b7dd3bce3ebfbc2d5e3a9f00d47f27cb6a5895c4618c878e314e573a7c216df1

Analysis

max time kernel
156s
max time network
170s
platform
ubuntu-20.04_amd64
resource
ubuntu2004-amd64-20240221-en
resource tags

arch:amd64arch:i386image:ubuntu2004-amd64-20240221-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
submitted
01-03-2024 21:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

The-MALWARE-Repo-master/Botnets/FritzFrog/103b8404dc64c9a44511675981a09fd01395ee837452d114f1350c295357c046
Size

8.6MB
MD5

ae747bc7fff9bc23f06635ef60ea0e8d
SHA1

64315e834f67905ed4e47f36155362a78ac23462
SHA256

103b8404dc64c9a44511675981a09fd01395ee837452d114f1350c295357c046
SHA512

e24914a58565a43883c27ae4a41061e8edd3d5eef7b86c1c0e9910d9fbe0eef3e78ed49136ac0c9378311e99901b1847bcfd926aa9a3ea44149a7478480f82b2
SSDEEP

98304:rDSceJ/GqDu6P0ypQ0Qv5knSTH20ejwBcHjI7Xk:rDSceJ/GqD18RZv5knS720e7s

Score

8^/10

antivm infostealer persistence

Malware Config

Signatures

Adds new SSH keys 2 IoCs

Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.

persistence

Processes:

103b8404dc64c9a44511675981a09fd01395ee837452d114f1350c295357c046

description	ioc	process
File opened for modification	/root/.ssh/authorized_keys	103b8404dc64c9a44511675981a09fd01395ee837452d114f1350c295357c046
File opened for modification	/root/.ssh/authorized_keys

Deletes itself 1 IoCs

Processes:

103b8404dc64c9a44511675981a09fd01395ee837452d114f1350c295357c046

pid process

1476 103b8404dc64c9a44511675981a09fd01395ee837452d114f1350c295357c046
Reads EFI boot settings 1 IoCs
Reads EFI boot settings from the efivars filesystem, may contain security secrets or sensitive data.
infostealer

Processes:

journalctl

description ioc process

File opened for reading /sys/firmware/efi/efivars/SystemdOptions-8cf2644b-4b0b-428f-9387-6d876050dc67 journalctl
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
antivm

Virtualization/Sandbox Evasion
T1497

Processes:

cat

description ioc process

File opened for reading /proc/cpuinfo cat

pid	process
1476	103b8404dc64c9a44511675981a09fd01395ee837452d114f1350c295357c046

description	ioc	process
File opened for reading	/sys/firmware/efi/efivars/SystemdOptions-8cf2644b-4b0b-428f-9387-6d876050dc67	journalctl

description	ioc	process
File opened for reading	/proc/cpuinfo	cat

Deletes log files 1 TTPs 2 IoCs

Deletes log files on the system.

Indicator Removal

T1070

Processes:

103b8404dc64c9a44511675981a09fd01395ee837452d114f1350c295357c046

description	ioc	process
File deleted	/var/log/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/103b8404dc64c9a44511675981a09fd01395ee837452d114f1350c295357c046	103b8404dc64c9a44511675981a09fd01395ee837452d114f1350c295357c046
File deleted	/var/log/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/103b8404dc64c9a44511675981a09fd01395ee837452d114f1350c295357c046

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 64 IoCs

System Information Discovery

T1082

Processes:

pspspkillpspspspkillpkillpspkillpspkillpspspkillpkillpspspsfreepspkillfreepspspkillpspspkillpspspspkillpkillpspspkillpspspkillpspspspkill

description	ioc	process
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery
T1082

Processes:

journalctl

description ioc process

File opened for reading /sys/firmware/efi/efivars/SystemdOptions-8cf2644b-4b0b-428f-9387-6d876050dc67 journalctl

description	ioc	process
File opened for reading	/sys/firmware/efi/efivars/SystemdOptions-8cf2644b-4b0b-428f-9387-6d876050dc67	journalctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

pkillpkillkillallpssudokillallkillallkillallkillallpspspspskillallpspspkillkillallkillallpidofpspkillpkillkillallpkillpspspspkillpkillpkillpspskillallpkillkillallkillallpspskillall

description	ioc	process
File opened for reading	/proc/93/status	pkill
File opened for reading	/proc/456/status
File opened for reading	/proc/453/stat
File opened for reading	/proc/533/status	pkill
File opened for reading	/proc/21/stat	killall
File opened for reading	/proc/74/status	ps
File opened for reading	/proc/975/status
File opened for reading	/proc/filesystems	sudo
File opened for reading	/proc/166/stat	killall
File opened for reading	/proc/695/stat	killall
File opened for reading	/proc/1133/stat	killall
File opened for reading	/proc/273/stat	killall
File opened for reading	/proc/72/stat	killall
File opened for reading	/proc/77/cmdline
File opened for reading	/proc/441/cmdline	ps
File opened for reading	/proc/634/status	ps
File opened for reading	/proc/935/stat	ps
File opened for reading	/proc/1457/status	ps
File opened for reading	/proc/763/stat
File opened for reading	/proc/491/stat	killall
File opened for reading	/proc/811/stat	killall
File opened for reading	/proc/564/stat
File opened for reading	/proc/852/stat
File opened for reading	/proc/453/status	ps
File opened for reading	/proc/2242/cmdline	ps
File opened for reading	/proc/932/status	pkill
File opened for reading	/proc/1117/stat
File opened for reading	/proc/1451/status
File opened for reading	/proc/946/status
File opened for reading	/proc/7/cmdline
File opened for reading	/proc/1204/stat	killall
File opened for reading	/proc/173/stat	killall
File opened for reading	/proc/1123/cmdline	pidof
File opened for reading	/proc/75/cmdline
File opened for reading	/proc/172/status
File opened for reading	/proc/82/stat
File opened for reading	/proc/636/cmdline	ps
File opened for reading	/proc/636/cmdline	ps
File opened for reading	/proc/454/status	pkill
File opened for reading	/proc/1123/status	pkill
File opened for reading	/proc/589/stat	killall
File opened for reading	/proc/535/cmdline	pkill
File opened for reading	/proc/501/cmdline
File opened for reading	/proc/975/cmdline
File opened for reading	/proc/566/status	ps
File opened for reading	/proc/2261/status	ps
File opened for reading	/proc/1091/status	ps
File opened for reading	/proc/7/cmdline	pkill
File opened for reading	/proc/456/cmdline	pkill
File opened for reading	/proc/1305/status	pkill
File opened for reading	/proc/399/stat
File opened for reading	/proc/634/cmdline
File opened for reading	/proc/1099/cmdline	ps
File opened for reading	/proc/1457/status	ps
File opened for reading	/proc/566/stat	killall
File opened for reading	/proc/2692/cmdline	pkill
File opened for reading	/proc/170/stat	killall
File opened for reading	/proc/1142/stat	killall
File opened for reading	/proc/495/cmdline	ps
File opened for reading	/proc/self/stat
File opened for reading	/proc/3828/cmdline
File opened for reading	/proc/2719/status	pkill
File opened for reading	/proc/273/stat	ps
File opened for reading	/proc/6/stat	killall

Writes file to tmp directory 17 IoCs

Malware often drops required files in the /tmp directory.

Processes:

touchtouchtouchtouchtouchtouchtouchtouchtouchtouchtouch

description	ioc	process
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_10592
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_14852
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_21139	touch
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_1252	touch
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_3864	touch
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_16214	touch
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_16840	touch
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_28068	touch
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_5245	touch
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_774	touch
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_14759	touch
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_5796
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_2276
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_27942
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_26978	touch
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_18183
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_16274	touch

