File opened for reading /proc/self/stat sudo File opened for reading /proc/112 ls File opened for reading /proc/12 ls -
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/log_rot 8e27b76b3903312cc5e93f250d7cf90b7b999592d70dcf2922bb450023014006.sh
Processes
-
/tmp/8e27b76b3903312cc5e93f250d7cf90b7b999592d70dcf2922bb450023014006.sh/tmp/8e27b76b3903312cc5e93f250d7cf90b7b999592d70dcf2922bb450023014006.sh1⤵
- Writes file to tmp directory
PID:670 -
/bin/rmrm -rf /var/log/syslog2⤵
- Deletes system logs
PID:672
-
-
/usr/bin/chattrchattr -iua /tmp/2⤵
- Attempts to change immutable files
PID:677
-
-
/usr/bin/chattrchattr -iua /var/tmp/2⤵
- Attempts to change immutable files
PID:679
-
-
/usr/bin/chattrchattr -R -i /var/spool/cron2⤵
- Attempts to change immutable files
PID:681
-
-
/usr/bin/chattrchattr -i /etc/crontab2⤵
- Attempts to change immutable files
PID:682
-
-
/sbin/iptablesiptables -F2⤵
- Flushes firewall rules
PID:683
-
-
/usr/bin/sudosudo sysctl "kernel.nmi_watchdog=0"2⤵
- Reads runtime system information
PID:688 -
/sbin/sysctlsysctl "kernel.nmi_watchdog=0"3⤵
- Reads CPU attributes
- Reads runtime system information
PID:698
-
-
-
/usr/sbin/userdeluserdel akay2⤵
- Reads runtime system information
PID:699
-
-
/usr/sbin/userdeluserdel vfinder2⤵
- Reads runtime system information
PID:700
-
-
/usr/bin/chattrchattr -iae /root/.ssh/2⤵
- Attempts to change immutable files
PID:701
-
-
/usr/bin/chattrchattr -iae /root/.ssh/authorized_keys2⤵
- Attempts to change immutable files
PID:702
-
-
/bin/rmrm -rf "/tmp/addres*"2⤵PID:705
-
-
/bin/rmrm -rf "/tmp/walle*"2⤵PID:706
-
-
/bin/rmrm -rf /tmp/keys2⤵PID:707
-
-
/bin/grepgrep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"2⤵PID:712
-
-
/bin/grepgrep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"2⤵PID:718
-
-
/bin/grepgrep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"2⤵PID:726
-
-
/bin/grepgrep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"2⤵PID:731
-
-
/bin/grepgrep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"2⤵PID:736
-
-
/bin/grepgrep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"2⤵PID:746
-
-
/bin/grepgrep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"2⤵PID:753
-
-
/bin/grepgrep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"2⤵PID:759
-
-
/bin/grepgrep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"2⤵PID:766
-
-
/bin/grepgrep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"2⤵PID:773
-
-
/bin/grepgrep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"2⤵PID:780
-
-
/bin/grepgrep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"2⤵PID:787
-
-
/bin/grepgrep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"2⤵PID:794
-
-
/bin/grepgrep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"2⤵PID:801
-
-
/bin/grepgrep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"2⤵PID:808
-
-
/bin/grepgrep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"2⤵PID:815
-
-
/bin/grepgrep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"2⤵PID:822
-
-