/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/103b8404dc64c9a44511675981a09fd01395ee837452d114f1350c295357c046
/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/103b8404dc64c9a44511675981a09fd01395ee837452d114f1350c295357c046
1⤵
- Adds new SSH keys
- Deletes itself
- Deletes log files
PID:1476
- /usr/bin/uname
  uname -a
  2⤵
  PID:1490
- /usr/bin/cat
  cat /proc/cpuinfo
  2⤵
  - Checks CPU configuration
  PID:1491
- /usr/bin/cat
  cat /etc/issue
  2⤵
  PID:1493
- /usr/bin/free
  free -m
  2⤵
  PID:1494
- /usr/bin/uptime
  uptime
  2⤵
  PID:1495
- /usr/bin/journalctl
  journalctl -S "@0" -u sshd
  2⤵
  - Reads EFI boot settings
  - Enumerates kernel/hardware configuration
  PID:1511
- /usr/bin/cat
  cat "/var/log/auth*"
  2⤵
  PID:1535
- /usr/bin/zcat
  zcat "/var/log/auth*"
  2⤵
  PID:1538
- /usr/local/sbin/gzip
  gzip -cd "/var/log/auth*"
  2⤵
  PID:1538
- /usr/local/bin/gzip
  gzip -cd "/var/log/auth*"
  2⤵
  PID:1538
- /usr/sbin/gzip
  gzip -cd "/var/log/auth*"
  2⤵
  PID:1538
- /usr/bin/gzip
  gzip -cd "/var/log/auth*"
  2⤵
  PID:1538
- /bin/bash
  /bin/bash -
  2⤵
  PID:2301
- - /usr/bin/sudo
    sudo -S touch .local_3864
    3⤵
    PID:2306
  - - /usr/bin/touch
      touch .local_3864
      4⤵
      Writes file to tmp directory
      PID:2307
- - /usr/bin/sudo
    sudo rm .local_3864
    3⤵
    PID:2311
  - - /usr/bin/rm
      rm .local_3864
      4⤵
      PID:2312
- - /usr/bin/sudo
    sudo killall -9 bssh
    3⤵
    PID:2319
  - - /usr/bin/killall
      killall -9 bssh
      4⤵
      PID:2320
- - /usr/bin/sudo
    sudo rm -rf /tmp/.an
    3⤵
    PID:2321
  - - /usr/bin/rm
      rm -rf /tmp/.an
      4⤵
      PID:2322
- - /usr/bin/sudo
    sudo killall -9 xm64
    3⤵
    PID:2323
  - - /usr/bin/killall
      killall -9 xm64
      4⤵
      PID:2324
- - /usr/bin/sudo
    sudo killall -9 rpc.idmapd
    3⤵
    PID:2325
  - - /usr/bin/killall
      killall -9 rpc.idmapd
      4⤵
      PID:2326
- - /usr/bin/sudo
    sudo rm -rf /tmp/.m2
    3⤵
    PID:2327
  - - /usr/bin/rm
      rm -rf /tmp/.m2
      4⤵
      PID:2328
- - /usr/bin/sudo
    sudo killall -9 xorgg
    3⤵
    PID:2329
  - - /usr/bin/killall
      killall -9 xorgg
      4⤵
      PID:2330
- - /usr/bin/sudo
    sudo rm -rf /tmp/seconfig
    3⤵
    PID:2331
  - - /usr/bin/rm
      rm -rf /tmp/seconfig
      4⤵
      PID:2332
- - /usr/bin/sudo
    sudo killall -9 crond64
    3⤵
    PID:2333
  - - /usr/bin/killall
      killall -9 crond64
      4⤵
      Reads runtime system information
      PID:2335
- - /usr/bin/sudo
    sudo killall -9 tsm
    3⤵
    PID:2336
  - - /usr/bin/killall
      killall -9 tsm
      4⤵
      PID:2337
- - /usr/bin/sudo
    sudo rm -rf /tmp/.ssh
    3⤵
    PID:2338
  - - /usr/bin/rm
      rm -rf /tmp/.ssh
      4⤵
      PID:2339
- - /usr/bin/sudo
    sudo rm -rf /tmp/.java
    3⤵
    PID:2340
  - - /usr/bin/rm
      rm -rf /tmp/.java
      4⤵
      PID:2341
- - /usr/bin/sudo
    sudo rm -rf /tmp/.iolanda
    3⤵
    PID:2342
  - - /usr/bin/rm
      rm -rf /tmp/.iolanda
      4⤵
      PID:2343
- - /usr/bin/sudo
    sudo pkill test.mod
    3⤵
    PID:2344
  - - /usr/bin/pkill
      pkill test.mod
      4⤵
      PID:2345
- - /usr/bin/sudo
    sudo pkill daemon.i686.mod
    3⤵
    PID:2346
  - - /usr/bin/pkill
      pkill daemon.i686.mod
      4⤵
      PID:2347
- - /usr/bin/sudo
    sudo pkill daemon.armv4l.mod
    3⤵
    PID:2348
  - - /usr/bin/pkill
      pkill daemon.armv4l.mod
      4⤵
      Reads CPU attributes
      PID:2349
- - /usr/bin/sudo
    sudo pkill daemon.mips.mod
    3⤵
    PID:2350
  - - /usr/bin/pkill
      pkill daemon.mips.mod
      4⤵
      PID:2351
- - /usr/bin/sudo
    sudo pkill daemon.mipsel.mod
    3⤵
    PID:2352
  - - /usr/bin/pkill
      pkill daemon.mipsel.mod
      4⤵
      PID:2353
- - /usr/bin/sudo
    sudo rm -rf /tmp/.xs
    3⤵
    PID:2354
  - - /usr/bin/rm
      rm -rf /tmp/.xs
      4⤵
      PID:2355
- - /usr/bin/sudo
    sudo pkill ld-linux-x86-64
    3⤵
    PID:2356
  - - /usr/bin/pkill
      pkill ld-linux-x86-64
      4⤵
      PID:2357
- - /usr/bin/rm
    rm -rf "/var/tmp/. *"
    3⤵
    PID:2358
- - /usr/bin/sudo
    sudo killall -9 "[atd]"
    3⤵
    PID:2397
  - - /usr/bin/killall
      killall -9 "[atd]"
      4⤵
      PID:2398
- - /usr/bin/sudo
    sudo rm -rf /tmp/.jk
    3⤵
    PID:2399
  - - /usr/bin/rm
      rm -rf /tmp/.jk
      4⤵
      PID:2400
- - /usr/bin/sudo
    sudo killall -9 "[ntpd]"
    3⤵
    PID:2401
  - - /usr/bin/killall
      killall -9 "[ntpd]"
      4⤵
      Reads runtime system information
      PID:2402
- - /usr/bin/sudo
    sudo killall -9 "[rpciod]"
    3⤵
    PID:2403
  - - /usr/bin/killall
      killall -9 "[rpciod]"
      4⤵
      PID:2404
- - /usr/bin/sudo
    sudo killall -9 "[ext4-dio-unwrit]"
    3⤵
    PID:2405
  - - /usr/bin/killall
      killall -9 "[ext4-dio-unwrit]"
      4⤵
      PID:2406
- - /usr/bin/sudo
    sudo rm -rf "/tmp/.xm*"
    3⤵
    PID:2407
  - - /usr/bin/rm
      rm -rf "/tmp/.xm*"
      4⤵
      PID:2408
- - /usr/bin/pidof
    pidof libexec
    3⤵
    PID:2409
- /usr/bin/free
  free -m
  2⤵
  PID:2365
- /usr/bin/uptime
  uptime
  2⤵
  PID:2366
- /bin/bash
  /bin/bash -
  2⤵
  PID:2974
- - /usr/bin/sudo
    sudo -S touch .local_28068
    3⤵
    PID:2979
  - - /usr/bin/touch
      touch .local_28068
      4⤵
      Writes file to tmp directory
      PID:2980
- - /usr/bin/sudo
    sudo rm .local_28068
    3⤵
    PID:2984
  - - /usr/bin/rm
      rm .local_28068
      4⤵
      PID:2985
- - /usr/bin/sudo
    sudo killall -9 bssh
    3⤵
    PID:2992
  - - /usr/bin/killall
      killall -9 bssh
      4⤵
      PID:2993
- - /usr/bin/sudo
    sudo rm -rf /tmp/.an
    3⤵
    PID:2994
  - - /usr/bin/rm
      rm -rf /tmp/.an
      4⤵
      PID:2995
- - /usr/bin/sudo
    sudo killall -9 xm64
    3⤵
    PID:2996
  - - /usr/bin/killall
      killall -9 xm64
      4⤵
      PID:2997
- - /usr/bin/sudo
    sudo killall -9 rpc.idmapd
    3⤵
    PID:2998
  - - /usr/bin/killall
      killall -9 rpc.idmapd
      4⤵
      PID:2999
- - /usr/bin/sudo
    sudo rm -rf /tmp/.m2
    3⤵
    PID:3000
  - - /usr/bin/rm
      rm -rf /tmp/.m2
      4⤵
      PID:3001
- - /usr/bin/sudo
    sudo killall -9 xorgg
    3⤵
    PID:3002
  - - /usr/bin/killall
      killall -9 xorgg
      4⤵
      Reads runtime system information
      PID:3003
- - /usr/bin/sudo
    sudo rm -rf /tmp/seconfig
    3⤵
    PID:3004
  - - /usr/bin/rm
      rm -rf /tmp/seconfig
      4⤵
      PID:3005
- - /usr/bin/sudo
    sudo killall -9 crond64
    3⤵
    PID:3006
  - - /usr/bin/killall
      killall -9 crond64
      4⤵
      Reads runtime system information
      PID:3007
- - /usr/bin/sudo
    sudo killall -9 tsm
    3⤵
    PID:3008
  - - /usr/bin/killall
      killall -9 tsm
      4⤵
      PID:3009
- - /usr/bin/sudo
    sudo rm -rf /tmp/.ssh
    3⤵
    PID:3010
  - - /usr/bin/rm
      rm -rf /tmp/.ssh
      4⤵
      PID:3011
- - /usr/bin/sudo
    sudo rm -rf /tmp/.java
    3⤵
    PID:3012
  - - /usr/bin/rm
      rm -rf /tmp/.java
      4⤵
      PID:3013
- - /usr/bin/sudo
    sudo rm -rf /tmp/.iolanda
    3⤵
    PID:3014
  - - /usr/bin/rm
      rm -rf /tmp/.iolanda
      4⤵
      PID:3015
- - /usr/bin/sudo
    sudo pkill test.mod
    3⤵
    PID:3016
  - - /usr/bin/pkill
      pkill test.mod
      4⤵
      PID:3017
- - /usr/bin/sudo
    sudo pkill daemon.i686.mod
    3⤵
    PID:3018
  - - /usr/bin/pkill
      pkill daemon.i686.mod
      4⤵
      PID:3019
- - /usr/bin/sudo
    sudo pkill daemon.armv4l.mod
    3⤵
    PID:3020
  - - /usr/bin/pkill
      pkill daemon.armv4l.mod
      4⤵
      PID:3021
- - /usr/bin/sudo
    sudo pkill daemon.mips.mod
    3⤵
    PID:3022
  - - /usr/bin/pkill
      pkill daemon.mips.mod
      4⤵
      PID:3023
- - /usr/bin/sudo
    sudo pkill daemon.mipsel.mod
    3⤵
    PID:3024
  - - /usr/bin/pkill
      pkill daemon.mipsel.mod
      4⤵
      Reads CPU attributes
      PID:3025
- - /usr/bin/sudo
    sudo rm -rf /tmp/.xs
    3⤵
    PID:3026
  - - /usr/bin/rm
      rm -rf /tmp/.xs
      4⤵
      PID:3027
- - /usr/bin/sudo
    sudo pkill ld-linux-x86-64
    3⤵
    PID:3028
  - - /usr/bin/pkill
      pkill ld-linux-x86-64
      4⤵
      Reads CPU attributes
      PID:3029
- - /usr/bin/rm
    rm -rf "/var/tmp/. *"
    3⤵
    PID:3030
- - /usr/bin/sudo
    sudo killall -9 "[atd]"
    3⤵
    PID:3067
  - - /usr/bin/killall
      killall -9 "[atd]"
      4⤵
      Reads runtime system information
      PID:3068
- - /usr/bin/sudo
    sudo rm -rf /tmp/.jk
    3⤵
    PID:3069
  - - /usr/bin/rm
      rm -rf /tmp/.jk
      4⤵
      PID:3070
- - /usr/bin/sudo
    sudo killall -9 "[ntpd]"
    3⤵
    PID:3071
  - - /usr/bin/killall
      killall -9 "[ntpd]"
      4⤵
      PID:3072
- - /usr/bin/sudo
    sudo killall -9 "[rpciod]"
    3⤵
    PID:3073
  - - /usr/bin/killall
      killall -9 "[rpciod]"
      4⤵
      PID:3074
- - /usr/bin/sudo
    sudo killall -9 "[ext4-dio-unwrit]"
    3⤵
    PID:3075
  - - /usr/bin/killall
      killall -9 "[ext4-dio-unwrit]"
      4⤵
      PID:3076
- - /usr/bin/sudo
    sudo rm -rf "/tmp/.xm*"
    3⤵
    PID:3077
  - - /usr/bin/rm
      rm -rf "/tmp/.xm*"
      4⤵
      PID:3078
- - /usr/bin/pidof
    pidof libexec
    3⤵
    - Reads runtime system information
    PID:3079
- /bin/bash
  /bin/bash -
  2⤵
  PID:3080
- - /usr/bin/sudo
    sudo -S touch .local_5245
    3⤵
    PID:3085
  - - /usr/bin/touch
      touch .local_5245
      4⤵
      Writes file to tmp directory
      PID:3086
- - /usr/bin/sudo
    sudo rm .local_5245
    3⤵
    PID:3090
  - - /usr/bin/rm
      rm .local_5245
      4⤵
      PID:3091
- - /usr/bin/sudo
    sudo killall -9 bssh
    3⤵
    PID:3098
  - - /usr/bin/killall
      killall -9 bssh
      4⤵
      PID:3099
- - /usr/bin/sudo
    sudo rm -rf /tmp/.an
    3⤵
    PID:3100
  - - /usr/bin/rm
      rm -rf /tmp/.an
      4⤵
      PID:3101
- - /usr/bin/sudo
    sudo killall -9 xm64
    3⤵
    PID:3102
  - - /usr/bin/killall
      killall -9 xm64
      4⤵
      PID:3103
- - /usr/bin/sudo
    sudo killall -9 rpc.idmapd
    3⤵
    PID:3104
  - - /usr/bin/killall
      killall -9 rpc.idmapd
      4⤵
      PID:3105
- - /usr/bin/sudo
    sudo rm -rf /tmp/.m2
    3⤵
    PID:3106
  - - /usr/bin/rm
      rm -rf /tmp/.m2
      4⤵
      PID:3107
- - /usr/bin/sudo
    sudo killall -9 xorgg
    3⤵
    PID:3108
  - - /usr/bin/killall
      killall -9 xorgg
      4⤵
      PID:3109
- - /usr/bin/sudo
    sudo rm -rf /tmp/seconfig
    3⤵
    PID:3110
  - - /usr/bin/rm
      rm -rf /tmp/seconfig
      4⤵
      PID:3111
- - /usr/bin/sudo
    sudo killall -9 crond64
    3⤵
    PID:3112
  - - /usr/bin/killall
      killall -9 crond64
      4⤵
      PID:3113
- - /usr/bin/sudo
    sudo killall -9 tsm
    3⤵
    PID:3114
  - - /usr/bin/killall
      killall -9 tsm
      4⤵
      PID:3115
- - /usr/bin/sudo
    sudo rm -rf /tmp/.ssh
    3⤵
    PID:3116
  - - /usr/bin/rm
      rm -rf /tmp/.ssh
      4⤵
      PID:3117
- - /usr/bin/sudo
    sudo rm -rf /tmp/.java
    3⤵
    PID:3118
  - - /usr/bin/rm
      rm -rf /tmp/.java
      4⤵
      PID:3119
- - /usr/bin/sudo
    sudo rm -rf /tmp/.iolanda
    3⤵
    PID:3120
  - - /usr/bin/rm
      rm -rf /tmp/.iolanda
      4⤵
      PID:3121
- - /usr/bin/sudo
    sudo pkill test.mod
    3⤵
    PID:3122
  - - /usr/bin/pkill
      pkill test.mod
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:3123
- - /usr/bin/sudo
    sudo pkill daemon.i686.mod
    3⤵
    PID:3124
  - - /usr/bin/pkill
      pkill daemon.i686.mod
      4⤵
      Reads runtime system information
      PID:3125
- - /usr/bin/sudo
    sudo pkill daemon.armv4l.mod
    3⤵
    PID:3126
  - - /usr/bin/pkill
      pkill daemon.armv4l.mod
      4⤵
      PID:3127
- - /usr/bin/sudo
    sudo pkill daemon.mips.mod
    3⤵
    PID:3128
  - - /usr/bin/pkill
      pkill daemon.mips.mod
      4⤵
      PID:3143
- - /usr/bin/sudo
    sudo pkill daemon.mipsel.mod
    3⤵
    PID:3144
  - - /usr/bin/pkill
      pkill daemon.mipsel.mod
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:3145
- - /usr/bin/sudo
    sudo rm -rf /tmp/.xs
    3⤵
    PID:3146
  - - /usr/bin/rm
      rm -rf /tmp/.xs
      4⤵
      PID:3147
- - /usr/bin/sudo
    sudo pkill ld-linux-x86-64
    3⤵
    PID:3148
  - - /usr/bin/pkill
      pkill ld-linux-x86-64
      4⤵
      Reads CPU attributes
      PID:3149
- - /usr/bin/rm
    rm -rf "/var/tmp/. *"
    3⤵
    PID:3150
- - /usr/bin/sudo
    sudo killall -9 "[atd]"
    3⤵
    PID:3187
  - - /usr/bin/killall
      killall -9 "[atd]"
      4⤵
      PID:3188
- - /usr/bin/sudo
    sudo rm -rf /tmp/.jk
    3⤵
    PID:3189
  - - /usr/bin/rm
      rm -rf /tmp/.jk
      4⤵
      PID:3190
- - /usr/bin/sudo
    sudo killall -9 "[ntpd]"
    3⤵
    PID:3191
  - - /usr/bin/killall
      killall -9 "[ntpd]"
      4⤵
      PID:3192
- - /usr/bin/sudo
    sudo killall -9 "[rpciod]"
    3⤵
    PID:3193
  - - /usr/bin/killall
      killall -9 "[rpciod]"
      4⤵
      PID:3194
- - /usr/bin/sudo
    sudo killall -9 "[ext4-dio-unwrit]"
    3⤵
    PID:3195
  - - /usr/bin/killall
      killall -9 "[ext4-dio-unwrit]"
      4⤵
      PID:3196
- - /usr/bin/sudo
    sudo rm -rf "/tmp/.xm*"
    3⤵
    PID:3197
  - - /usr/bin/rm
      rm -rf "/tmp/.xm*"
      4⤵
      PID:3198
- - /usr/bin/pidof
    pidof libexec
    3⤵
    PID:3200
- /usr/bin/free
  free -m
  2⤵
  PID:3199
- /usr/bin/uptime
  uptime
  2⤵
  PID:3201
- /bin/bash
  /bin/bash -
  2⤵
  PID:3202
- - /usr/bin/sudo
    sudo -S touch .local_774
    3⤵
    PID:3207
  - - /usr/bin/touch
      touch .local_774
      4⤵
      Writes file to tmp directory
      PID:3208
- - /usr/bin/sudo
    sudo rm .local_774
    3⤵
    PID:3212
  - - /usr/bin/rm
      rm .local_774
      4⤵
      PID:3213
- - /usr/bin/sudo
    sudo killall -9 bssh
    3⤵
    PID:3220
  - - /usr/bin/killall
      killall -9 bssh
      4⤵
      Reads runtime system information
      PID:3221
- - /usr/bin/sudo
    sudo rm -rf /tmp/.an
    3⤵
    PID:3222
  - - /usr/bin/rm
      rm -rf /tmp/.an
      4⤵
      PID:3223
- - /usr/bin/sudo
    sudo killall -9 xm64
    3⤵
    PID:3224
  - - /usr/bin/killall
      killall -9 xm64
      4⤵
      PID:3225
- - /usr/bin/sudo
    sudo killall -9 rpc.idmapd
    3⤵
    PID:3226
  - - /usr/bin/killall
      killall -9 rpc.idmapd
      4⤵
      PID:3227
- - /usr/bin/sudo
    sudo rm -rf /tmp/.m2
    3⤵
    PID:3228
  - - /usr/bin/rm
      rm -rf /tmp/.m2
      4⤵
      PID:3229
- - /usr/bin/sudo
    sudo killall -9 xorgg
    3⤵
    PID:3230
  - - /usr/bin/killall
      killall -9 xorgg
      4⤵
      PID:3231
- - /usr/bin/sudo
    sudo rm -rf /tmp/seconfig
    3⤵
    PID:3232
  - - /usr/bin/rm
      rm -rf /tmp/seconfig
      4⤵
      PID:3233
- - /usr/bin/sudo
    sudo killall -9 crond64
    3⤵
    PID:3234
  - - /usr/bin/killall
      killall -9 crond64
      4⤵
      PID:3235
- - /usr/bin/sudo
    sudo killall -9 tsm
    3⤵
    PID:3236
  - - /usr/bin/killall
      killall -9 tsm
      4⤵
      PID:3237
- - /usr/bin/sudo
    sudo rm -rf /tmp/.ssh
    3⤵
    PID:3238

/bin/bash
/bin/bash -
1⤵
PID:1527
- /usr/bin/sudo
  sudo -S touch .local_14759
  2⤵
  PID:1534
- - /usr/bin/touch
    touch .local_14759
    3⤵
    - Writes file to tmp directory
    PID:1548
- /usr/bin/sudo
  sudo rm .local_14759
  2⤵
  PID:1552
- - /usr/bin/rm
    rm .local_14759
    3⤵
    PID:1554
- /usr/bin/sudo
  sudo killall -9 bssh
  2⤵
  PID:1591
- - /usr/bin/killall
    killall -9 bssh
    3⤵
    PID:1610
- /usr/bin/sudo
  sudo rm -rf /tmp/.an
  2⤵
  PID:1626
- - /usr/bin/rm
    rm -rf /tmp/.an
    3⤵
    PID:1631
- /usr/bin/sudo
  sudo killall -9 xm64
  2⤵
  PID:1635
- - /usr/bin/killall
    killall -9 xm64
    3⤵
    PID:1640
- /usr/bin/sudo
  sudo killall -9 rpc.idmapd
  2⤵
  PID:1646
- - /usr/bin/killall
    killall -9 rpc.idmapd
    3⤵
    PID:1652
- /usr/bin/sudo
  sudo rm -rf /tmp/.m2
  2⤵
  PID:1660
- - /usr/bin/rm
    rm -rf /tmp/.m2
    3⤵
    PID:1686
- /usr/bin/sudo
  sudo killall -9 xorgg
  2⤵
  PID:1689
- - /usr/bin/killall
    killall -9 xorgg
    3⤵
    PID:1697
- /usr/bin/sudo
  sudo rm -rf /tmp/seconfig
  2⤵
  PID:1702
- - /usr/bin/rm
    rm -rf /tmp/seconfig
    3⤵
    PID:1708
- /usr/bin/sudo
  sudo killall -9 crond64
  2⤵
  PID:1709
- - /usr/bin/killall
    killall -9 crond64
    3⤵
    PID:1722
- /usr/bin/sudo
  sudo killall -9 tsm
  2⤵
  PID:1729
- - /usr/bin/killall
    killall -9 tsm
    3⤵
    PID:1736
- /usr/bin/sudo
  sudo rm -rf /tmp/.ssh
  2⤵
  PID:1743
- - /usr/bin/rm
    rm -rf /tmp/.ssh
    3⤵
    PID:1748
- /usr/bin/sudo
  sudo rm -rf /tmp/.java
  2⤵
  PID:1750
- - /usr/bin/rm
    rm -rf /tmp/.java
    3⤵
    PID:1763
- /usr/bin/sudo
  sudo rm -rf /tmp/.iolanda
  2⤵
  PID:1772
- - /usr/bin/rm
    rm -rf /tmp/.iolanda
    3⤵
    PID:1790
- /usr/bin/sudo
  sudo pkill test.mod
  2⤵
  PID:1791
- - /usr/bin/pkill
    pkill test.mod
    3⤵
    PID:1794
- /usr/bin/sudo
  sudo pkill daemon.i686.mod
  2⤵
  PID:1795
- - /usr/bin/pkill
    pkill daemon.i686.mod
    3⤵
    PID:1796
- /usr/bin/sudo
  sudo pkill daemon.armv4l.mod
  2⤵
  PID:1797
- - /usr/bin/pkill
    pkill daemon.armv4l.mod
    3⤵
    - Reads CPU attributes
    PID:1799
- /usr/bin/sudo
  sudo pkill daemon.mips.mod
  2⤵
  PID:1803
- - /usr/bin/pkill
    pkill daemon.mips.mod
    3⤵
    PID:1805
- /usr/bin/sudo
  sudo pkill daemon.mipsel.mod
  2⤵
  PID:1809
- - /usr/bin/pkill
    pkill daemon.mipsel.mod
    3⤵
    PID:1810
- /usr/bin/sudo
  sudo rm -rf /tmp/.xs
  2⤵
  PID:1813
- - /usr/bin/rm
    rm -rf /tmp/.xs
    3⤵
    PID:1816
- /usr/bin/sudo
  sudo pkill ld-linux-x86-64
  2⤵
  PID:1818
- - /usr/bin/pkill
    pkill ld-linux-x86-64
    3⤵
    PID:1819
- /usr/bin/rm
  rm -rf "/var/tmp/. *"
  2⤵
  PID:1823
- /usr/bin/sudo
  sudo killall -9 "[atd]"
  2⤵
  PID:1903
- - /usr/bin/killall
    killall -9 "[atd]"
    3⤵
    PID:1904
- /usr/bin/sudo
  sudo rm -rf /tmp/.jk
  2⤵
  PID:1905
- - /usr/bin/rm
    rm -rf /tmp/.jk
    3⤵
    PID:1906
- /usr/bin/sudo
  sudo killall -9 "[ntpd]"
  2⤵
  PID:1907
- - /usr/bin/killall
    killall -9 "[ntpd]"
    3⤵
    PID:1908
- /usr/bin/sudo
  sudo killall -9 "[rpciod]"
  2⤵
  PID:1909
- - /usr/bin/killall
    killall -9 "[rpciod]"
    3⤵
    PID:1910
- /usr/bin/sudo
  sudo killall -9 "[ext4-dio-unwrit]"
  2⤵
  PID:1911
- - /usr/bin/killall
    killall -9 "[ext4-dio-unwrit]"
    3⤵
    PID:1912
- /usr/bin/sudo
  sudo rm -rf "/tmp/.xm*"
  2⤵
  PID:1913
- - /usr/bin/rm
    rm -rf "/tmp/.xm*"
    3⤵
    PID:1914
- /usr/bin/pidof
  pidof libexec
  2⤵
  PID:1915