/bin/grepgrep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"2⤵PID:829
-
-
/bin/grepgrep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"2⤵PID:836
-
-
/usr/sbin/sendmailsendmail -t1⤵
- Reads runtime system information
PID:693 -
/usr/sbin/exim4/usr/sbin/exim4 -Mc 1rXVZT-0000BB-Pe2⤵
- Reads CPU attributes
PID:703
-
-
/usr/sbin/sendmailsendmail -t1⤵
- Reads runtime system information
PID:696 -
/usr/sbin/exim4/usr/sbin/exim4 -Mc 1rXVZU-0000BE-0t2⤵
- Reads CPU attributes
PID:704
-
-
/bin/lsls -latrh /proc/11⤵
- Reads runtime system information
PID:709
-
/bin/grepgrep exe1⤵PID:710
-
/bin/lsls -latrh /proc/101⤵
- Reads runtime system information
PID:714
-
/bin/grepgrep exe1⤵PID:715
-
/bin/lsls -latrh /proc/1001⤵
- Reads runtime system information
PID:723
-
/bin/grepgrep exe1⤵PID:724
-
/bin/lsls -latrh /proc/1091⤵
- Reads runtime system information
PID:728
-
/bin/grepgrep exe1⤵PID:729
-
/bin/lsls -latrh /proc/111⤵
- Reads runtime system information
PID:733
-
/bin/grepgrep exe1⤵PID:734
-
/bin/lsls -latrh /proc/1111⤵
- Reads runtime system information
PID:740
-
/bin/grepgrep exe1⤵PID:741
-
/bin/lsls -latrh /proc/1121⤵
- Reads runtime system information
PID:749
-
/bin/grepgrep exe1⤵PID:750
-
/bin/lsls -latrh /proc/121⤵
- Reads runtime system information
PID:756
-
/bin/grepgrep exe1⤵PID:757
-
/bin/lsls -latrh /proc/131⤵
- Reads runtime system information
PID:763
-
/bin/grepgrep exe1⤵PID:764
-
/bin/lsls -latrh /proc/141⤵
- Reads runtime system information
PID:769
-
/bin/grepgrep exe1⤵PID:770
-
/bin/lsls -latrh /proc/1411⤵
- Reads runtime system information
PID:776
-
/bin/grepgrep exe1⤵PID:777
-
/bin/lsls -latrh /proc/1441⤵
- Reads runtime system information
PID:783
-
/bin/grepgrep exe1⤵PID:784
-
/bin/lsls -latrh /proc/151⤵
- Reads runtime system information
PID:789
-
/bin/grepgrep exe1⤵PID:790
-
/bin/lsls -latrh /proc/1511⤵
- Reads runtime system information
PID:796
-
/bin/grepgrep exe1⤵PID:797
-
/bin/lsls -latrh /proc/1541⤵
- Reads runtime system information
PID:803
-
/bin/grepgrep exe1⤵PID:804
-
/bin/lsls -latrh /proc/161⤵
- Reads runtime system information
PID:810
-
/bin/grepgrep exe1⤵PID:811
-
/bin/lsls -latrh /proc/1691⤵
- Reads runtime system information
PID:817
-
/bin/grepgrep exe1⤵PID:818
-
/bin/grepgrep exe1⤵PID:825
-
/bin/lsls -latrh /proc/171⤵
- Reads runtime system information
PID:824
-
/bin/lsls -latrh /proc/181⤵
- Reads runtime system information
PID:831
-
/bin/grepgrep exe1⤵PID:832
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5B
MD5727479ef7cedf30c03459bec7d87b0f0
SHA12082e7f715f058acab2398d25d135cf5f4c0ce41
SHA25629872037c9573567744ef10ed2de57864ded7554c9fa2ef03fc1244c65794ba6
SHA5124cb59d37f8481f9bb2745f494baa0910a68aad40ac2903ef1513547e091e1e772a5f9436f789ab91fcafb75b8a28c2112ede89004be41f33c01d936b542ca6ba
-
Filesize
820B
MD5de75dc68504aa678bbd9fe3563c405bd
SHA1a37124e98461e2012bdcc9f23c5849bbbe91a47b
SHA256259027781815b016d6056cf094db8ad6869cd1ab9739074e28e316cfe5addef8
SHA512a96895b3ba784677b40689cd8eb11cf114dfd68fb510620629e39c12da98d9a90a2f8c5cd82326c329c8683043003f2d501d1e4be632fcd588b5fcf8d882761c