/usr/bin/wc
wc -l
1⤵
PID:1532

/usr/bin/which
which sudo
1⤵
PID:1531

/usr/bin/grep
grep -c root
1⤵
PID:1551

/usr/bin/ls
ls -l .local_14759
1⤵
PID:1550

/usr/bin/grep
grep "./crond -t=all"
1⤵
PID:1558

/usr/bin/sudo
sudo ps auxff
1⤵
PID:1557
- /usr/bin/ps
  ps auxff
  2⤵
  - Reads CPU attributes
  PID:1565

/usr/bin/grep
grep -v grep
1⤵
PID:1559

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:1560

/usr/bin/sudo
sudo ps auxf
1⤵
PID:1825
- /usr/bin/ps
  ps auxf
  2⤵
  PID:1831

/usr/bin/grep
grep xmr
1⤵
PID:1826

/usr/bin/grep
grep -v grep
1⤵
PID:1827

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:1828

/usr/bin/sudo
sudo ps auxf
1⤵
- Reads runtime system information
PID:1841
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  PID:1847

/usr/bin/grep
grep cryptonight
1⤵
PID:1842

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:1844

/usr/bin/grep
grep -v grep
1⤵
PID:1843

/usr/bin/grep
grep -v grep
1⤵
PID:1866

/usr/bin/sudo
sudo ps auxf
1⤵
PID:1864
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads runtime system information
  PID:1877

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:1867

/usr/bin/grep
grep stratum
1⤵
PID:1865

/usr/bin/grep
grep -v grep
1⤵
PID:1886

/usr/bin/grep
grep dbus-daemon--system
1⤵
PID:1885

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:1887

/usr/bin/sudo
sudo ps auxf
1⤵
PID:1884
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  PID:1888

/usr/bin/sudo
sudo ps auxf
1⤵
PID:1890
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads runtime system information
  PID:1896

/usr/bin/grep
grep -v grep
1⤵
PID:1892

/usr/bin/grep
grep "\\[\\]"
1⤵
PID:1891

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:1893

/usr/bin/free
free -m
1⤵
PID:1894

/usr/bin/uptime
uptime
1⤵
PID:1895

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:1901

/usr/bin/grep
grep -v grep
1⤵
PID:1900

/usr/bin/grep
grep xm64
1⤵
PID:1899

/usr/bin/sudo
sudo ps auxf
1⤵
PID:1898
- /usr/bin/ps
  ps auxf
  2⤵
  PID:1902

/usr/bin/free
free -m
1⤵
PID:2026

/usr/bin/uptime
uptime
1⤵
PID:2027

/bin/bash
/bin/bash -
1⤵
PID:2028
- /usr/bin/sudo
  sudo -S touch .local_16274
  2⤵
  PID:2033
- - /usr/bin/touch
    touch .local_16274
    3⤵
    - Writes file to tmp directory
    PID:2034
- /usr/bin/sudo
  sudo rm .local_16274
  2⤵
  PID:2038
- - /usr/bin/rm
    rm .local_16274
    3⤵
    PID:2039
- /usr/bin/sudo
  sudo killall -9 bssh
  2⤵
  PID:2046
- - /usr/bin/killall
    killall -9 bssh
    3⤵
    PID:2047
- /usr/bin/sudo
  sudo rm -rf /tmp/.an
  2⤵
  PID:2048
- - /usr/bin/rm
    rm -rf /tmp/.an
    3⤵
    PID:2049
- /usr/bin/sudo
  sudo killall -9 xm64
  2⤵
  PID:2050
- - /usr/bin/killall
    killall -9 xm64
    3⤵
    PID:2051
- /usr/bin/sudo
  sudo killall -9 rpc.idmapd
  2⤵
  PID:2052
- - /usr/bin/killall
    killall -9 rpc.idmapd
    3⤵
    - Reads runtime system information
    PID:2053
- /usr/bin/sudo
  sudo rm -rf /tmp/.m2
  2⤵
  PID:2054
- - /usr/bin/rm
    rm -rf /tmp/.m2
    3⤵
    PID:2055
- /usr/bin/sudo
  sudo killall -9 xorgg
  2⤵
  PID:2056
- - /usr/bin/killall
    killall -9 xorgg
    3⤵
    PID:2057
- /usr/bin/sudo
  sudo rm -rf /tmp/seconfig
  2⤵
  PID:2058
- - /usr/bin/rm
    rm -rf /tmp/seconfig
    3⤵
    PID:2059
- /usr/bin/sudo
  sudo killall -9 crond64
  2⤵
  PID:2060
- - /usr/bin/killall
    killall -9 crond64
    3⤵
    PID:2061
- /usr/bin/sudo
  sudo killall -9 tsm
  2⤵
  PID:2062
- - /usr/bin/killall
    killall -9 tsm
    3⤵
    PID:2063
- /usr/bin/sudo
  sudo rm -rf /tmp/.ssh
  2⤵
  PID:2064
- - /usr/bin/rm
    rm -rf /tmp/.ssh
    3⤵
    PID:2065
- /usr/bin/sudo
  sudo rm -rf /tmp/.java
  2⤵
  PID:2066
- - /usr/bin/rm
    rm -rf /tmp/.java
    3⤵
    PID:2067
- /usr/bin/sudo
  sudo rm -rf /tmp/.iolanda
  2⤵
  PID:2068
- - /usr/bin/rm
    rm -rf /tmp/.iolanda
    3⤵
    PID:2069
- /usr/bin/sudo
  sudo pkill test.mod
  2⤵
  PID:2070
- - /usr/bin/pkill
    pkill test.mod
    3⤵
    PID:2071
- /usr/bin/sudo
  sudo pkill daemon.i686.mod
  2⤵
  PID:2072
- - /usr/bin/pkill
    pkill daemon.i686.mod
    3⤵
    PID:2073
- /usr/bin/sudo
  sudo pkill daemon.armv4l.mod
  2⤵
  PID:2074
- - /usr/bin/pkill
    pkill daemon.armv4l.mod
    3⤵
    PID:2075
- /usr/bin/sudo
  sudo pkill daemon.mips.mod
  2⤵
  PID:2076
- - /usr/bin/pkill
    pkill daemon.mips.mod
    3⤵
    PID:2077
- /usr/bin/sudo
  sudo pkill daemon.mipsel.mod
  2⤵
  PID:2078
- - /usr/bin/pkill
    pkill daemon.mipsel.mod
    3⤵
    PID:2079
- /usr/bin/sudo
  sudo rm -rf /tmp/.xs
  2⤵
  PID:2080
- - /usr/bin/rm
    rm -rf /tmp/.xs
    3⤵
    PID:2081
- /usr/bin/sudo
  sudo pkill ld-linux-x86-64
  2⤵
  PID:2082
- - /usr/bin/pkill
    pkill ld-linux-x86-64
    3⤵
    PID:2083
- /usr/bin/rm
  rm -rf "/var/tmp/. *"
  2⤵
  PID:2084
- /usr/bin/sudo
  sudo killall -9 "[atd]"
  2⤵
  PID:2121
- - /usr/bin/killall
    killall -9 "[atd]"
    3⤵
    PID:2122
- /usr/bin/sudo
  sudo rm -rf /tmp/.jk
  2⤵
  PID:2123
- - /usr/bin/rm
    rm -rf /tmp/.jk
    3⤵
    PID:2124
- /usr/bin/sudo
  sudo killall -9 "[ntpd]"
  2⤵
  PID:2125
- - /usr/bin/killall
    killall -9 "[ntpd]"
    3⤵
    PID:2126
- /usr/bin/sudo
  sudo killall -9 "[rpciod]"
  2⤵
  PID:2127
- - /usr/bin/killall
    killall -9 "[rpciod]"
    3⤵
    PID:2128
- /usr/bin/sudo
  sudo killall -9 "[ext4-dio-unwrit]"
  2⤵
  PID:2129
- - /usr/bin/killall
    killall -9 "[ext4-dio-unwrit]"
    3⤵
    PID:2130
- /usr/bin/sudo
  sudo rm -rf "/tmp/.xm*"
  2⤵
  PID:2131
- - /usr/bin/rm
    rm -rf "/tmp/.xm*"
    3⤵
    PID:2132
- /usr/bin/pidof
  pidof libexec
  2⤵
  PID:2133

/usr/bin/wc
wc -l
1⤵
PID:2031

/usr/bin/which
which sudo
1⤵
PID:2030

/usr/bin/grep
grep -c root
1⤵
PID:2037

/usr/bin/ls
ls -l .local_16274
1⤵
PID:2036

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2044

/usr/bin/grep
grep -v grep
1⤵
PID:2043

/usr/bin/grep
grep "./crond -t=all"
1⤵
PID:2042

/usr/bin/sudo
sudo ps auxff
1⤵
PID:2041
- /usr/bin/ps
  ps auxff
  2⤵
  PID:2045

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2089

/usr/bin/grep
grep -v grep
1⤵
PID:2088

/usr/bin/grep
grep xmr
1⤵
PID:2087

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2086
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  PID:2090

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2095

/usr/bin/grep
grep -v grep
1⤵
PID:2094

/usr/bin/grep
grep cryptonight
1⤵
PID:2093

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2092
- /usr/bin/ps
  ps auxf
  2⤵
  PID:2096

/usr/bin/grep
grep -v grep
1⤵
PID:2100

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2101

/usr/bin/grep
grep stratum
1⤵
PID:2099

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2098
- /usr/bin/ps
  ps auxf
  2⤵
  PID:2102

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2107

/usr/bin/grep
grep -v grep
1⤵
PID:2106

/usr/bin/grep
grep dbus-daemon--system
1⤵
PID:2105

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2104
- /usr/bin/ps
  ps auxf
  2⤵
  PID:2108

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2113

/usr/bin/grep
grep -v grep
1⤵
PID:2112

/usr/bin/grep
grep "\\[\\]"
1⤵
PID:2111

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2110
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  PID:2114

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2119

/usr/bin/grep
grep -v grep
1⤵
PID:2118

/usr/bin/grep
grep xm64
1⤵
PID:2117

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2116
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  PID:2120

/bin/bash
/bin/bash -
1⤵
PID:2134
- /usr/bin/sudo
  sudo -S touch .local_1252
  2⤵
  PID:2139
- - /usr/bin/touch
    touch .local_1252
    3⤵
    - Writes file to tmp directory
    PID:2140
- /usr/bin/sudo
  sudo rm .local_1252
  2⤵
  PID:2144
- - /usr/bin/rm
    rm .local_1252
    3⤵
    PID:2145
- /usr/bin/sudo
  sudo killall -9 bssh
  2⤵
  PID:2152
- - /usr/bin/killall
    killall -9 bssh
    3⤵
    PID:2153
- /usr/bin/sudo
  sudo rm -rf /tmp/.an
  2⤵
  PID:2154
- - /usr/bin/rm
    rm -rf /tmp/.an
    3⤵
    PID:2155
- /usr/bin/sudo
  sudo killall -9 xm64
  2⤵
  PID:2156
- - /usr/bin/killall
    killall -9 xm64
    3⤵
    PID:2157
- /usr/bin/sudo
  sudo killall -9 rpc.idmapd
  2⤵
  PID:2158
- - /usr/bin/killall
    killall -9 rpc.idmapd
    3⤵
    PID:2159
- /usr/bin/sudo
  sudo rm -rf /tmp/.m2
  2⤵
  PID:2160
- - /usr/bin/rm
    rm -rf /tmp/.m2
    3⤵
    PID:2161
- /usr/bin/sudo
  sudo killall -9 xorgg
  2⤵
  PID:2162
- - /usr/bin/killall
    killall -9 xorgg
    3⤵
    PID:2163
- /usr/bin/sudo
  sudo rm -rf /tmp/seconfig
  2⤵
  PID:2164
- - /usr/bin/rm
    rm -rf /tmp/seconfig
    3⤵
    PID:2165
- /usr/bin/sudo
  sudo killall -9 crond64
  2⤵
  PID:2166
- - /usr/bin/killall
    killall -9 crond64
    3⤵
    PID:2167
- /usr/bin/sudo
  sudo killall -9 tsm
  2⤵
  PID:2168
- - /usr/bin/killall
    killall -9 tsm
    3⤵
    PID:2169
- /usr/bin/sudo
  sudo rm -rf /tmp/.ssh
  2⤵
  PID:2170
- - /usr/bin/rm
    rm -rf /tmp/.ssh
    3⤵
    PID:2171
- /usr/bin/sudo
  sudo rm -rf /tmp/.java
  2⤵
  PID:2172
- - /usr/bin/rm
    rm -rf /tmp/.java
    3⤵
    PID:2173
- /usr/bin/sudo
  sudo rm -rf /tmp/.iolanda
  2⤵
  PID:2174
- - /usr/bin/rm
    rm -rf /tmp/.iolanda
    3⤵
    PID:2175
- /usr/bin/sudo
  sudo pkill test.mod
  2⤵
  PID:2176
- - /usr/bin/pkill
    pkill test.mod
    3⤵
    PID:2177
- /usr/bin/sudo
  sudo pkill daemon.i686.mod
  2⤵
  PID:2178
- - /usr/bin/pkill
    pkill daemon.i686.mod
    3⤵
    PID:2179
- /usr/bin/sudo
  sudo pkill daemon.armv4l.mod
  2⤵
  PID:2180
- - /usr/bin/pkill
    pkill daemon.armv4l.mod
    3⤵
    PID:2181
- /usr/bin/sudo
  sudo pkill daemon.mips.mod
  2⤵
  PID:2182
- - /usr/bin/pkill
    pkill daemon.mips.mod
    3⤵
    PID:2183
- /usr/bin/sudo
  sudo pkill daemon.mipsel.mod
  2⤵
  PID:2184
- - /usr/bin/pkill
    pkill daemon.mipsel.mod
    3⤵
    - Reads CPU attributes
    PID:2185
- /usr/bin/sudo
  sudo rm -rf /tmp/.xs
  2⤵
  PID:2186
- - /usr/bin/rm
    rm -rf /tmp/.xs
    3⤵
    PID:2187
- /usr/bin/sudo
  sudo pkill ld-linux-x86-64
  2⤵
  PID:2188
- - /usr/bin/pkill
    pkill ld-linux-x86-64
    3⤵
    PID:2189
- /usr/bin/rm
  rm -rf "/var/tmp/. *"
  2⤵
  PID:2190
- /usr/bin/sudo
  sudo killall -9 "[atd]"
  2⤵
  PID:2227
- - /usr/bin/killall
    killall -9 "[atd]"
    3⤵
    PID:2228
- /usr/bin/sudo
  sudo rm -rf /tmp/.jk
  2⤵
  PID:2229
- - /usr/bin/rm
    rm -rf /tmp/.jk
    3⤵
    PID:2230
- /usr/bin/sudo
  sudo killall -9 "[ntpd]"
  2⤵
  PID:2231
- - /usr/bin/killall
    killall -9 "[ntpd]"
    3⤵
    PID:2232
- /usr/bin/sudo
  sudo killall -9 "[rpciod]"
  2⤵
  PID:2233
- - /usr/bin/killall
    killall -9 "[rpciod]"
    3⤵
    PID:2234
- /usr/bin/sudo
  sudo killall -9 "[ext4-dio-unwrit]"
  2⤵
  PID:2235
- - /usr/bin/killall
    killall -9 "[ext4-dio-unwrit]"
    3⤵
    PID:2236
- /usr/bin/sudo
  sudo rm -rf "/tmp/.xm*"
  2⤵
  PID:2237
- - /usr/bin/rm
    rm -rf "/tmp/.xm*"
    3⤵
    PID:2238
- /usr/bin/pidof
  pidof libexec
  2⤵
  PID:2239

/usr/bin/wc
wc -l
1⤵
PID:2137

/usr/bin/which
which sudo
1⤵
PID:2136

/usr/bin/grep
grep -c root
1⤵
PID:2143

/usr/bin/ls
ls -l .local_1252
1⤵
PID:2142

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2150

/usr/bin/grep
grep "./crond -t=all"
1⤵
PID:2148

/usr/bin/grep
grep -v grep
1⤵
PID:2149

/usr/bin/sudo
sudo ps auxff
1⤵
PID:2147
- /usr/bin/ps
  ps auxff
  2⤵
  - Reads runtime system information
  PID:2151

/usr/bin/grep
grep -v grep
1⤵
PID:2194

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2195

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2192
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  PID:2196

/usr/bin/grep
grep xmr
1⤵
PID:2193

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2201

/usr/bin/grep
grep -v grep
1⤵
PID:2200

/usr/bin/grep
grep cryptonight
1⤵
PID:2199

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2198
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  PID:2202

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2207

/usr/bin/grep
grep -v grep
1⤵
PID:2206

/usr/bin/grep
grep stratum
1⤵
PID:2205

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2204
- /usr/bin/ps
  ps auxf
  2⤵
  PID:2208

/usr/bin/grep
grep -v grep
1⤵
PID:2212

/usr/bin/grep
grep dbus-daemon--system
1⤵
PID:2211

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2210
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads runtime system information
  PID:2214

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2213

/usr/bin/grep
grep -v grep
1⤵
PID:2218

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2219

/usr/bin/grep
grep "\\[\\]"
1⤵
PID:2217

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2216
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  PID:2220

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2225

/usr/bin/grep
grep -v grep
1⤵
PID:2224

/usr/bin/grep
grep xm64
1⤵
PID:2223

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2222
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads runtime system information
  PID:2226

/usr/bin/free
free -m
1⤵
PID:2240

/usr/bin/uptime
uptime
1⤵
PID:2241

/usr/bin/wc
wc -l
1⤵
PID:2304

/usr/bin/which
which sudo
1⤵
PID:2303

/usr/bin/grep
grep -c root
1⤵
PID:2310

/usr/bin/ls
ls -l .local_3864
1⤵
PID:2309

/usr/bin/sudo
sudo ps auxff
1⤵
PID:2314
- /usr/bin/ps
  ps auxff
  2⤵
  PID:2318

/usr/bin/grep
grep "./crond -t=all"
1⤵
PID:2315

/usr/bin/grep
grep -v grep
1⤵
PID:2316

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2317

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2363

/usr/bin/grep
grep -v grep
1⤵
PID:2362

/usr/bin/grep
grep xmr
1⤵
PID:2361

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2360
- /usr/bin/ps
  ps auxf
  2⤵
  PID:2364

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2368
- /usr/bin/ps
  ps auxf
  2⤵
  PID:2372

/usr/bin/grep
grep -v grep
1⤵
PID:2370

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2371

/usr/bin/grep
grep cryptonight
1⤵
PID:2369

/usr/bin/grep
grep -v grep
1⤵
PID:2376

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2377

/usr/bin/grep
grep stratum
1⤵
PID:2375

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2374
- /usr/bin/ps
  ps auxf
  2⤵
  PID:2378

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2383

/usr/bin/grep
grep -v grep
1⤵
PID:2382

/usr/bin/grep
grep dbus-daemon--system
1⤵
PID:2381

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2380
- /usr/bin/ps
  ps auxf
  2⤵
  PID:2384

/usr/bin/grep
grep -v grep
1⤵
PID:2388

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2386
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads runtime system information
  PID:2390

/usr/bin/grep
grep "\\[\\]"
1⤵
PID:2387

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2389

/usr/bin/grep
grep xm64
1⤵
PID:2393

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2392
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  PID:2396