-
Filesize
1KB
MD57fde51c03b255eb651a00ac44702c8f4
SHA1a0877bf88c90839811a7b41a134fd20d3d155882
SHA25604bca5d9d6156f784427d36a2e9bdf82b823444fd51db0253cc6e6c9672ca089
SHA512d70c988280829a92c9f66d3a5ca07953c0bc7ba13144d8181836ecc8ff0bb911c04b80638cfa5a0b7747c5cb2276d1042e573996d0254988da30db62a51a0fe7
-
Filesize
126B
MD5c41bd19767894373fd241e93a6f9ad27
SHA1d50e503e929d274eb581e3a2859ead264ff5f401
SHA256b8b78813ae8e9bbd99c7a175780205ecabdb68be4fc620de9c57f583da06fd44
SHA5122462124a95f186cd1d09a694f52e69d4f4dadc3807888e1e4c8be6ef207a90742300ac052c95b1f5d56fea415fb2cbf81f3bd0814c5303ad0141c0404d1052f1
-
Filesize
34B
MD5d7d96d63d643a4ce3e408eba7dfcedc5
SHA1c53607f95c5c57beafc1d8266646797a035f76ea
SHA25621db3a59b2d0ce18fb250b787d6e2c85d12919f5fdf1448c8f48207c4083b159
SHA512703a03e54776a6ad9b8adc6c475bbc91c06502618fa3b6f495b1a01a4f6f7aa6fb65dc6ba6885ddc6af961627062f1ce1e1d66688288cbd3bef7754d249fa9b3
-
Filesize
145B
MD511a7a490d45ac24fe3ee7087741b5c72
SHA1f1b1382134e7d202c16e82c6fdda6d8ea071260a
SHA25663bd1714961cbe859e302b8683d74caa99efef9718951ddecb7a51ecd832692a
SHA512a879e01729a5feb3529ccd0c693ab9c37fefc72b1a74e4347fe22bb7a4ea7aec50c20003499284c0310ae5d7500c97616eb36f0242fc88bd5d2b9cb2a6a1733c
-
Filesize
912B
MD5ecafac76c2f085867a6c72a483bdc83f
SHA1717cc70e275d66bba38be06cd345e516a5015b45
SHA256d4c272b2e6c1a9b6ed77e3ea0702ccdd0a490e0975ce41af9493451c67720cd9
SHA512899855d44312528f31134bdc0e3196a810ebd922200cbfdde4eae2bcf3a6d488ea33f39ae5f903ce2c01240ed9e2f5850f2b3216fd0d519eb7d19cc81fd5f0bc
-
Filesize
912B
MD5b2b9e61e6e8cf1d6485cf7932769988d
SHA105a2accdad5ff4cb814af37b2681fd8eb37b4370
SHA256085e82812132062e3b738cd5646ec38a718021e3fdb872c6727069363563641e
SHA512985c052ab3f65c61fa38b3b6b854db654513fc0b6cfae6d1e9a3a0fcdae0b5ebd9aa9c0ed66a4a868ae8694cc1b91cb4c8f54d08ed7b20db2abdbcc90e0a0ce3
-
Filesize
288B
MD5e824bd341e8791061eabbd4efe657be1
SHA1da2d0f9bc8c2d521e52038478296258ca471efc5
SHA256861fc55eaf55d38e2c892b1bd5d2c501578366e74e197118dc3e2835c2841c64
SHA512bbd9d26761515a8b0506e929b654412e0ffeeef65864f26c55d0ff846aeea99ab467ff3ae72db942d2992d1307cdeba42feeabf587949a61cea98d56a35a62b6
-
Filesize
89B
MD51dcbe8766a4f6479f5c950f205bb91fd
SHA15bf31c54a3bd78be9f6a9f9a036aa49ddec99431
SHA2567db79de0887216ca33cee8e29facf66a0faf9972fd298d454e3155015f1a88ad
SHA51251617abb0483579fcf4c69dfe10087ff000478368190b990e3ccbd4af2ae9d3a6974e88fff25c545350bf95ae42cc046dc59e43c36f84fa98bd2c2fa2832caf3
-
Filesize
288B
MD565a00cccaa56f7461b2c63f12040087e
SHA18c98375c4399fbb907982eb54b3fd8b2ff56edbc
SHA2563c1b5986eff71566d3ddf777d354143143ce231ceaa9d3cf5a5edc7d5bb07ae1
SHA512b48f717dfbbaf3e02101f703cc3a81e27a6f96a6e86d950f79b358de995a53f4a5da2de309eaa44023533dda47e2a55ddeeaa7966dc67b85ea871e526ab56f67
-
Filesize
89B
MD55cc0ca3d18c804cd6c4a60549e58df2c
SHA1fb0f4b4bbc7662a8918be27efe003450b18ccbb6
SHA25638ac225d9bb98eb6d065bbbe42f3322f42617bdea042965b27cc3bd237a9d712
SHA5124b0dbc5718a319d829db5c92d1ae5d76ab9655fb49b30960a6926a3cd811a14bdc59119d811eeb0b4a9d4350b7d3828ae0b67baeb7ef28191ad19a65c66dc957