/usr/bin/grep
grep -v grep
1⤵
PID:2394

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2395

/bin/bash
/bin/bash -
1⤵
PID:2410
- /usr/bin/sudo
  sudo -S touch .local_26978
  2⤵
  PID:2417
- - /usr/bin/touch
    touch .local_26978
    3⤵
    - Writes file to tmp directory
    PID:2418
- /usr/bin/sudo
  sudo rm .local_26978
  2⤵
  PID:2422
- - /usr/bin/rm
    rm .local_26978
    3⤵
    PID:2423
- /usr/bin/sudo
  sudo killall -9 bssh
  2⤵
  PID:2436
- - /usr/bin/killall
    killall -9 bssh
    3⤵
    PID:2437
- /usr/bin/sudo
  sudo rm -rf /tmp/.an
  2⤵
  PID:2438
- - /usr/bin/rm
    rm -rf /tmp/.an
    3⤵
    PID:2439
- /usr/bin/sudo
  sudo killall -9 xm64
  2⤵
  PID:2440
- - /usr/bin/killall
    killall -9 xm64
    3⤵
    PID:2441
- /usr/bin/sudo
  sudo killall -9 rpc.idmapd
  2⤵
  PID:2442
- - /usr/bin/killall
    killall -9 rpc.idmapd
    3⤵
    PID:2443
- /usr/bin/sudo
  sudo rm -rf /tmp/.m2
  2⤵
  PID:2444
- - /usr/bin/rm
    rm -rf /tmp/.m2
    3⤵
    PID:2445
- /usr/bin/sudo
  sudo killall -9 xorgg
  2⤵
  PID:2446
- - /usr/bin/killall
    killall -9 xorgg
    3⤵
    PID:2447
- /usr/bin/sudo
  sudo rm -rf /tmp/seconfig
  2⤵
  PID:2448
- - /usr/bin/rm
    rm -rf /tmp/seconfig
    3⤵
    PID:2449
- /usr/bin/sudo
  sudo killall -9 crond64
  2⤵
  PID:2450
- - /usr/bin/killall
    killall -9 crond64
    3⤵
    - Reads runtime system information
    PID:2451
- /usr/bin/sudo
  sudo killall -9 tsm
  2⤵
  PID:2452
- - /usr/bin/killall
    killall -9 tsm
    3⤵
    PID:2453
- /usr/bin/sudo
  sudo rm -rf /tmp/.ssh
  2⤵
  PID:2454
- - /usr/bin/rm
    rm -rf /tmp/.ssh
    3⤵
    PID:2455
- /usr/bin/sudo
  sudo rm -rf /tmp/.java
  2⤵
  PID:2456
- - /usr/bin/rm
    rm -rf /tmp/.java
    3⤵
    PID:2457
- /usr/bin/sudo
  sudo rm -rf /tmp/.iolanda
  2⤵
  PID:2458
- - /usr/bin/rm
    rm -rf /tmp/.iolanda
    3⤵
    PID:2459
- /usr/bin/sudo
  sudo pkill test.mod
  2⤵
  PID:2460
- - /usr/bin/pkill
    pkill test.mod
    3⤵
    PID:2461
- /usr/bin/sudo
  sudo pkill daemon.i686.mod
  2⤵
  PID:2462
- - /usr/bin/pkill
    pkill daemon.i686.mod
    3⤵
    PID:2463
- /usr/bin/sudo
  sudo pkill daemon.armv4l.mod
  2⤵
  PID:2464
- - /usr/bin/pkill
    pkill daemon.armv4l.mod
    3⤵
    PID:2465
- /usr/bin/sudo
  sudo pkill daemon.mips.mod
  2⤵
  PID:2466
- - /usr/bin/pkill
    pkill daemon.mips.mod
    3⤵
    PID:2467
- /usr/bin/sudo
  sudo pkill daemon.mipsel.mod
  2⤵
  PID:2468
- - /usr/bin/pkill
    pkill daemon.mipsel.mod
    3⤵
    - Reads runtime system information
    PID:2469
- /usr/bin/sudo
  sudo rm -rf /tmp/.xs
  2⤵
  PID:2470
- - /usr/bin/rm
    rm -rf /tmp/.xs
    3⤵
    PID:2471
- /usr/bin/sudo
  sudo pkill ld-linux-x86-64
  2⤵
  PID:2472
- - /usr/bin/pkill
    pkill ld-linux-x86-64
    3⤵
    PID:2473
- /usr/bin/rm
  rm -rf "/var/tmp/. *"
  2⤵
  PID:2474
- /usr/bin/sudo
  sudo killall -9 "[atd]"
  2⤵
  PID:2513
- - /usr/bin/killall
    killall -9 "[atd]"
    3⤵
    PID:2514
- /usr/bin/sudo
  sudo rm -rf /tmp/.jk
  2⤵
  PID:2515
- - /usr/bin/rm
    rm -rf /tmp/.jk
    3⤵
    PID:2516
- /usr/bin/sudo
  sudo killall -9 "[ntpd]"
  2⤵
  PID:2517
- - /usr/bin/killall
    killall -9 "[ntpd]"
    3⤵
    - Reads runtime system information
    PID:2518
- /usr/bin/sudo
  sudo killall -9 "[rpciod]"
  2⤵
  PID:2519
- - /usr/bin/killall
    killall -9 "[rpciod]"
    3⤵
    PID:2520
- /usr/bin/sudo
  sudo killall -9 "[ext4-dio-unwrit]"
  2⤵
  PID:2521
- - /usr/bin/killall
    killall -9 "[ext4-dio-unwrit]"
    3⤵
    PID:2522
- /usr/bin/sudo
  sudo rm -rf "/tmp/.xm*"
  2⤵
  PID:2523
- - /usr/bin/rm
    rm -rf "/tmp/.xm*"
    3⤵
    PID:2524
- /usr/bin/pidof
  pidof libexec
  2⤵
  PID:2525

/usr/bin/free
free -m
1⤵
- Reads CPU attributes
PID:2411

/usr/bin/uptime
uptime
1⤵
PID:2412

/usr/bin/wc
wc -l
1⤵
PID:2415

/usr/bin/which
which sudo
1⤵
PID:2414

/usr/bin/grep
grep -c root
1⤵
PID:2421

/usr/bin/ls
ls -l .local_26978
1⤵
PID:2420

/usr/bin/sudo
sudo ps auxff
1⤵
PID:2425
- /usr/bin/ps
  ps auxff
  2⤵
  - Reads runtime system information
  PID:2435

/usr/bin/grep
grep -v grep
1⤵
PID:2427

/usr/bin/grep
grep "./crond -t=all"
1⤵
PID:2426

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2428

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2479

/usr/bin/grep
grep -v grep
1⤵
PID:2478

/usr/bin/grep
grep xmr
1⤵
PID:2477

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2476
- /usr/bin/ps
  ps auxf
  2⤵
  PID:2480

/usr/bin/grep
grep cryptonight
1⤵
PID:2483

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2485

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2482
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads runtime system information
  PID:2486

/usr/bin/grep
grep -v grep
1⤵
PID:2484

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2492

/usr/bin/grep
grep -v grep
1⤵
PID:2491

/usr/bin/grep
grep stratum
1⤵
PID:2490

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2489
- /usr/bin/ps
  ps auxf
  2⤵
  PID:2493

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2499

/usr/bin/grep
grep -v grep
1⤵
PID:2498

/usr/bin/grep
grep dbus-daemon--system
1⤵
PID:2497

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2496
- /usr/bin/ps
  ps auxf
  2⤵
  PID:2500

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2505

/usr/bin/grep
grep -v grep
1⤵
PID:2504

/usr/bin/grep
grep "\\[\\]"
1⤵
PID:2503

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2502
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads runtime system information
  PID:2506

/usr/bin/grep
grep xm64
1⤵
PID:2509

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2508
- /usr/bin/ps
  ps auxf
  2⤵
  PID:2512

/usr/bin/grep
grep -v grep
1⤵
PID:2510

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2511

/bin/bash
/bin/bash -
1⤵
PID:2531
- /usr/bin/sudo
  sudo -S touch .local_16214
  2⤵
  PID:2536
- - /usr/bin/touch
    touch .local_16214
    3⤵
    - Writes file to tmp directory
    PID:2537
- /usr/bin/sudo
  sudo rm .local_16214
  2⤵
  PID:2541
- - /usr/bin/rm
    rm .local_16214
    3⤵
    PID:2542
- /usr/bin/sudo
  sudo killall -9 bssh
  2⤵
  PID:2551
- - /usr/bin/killall
    killall -9 bssh
    3⤵
    PID:2552
- /usr/bin/sudo
  sudo rm -rf /tmp/.an
  2⤵
  PID:2553
- - /usr/bin/rm
    rm -rf /tmp/.an
    3⤵
    PID:2554
- /usr/bin/sudo
  sudo killall -9 xm64
  2⤵
  PID:2555
- - /usr/bin/killall
    killall -9 xm64
    3⤵
    PID:2556
- /usr/bin/sudo
  sudo killall -9 rpc.idmapd
  2⤵
  PID:2557
- - /usr/bin/killall
    killall -9 rpc.idmapd
    3⤵
    PID:2558
- /usr/bin/sudo
  sudo rm -rf /tmp/.m2
  2⤵
  PID:2559
- - /usr/bin/rm
    rm -rf /tmp/.m2
    3⤵
    PID:2560
- /usr/bin/sudo
  sudo killall -9 xorgg
  2⤵
  PID:2561
- - /usr/bin/killall
    killall -9 xorgg
    3⤵
    PID:2562
- /usr/bin/sudo
  sudo rm -rf /tmp/seconfig
  2⤵
  PID:2563
- - /usr/bin/rm
    rm -rf /tmp/seconfig
    3⤵
    PID:2564
- /usr/bin/sudo
  sudo killall -9 crond64
  2⤵
  PID:2565
- - /usr/bin/killall
    killall -9 crond64
    3⤵
    PID:2566
- /usr/bin/sudo
  sudo killall -9 tsm
  2⤵
  PID:2567
- - /usr/bin/killall
    killall -9 tsm
    3⤵
    PID:2568
- /usr/bin/sudo
  sudo rm -rf /tmp/.ssh
  2⤵
  PID:2569
- - /usr/bin/rm
    rm -rf /tmp/.ssh
    3⤵
    PID:2570
- /usr/bin/sudo
  sudo rm -rf /tmp/.java
  2⤵
  PID:2571
- - /usr/bin/rm
    rm -rf /tmp/.java
    3⤵
    PID:2572
- /usr/bin/sudo
  sudo rm -rf /tmp/.iolanda
  2⤵
  PID:2573
- - /usr/bin/rm
    rm -rf /tmp/.iolanda
    3⤵
    PID:2574
- /usr/bin/sudo
  sudo pkill test.mod
  2⤵
  PID:2575
- - /usr/bin/pkill
    pkill test.mod
    3⤵
    - Reads CPU attributes
    PID:2576
- /usr/bin/sudo
  sudo pkill daemon.i686.mod
  2⤵
  PID:2577
- - /usr/bin/pkill
    pkill daemon.i686.mod
    3⤵
    PID:2578
- /usr/bin/sudo
  sudo pkill daemon.armv4l.mod
  2⤵
  PID:2579
- - /usr/bin/pkill
    pkill daemon.armv4l.mod
    3⤵
    - Reads runtime system information
    PID:2580
- /usr/bin/sudo
  sudo pkill daemon.mips.mod
  2⤵
  PID:2581
- - /usr/bin/pkill
    pkill daemon.mips.mod
    3⤵
    - Reads CPU attributes
    PID:2582
- /usr/bin/sudo
  sudo pkill daemon.mipsel.mod
  2⤵
  PID:2584
- - /usr/bin/pkill
    pkill daemon.mipsel.mod
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:2585
- /usr/bin/sudo
  sudo rm -rf /tmp/.xs
  2⤵
  PID:2587
- - /usr/bin/rm
    rm -rf /tmp/.xs
    3⤵
    PID:2588
- /usr/bin/sudo
  sudo pkill ld-linux-x86-64
  2⤵
  PID:2589
- - /usr/bin/pkill
    pkill ld-linux-x86-64
    3⤵
    - Reads CPU attributes
    PID:2590
- /usr/bin/rm
  rm -rf "/var/tmp/. *"
  2⤵
  PID:2592
- /usr/bin/sudo
  sudo killall -9 "[atd]"
  2⤵
  PID:2637
- - /usr/bin/killall
    killall -9 "[atd]"
    3⤵
    - Reads runtime system information
    PID:2638
- /usr/bin/sudo
  sudo rm -rf /tmp/.jk
  2⤵
  PID:2639
- - /usr/bin/rm
    rm -rf /tmp/.jk
    3⤵
    PID:2641
- /usr/bin/sudo
  sudo killall -9 "[ntpd]"
  2⤵
  PID:2642
- - /usr/bin/killall
    killall -9 "[ntpd]"
    3⤵
    PID:2643
- /usr/bin/sudo
  sudo killall -9 "[rpciod]"
  2⤵
  PID:2644
- - /usr/bin/killall
    killall -9 "[rpciod]"
    3⤵
    PID:2645
- /usr/bin/sudo
  sudo killall -9 "[ext4-dio-unwrit]"
  2⤵
  PID:2647
- - /usr/bin/killall
    killall -9 "[ext4-dio-unwrit]"
    3⤵
    PID:2648
- /usr/bin/sudo
  sudo rm -rf "/tmp/.xm*"
  2⤵
  PID:2649
- - /usr/bin/rm
    rm -rf "/tmp/.xm*"
    3⤵
    PID:2650
- /usr/bin/pidof
  pidof libexec
  2⤵
  PID:2651

/usr/bin/wc
wc -l
1⤵
PID:2534

/usr/bin/which
which sudo
1⤵
PID:2533

/usr/bin/grep
grep -c root
1⤵
PID:2540

/usr/bin/ls
ls -l .local_16214
1⤵
PID:2539

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2547

/usr/bin/grep
grep -v grep
1⤵
PID:2546

/usr/bin/grep
grep "./crond -t=all"
1⤵
PID:2545

/usr/bin/sudo
sudo ps auxff
1⤵
PID:2544
- /usr/bin/ps
  ps auxff
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:2548

/usr/bin/free
free -m
1⤵
- Reads CPU attributes
PID:2549

/usr/bin/uptime
uptime
1⤵
PID:2550

/usr/bin/grep
grep -v grep
1⤵
PID:2596

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2597

/usr/bin/grep
grep xmr
1⤵
PID:2595

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2594
- /usr/bin/ps
  ps auxf
  2⤵
  PID:2598

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2604

/usr/bin/grep
grep -v grep
1⤵
PID:2603

/usr/bin/grep
grep cryptonight
1⤵
PID:2602

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2601
- /usr/bin/ps
  ps auxf
  2⤵
  PID:2605

/usr/bin/grep
grep -v grep
1⤵
PID:2610

/usr/bin/grep
grep stratum
1⤵
PID:2609

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2611

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2608
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:2613

/usr/bin/grep
grep -v grep
1⤵
PID:2617

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2618

/usr/bin/grep
grep dbus-daemon--system
1⤵
PID:2616

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2615
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:2620

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2623
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  PID:2627

/usr/bin/grep
grep -v grep
1⤵
PID:2625

/usr/bin/grep
grep "\\[\\]"
1⤵
PID:2624

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2626

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2633

/usr/bin/grep
grep -v grep
1⤵
PID:2632

/usr/bin/grep
grep xm64
1⤵
PID:2631

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2630
- /usr/bin/ps
  ps auxf
  2⤵
  PID:2635

/bin/bash
/bin/bash -
1⤵
PID:2672
- /usr/bin/sudo
  sudo -S touch .local_16840
  2⤵
  PID:2677
- - /usr/bin/touch
    touch .local_16840
    3⤵
    - Writes file to tmp directory
    PID:2694
- /usr/bin/sudo
  sudo rm .local_16840
  2⤵
  PID:2718
- - /usr/bin/rm
    rm .local_16840
    3⤵
    PID:2721
- /usr/bin/sudo
  sudo killall -9 bssh
  2⤵
  PID:2729
- - /usr/bin/killall
    killall -9 bssh
    3⤵
    PID:2730
- /usr/bin/sudo
  sudo rm -rf /tmp/.an
  2⤵
  PID:2731
- - /usr/bin/rm
    rm -rf /tmp/.an
    3⤵
    PID:2732
- /usr/bin/sudo
  sudo killall -9 xm64
  2⤵
  PID:2733
- - /usr/bin/killall
    killall -9 xm64
    3⤵
    PID:2734
- /usr/bin/sudo
  sudo killall -9 rpc.idmapd
  2⤵
  PID:2735
- - /usr/bin/killall
    killall -9 rpc.idmapd
    3⤵
    PID:2736
- /usr/bin/sudo
  sudo rm -rf /tmp/.m2
  2⤵
  PID:2737
- - /usr/bin/rm
    rm -rf /tmp/.m2
    3⤵
    PID:2738
- /usr/bin/sudo
  sudo killall -9 xorgg
  2⤵
  PID:2739
- - /usr/bin/killall
    killall -9 xorgg
    3⤵
    PID:2740
- /usr/bin/sudo
  sudo rm -rf /tmp/seconfig
  2⤵
  PID:2741
- - /usr/bin/rm
    rm -rf /tmp/seconfig
    3⤵
    PID:2742
- /usr/bin/sudo
  sudo killall -9 crond64
  2⤵
  PID:2743
- - /usr/bin/killall
    killall -9 crond64
    3⤵
    PID:2746
- /usr/bin/sudo
  sudo killall -9 tsm
  2⤵
  PID:2747
- - /usr/bin/killall
    killall -9 tsm
    3⤵
    PID:2748
- /usr/bin/sudo
  sudo rm -rf /tmp/.ssh
  2⤵
  PID:2749
- - /usr/bin/rm
    rm -rf /tmp/.ssh
    3⤵
    PID:2750
- /usr/bin/sudo
  sudo rm -rf /tmp/.java
  2⤵
  PID:2751
- - /usr/bin/rm
    rm -rf /tmp/.java
    3⤵
    PID:2752
- /usr/bin/sudo
  sudo rm -rf /tmp/.iolanda
  2⤵
  PID:2753
- - /usr/bin/rm
    rm -rf /tmp/.iolanda
    3⤵
    PID:2754
- /usr/bin/sudo
  sudo pkill test.mod
  2⤵
  PID:2755
- - /usr/bin/pkill
    pkill test.mod
    3⤵
    - Reads runtime system information
    PID:2756
- /usr/bin/sudo
  sudo pkill daemon.i686.mod
  2⤵
  PID:2757
- - /usr/bin/pkill
    pkill daemon.i686.mod
    3⤵
    - Reads CPU attributes
    PID:2758
- /usr/bin/sudo
  sudo pkill daemon.armv4l.mod
  2⤵
  PID:2759
- - /usr/bin/pkill
    pkill daemon.armv4l.mod
    3⤵
    PID:2760
- /usr/bin/sudo
  sudo pkill daemon.mips.mod
  2⤵
  PID:2761
- - /usr/bin/pkill
    pkill daemon.mips.mod
    3⤵
    PID:2762
- /usr/bin/sudo
  sudo pkill daemon.mipsel.mod
  2⤵
  PID:2763
- - /usr/bin/pkill
    pkill daemon.mipsel.mod
    3⤵
    - Reads CPU attributes
    PID:2765
- /usr/bin/sudo
  sudo rm -rf /tmp/.xs
  2⤵
  PID:2766
- - /usr/bin/rm
    rm -rf /tmp/.xs
    3⤵
    PID:2767
- /usr/bin/sudo
  sudo pkill ld-linux-x86-64
  2⤵
  PID:2768
- - /usr/bin/pkill
    pkill ld-linux-x86-64
    3⤵
    PID:2769
- /usr/bin/rm
  rm -rf "/var/tmp/. *"
  2⤵
  PID:2770
- /usr/bin/sudo
  sudo killall -9 "[atd]"
  2⤵
  PID:2807
- - /usr/bin/killall
    killall -9 "[atd]"
    3⤵
    - Reads runtime system information
    PID:2808
- /usr/bin/sudo
  sudo rm -rf /tmp/.jk
  2⤵
  PID:2809
- - /usr/bin/rm
    rm -rf /tmp/.jk
    3⤵
    PID:2810
- /usr/bin/sudo
  sudo killall -9 "[ntpd]"
  2⤵
  PID:2811
- - /usr/bin/killall
    killall -9 "[ntpd]"
    3⤵
    PID:2812
- /usr/bin/sudo
  sudo killall -9 "[rpciod]"
  2⤵
  PID:2813
- - /usr/bin/killall
    killall -9 "[rpciod]"
    3⤵
    PID:2814
- /usr/bin/sudo
  sudo killall -9 "[ext4-dio-unwrit]"
  2⤵
  PID:2815
- - /usr/bin/killall
    killall -9 "[ext4-dio-unwrit]"
    3⤵
    PID:2816
- /usr/bin/sudo
  sudo rm -rf "/tmp/.xm*"
  2⤵
  PID:2817
- - /usr/bin/rm
    rm -rf "/tmp/.xm*"
    3⤵
    PID:2818
- /usr/bin/pidof
  pidof libexec
  2⤵
  PID:2819

/usr/bin/wc
wc -l
1⤵
PID:2675

/usr/bin/which
which sudo
1⤵
PID:2674

/usr/bin/grep
grep -c root
1⤵
PID:2715

/usr/bin/ls
ls -l .local_16840
1⤵
PID:2714

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2726

/usr/bin/grep
grep "./crond -t=all"
1⤵
PID:2724

/usr/bin/sudo
sudo ps auxff
1⤵
PID:2723
- /usr/bin/ps
  ps auxff
  2⤵
  PID:2728

/usr/bin/grep
grep -v grep
1⤵
PID:2725

/usr/bin/free
free -m
1⤵
PID:2744

/usr/bin/uptime
uptime
1⤵
PID:2745

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2775

/usr/bin/grep
grep -v grep
1⤵
PID:2774

/usr/bin/grep
grep xmr
1⤵
PID:2773

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2772
- /usr/bin/ps
  ps auxf
  2⤵
  PID:2776

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2781

/usr/bin/grep
grep -v grep
1⤵
PID:2780

/usr/bin/grep
grep cryptonight
1⤵
PID:2779

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2778
- /usr/bin/ps
  ps auxf
  2⤵
  PID:2782

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2787

/usr/bin/grep
grep -v grep
1⤵
PID:2786

/usr/bin/grep
grep stratum
1⤵
PID:2785

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2784
- /usr/bin/ps
  ps auxf
  2⤵
  PID:2788

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2793

/usr/bin/grep
grep -v grep
1⤵
PID:2792

/usr/bin/grep
grep dbus-daemon--system
1⤵
PID:2791

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2790
- /usr/bin/ps
  ps auxf
  2⤵
  PID:2794

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2799

/usr/bin/grep
grep -v grep
1⤵
PID:2798

/usr/bin/grep
grep "\\[\\]"
1⤵
PID:2797

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2796
- /usr/bin/ps
  ps auxf
  2⤵
  PID:2800

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2805

/usr/bin/grep
grep -v grep
1⤵
PID:2804

/usr/bin/grep
grep xm64
1⤵
PID:2803

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2802
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  PID:2806

/bin/bash
/bin/bash -
1⤵
PID:2866
- /usr/bin/sudo
  sudo -S touch .local_21139
  2⤵
  PID:2871
- - /usr/bin/touch
    touch .local_21139
    3⤵
    - Writes file to tmp directory
    PID:2872
- /usr/bin/sudo
  sudo rm .local_21139
  2⤵
  PID:2876
- - /usr/bin/rm
    rm .local_21139
    3⤵
    PID:2877
- /usr/bin/sudo
  sudo killall -9 bssh
  2⤵
  PID:2884
- - /usr/bin/killall
    killall -9 bssh
    3⤵
    PID:2885
- /usr/bin/sudo
  sudo rm -rf /tmp/.an
  2⤵
  PID:2886
- - /usr/bin/rm
    rm -rf /tmp/.an
    3⤵
    PID:2887
- /usr/bin/sudo
  sudo killall -9 xm64
  2⤵
  PID:2888
- - /usr/bin/killall
    killall -9 xm64
    3⤵
    - Reads runtime system information
    PID:2889
- /usr/bin/sudo
  sudo killall -9 rpc.idmapd
  2⤵
  PID:2890
- - /usr/bin/killall
    killall -9 rpc.idmapd
    3⤵
    PID:2891
- /usr/bin/sudo
  sudo rm -rf /tmp/.m2
  2⤵
  PID:2892
- - /usr/bin/rm
    rm -rf /tmp/.m2
    3⤵
    PID:2893
- /usr/bin/sudo
  sudo killall -9 xorgg
  2⤵
  PID:2894
- - /usr/bin/killall
    killall -9 xorgg
    3⤵
    PID:2895
- /usr/bin/sudo
  sudo rm -rf /tmp/seconfig
  2⤵
  PID:2896
- - /usr/bin/rm
    rm -rf /tmp/seconfig
    3⤵
    PID:2897
- /usr/bin/sudo
  sudo killall -9 crond64
  2⤵
  PID:2898
- - /usr/bin/killall
    killall -9 crond64
    3⤵
    - Reads runtime system information
    PID:2899
- /usr/bin/sudo
  sudo killall -9 tsm
  2⤵
  PID:2900
- - /usr/bin/killall
    killall -9 tsm
    3⤵
    PID:2901
- /usr/bin/sudo
  sudo rm -rf /tmp/.ssh
  2⤵
  PID:2902
- - /usr/bin/rm
    rm -rf /tmp/.ssh
    3⤵
    PID:2903
- /usr/bin/sudo
  sudo rm -rf /tmp/.java
  2⤵
  PID:2904
- - /usr/bin/rm
    rm -rf /tmp/.java
    3⤵
    PID:2905
- /usr/bin/sudo
  sudo rm -rf /tmp/.iolanda
  2⤵
  PID:2906
- - /usr/bin/rm
    rm -rf /tmp/.iolanda
    3⤵
    PID:2907
- /usr/bin/sudo
  sudo pkill test.mod
  2⤵
  PID:2908
- - /usr/bin/pkill
    pkill test.mod
    3⤵
    - Reads runtime system information
    PID:2909
- /usr/bin/sudo
  sudo pkill daemon.i686.mod
  2⤵
  PID:2910
- - /usr/bin/pkill
    pkill daemon.i686.mod
    3⤵
    PID:2911
- /usr/bin/sudo
  sudo pkill daemon.armv4l.mod
  2⤵
  PID:2912
- - /usr/bin/pkill
    pkill daemon.armv4l.mod
    3⤵
    - Reads runtime system information
    PID:2913
- /usr/bin/sudo
  sudo pkill daemon.mips.mod
  2⤵
  PID:2914
- - /usr/bin/pkill
    pkill daemon.mips.mod
    3⤵
    - Reads runtime system information
    PID:2915
- /usr/bin/sudo
  sudo pkill daemon.mipsel.mod
  2⤵
  PID:2916
- - /usr/bin/pkill
    pkill daemon.mipsel.mod
    3⤵
    PID:2917
- /usr/bin/sudo
  sudo rm -rf /tmp/.xs
  2⤵
  PID:2918
- - /usr/bin/rm
    rm -rf /tmp/.xs
    3⤵
    PID:2919
- /usr/bin/sudo
  sudo pkill ld-linux-x86-64
  2⤵
  PID:2920
- - /usr/bin/pkill
    pkill ld-linux-x86-64
    3⤵
    - Reads CPU attributes
    PID:2921
- /usr/bin/rm
  rm -rf "/var/tmp/. *"
  2⤵
  PID:2922
- /usr/bin/sudo
  sudo killall -9 "[atd]"
  2⤵
  PID:2959
- - /usr/bin/killall
    killall -9 "[atd]"
    3⤵
    PID:2960
- /usr/bin/sudo
  sudo rm -rf /tmp/.jk
  2⤵
  PID:2961
- - /usr/bin/rm
    rm -rf /tmp/.jk
    3⤵
    PID:2962
- /usr/bin/sudo
  sudo killall -9 "[ntpd]"
  2⤵
  PID:2963
- - /usr/bin/killall
    killall -9 "[ntpd]"
    3⤵
    PID:2964
- /usr/bin/sudo
  sudo killall -9 "[rpciod]"
  2⤵
  PID:2965
- - /usr/bin/killall
    killall -9 "[rpciod]"
    3⤵
    PID:2966
- /usr/bin/sudo
  sudo killall -9 "[ext4-dio-unwrit]"
  2⤵
  PID:2967
- - /usr/bin/killall
    killall -9 "[ext4-dio-unwrit]"
    3⤵
    PID:2968
- /usr/bin/sudo
  sudo rm -rf "/tmp/.xm*"
  2⤵
  PID:2969
- - /usr/bin/rm
    rm -rf "/tmp/.xm*"
    3⤵
    PID:2970
- /usr/bin/pidof
  pidof libexec
  2⤵
  PID:2971

/usr/bin/wc
wc -l
1⤵
PID:2869

/usr/bin/which
which sudo
1⤵
PID:2868

/usr/bin/grep
grep -c root
1⤵
PID:2875

/usr/bin/ls
ls -l .local_21139
1⤵
PID:2874

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2882

/usr/bin/grep
grep "./crond -t=all"
1⤵
PID:2880

/usr/bin/grep
grep -v grep
1⤵
PID:2881

/usr/bin/sudo
sudo ps auxff
1⤵
PID:2879
- /usr/bin/ps
  ps auxff
  2⤵
  PID:2883

/usr/bin/grep
grep -v grep
1⤵
PID:2926

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2927

/usr/bin/grep
grep xmr
1⤵
PID:2925

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2924
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  PID:2928

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2930
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  PID:2934

/usr/bin/grep
grep -v grep
1⤵
PID:2932

/usr/bin/grep
grep cryptonight
1⤵
PID:2931

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2933

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2939

/usr/bin/grep
grep -v grep
1⤵
PID:2938

/usr/bin/grep
grep stratum
1⤵
PID:2937

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2936
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  PID:2940

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2945

/usr/bin/grep
grep -v grep
1⤵
PID:2944

/usr/bin/grep
grep dbus-daemon--system
1⤵
PID:2943

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2942
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:2946

/usr/bin/grep
grep -v grep
1⤵
PID:2950

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2951

/usr/bin/grep
grep "\\[\\]"
1⤵
PID:2949

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2948
- /usr/bin/ps
  ps auxf
  2⤵
  PID:2952

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2957

/usr/bin/grep
grep -v grep
1⤵
PID:2956

/usr/bin/grep
grep xm64
1⤵
PID:2955

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2954
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  PID:2958

/usr/bin/free
free -m
1⤵
PID:2972

/usr/bin/uptime
uptime
1⤵
PID:2973

/usr/bin/wc
wc -l
1⤵
PID:2977

/usr/bin/which
which sudo
1⤵
PID:2976

/usr/bin/grep
grep -c root
1⤵
PID:2983

/usr/bin/ls
ls -l .local_28068
1⤵
PID:2982

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2990

/usr/bin/grep
grep -v grep
1⤵
PID:2989

/usr/bin/grep
grep "./crond -t=all"
1⤵
PID:2988

/usr/bin/sudo
sudo ps auxff
1⤵
PID:2987
- /usr/bin/ps
  ps auxff
  2⤵
  - Reads CPU attributes
  PID:2991

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:3035

/usr/bin/grep
grep -v grep
1⤵
PID:3034

/usr/bin/grep
grep xmr
1⤵
PID:3033

/usr/bin/sudo
sudo ps auxf
1⤵
PID:3032
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  PID:3036

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:3041

/usr/bin/grep
grep -v grep
1⤵
PID:3040

/usr/bin/grep
grep cryptonight
1⤵
PID:3039

/usr/bin/sudo
sudo ps auxf
1⤵
PID:3038
- /usr/bin/ps
  ps auxf
  2⤵
  PID:3042

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:3047

/usr/bin/grep
grep -v grep
1⤵
PID:3046

/usr/bin/grep
grep stratum
1⤵
PID:3045

/usr/bin/sudo
sudo ps auxf
1⤵
PID:3044
- /usr/bin/ps
  ps auxf
  2⤵
  PID:3048

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:3053

/usr/bin/grep
grep -v grep
1⤵
PID:3052

/usr/bin/grep
grep dbus-daemon--system
1⤵
PID:3051

/usr/bin/sudo
sudo ps auxf
1⤵
PID:3050
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:3054

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:3059

/usr/bin/grep
grep -v grep
1⤵
PID:3058

/usr/bin/grep
grep "\\[\\]"
1⤵
PID:3057

/usr/bin/sudo
sudo ps auxf
1⤵
PID:3056
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads runtime system information
  PID:3060

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:3065

/usr/bin/grep
grep -v grep
1⤵
PID:3064

/usr/bin/grep
grep xm64
1⤵
PID:3063

/usr/bin/sudo
sudo ps auxf
1⤵
PID:3062
- /usr/bin/ps
  ps auxf
  2⤵
  PID:3066

/usr/bin/wc
wc -l
1⤵
PID:3083

/usr/bin/which
which sudo
1⤵
PID:3082

/usr/bin/grep
grep -c root
1⤵
PID:3089

/usr/bin/ls
ls -l .local_5245
1⤵
PID:3088

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:3096

/usr/bin/grep
grep -v grep
1⤵
PID:3095

/usr/bin/grep
grep "./crond -t=all"
1⤵
PID:3094

/usr/bin/sudo
sudo ps auxff
1⤵
PID:3093
- /usr/bin/ps
  ps auxff
  2⤵
  - Reads CPU attributes
  PID:3097

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:3155

/usr/bin/grep
grep -v grep
1⤵
PID:3154

/usr/bin/grep
grep xmr
1⤵
PID:3153

/usr/bin/sudo
sudo ps auxf
1⤵
PID:3152
- /usr/bin/ps
  ps auxf
  2⤵
  PID:3156

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:3161

/usr/bin/grep
grep -v grep
1⤵
PID:3160

/usr/bin/grep
grep cryptonight
1⤵
PID:3159

/usr/bin/sudo
sudo ps auxf
1⤵
PID:3158
- /usr/bin/ps
  ps auxf
  2⤵
  PID:3162

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:3167

/usr/bin/grep
grep -v grep
1⤵
PID:3166

/usr/bin/grep
grep stratum
1⤵
PID:3165

/usr/bin/sudo
sudo ps auxf
1⤵
PID:3164
- /usr/bin/ps
  ps auxf
  2⤵
  PID:3168

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:3173

/usr/bin/grep
grep -v grep
1⤵
PID:3172

/usr/bin/grep
grep dbus-daemon--system
1⤵
PID:3171

/usr/bin/sudo
sudo ps auxf
1⤵
PID:3170
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  PID:3174

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:3179

/usr/bin/grep
grep -v grep
1⤵
PID:3178

/usr/bin/grep
grep "\\[\\]"
1⤵
PID:3177

/usr/bin/sudo
sudo ps auxf
1⤵
PID:3176
- /usr/bin/ps
  ps auxf
  2⤵
  PID:3180

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:3185

/usr/bin/grep
grep -v grep
1⤵
PID:3184

/usr/bin/grep
grep xm64
1⤵
PID:3183

/usr/bin/sudo
sudo ps auxf
1⤵
PID:3182
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  PID:3186

/usr/bin/wc
wc -l
1⤵
PID:3205

/usr/bin/which
which sudo
1⤵
PID:3204

/usr/bin/grep
grep -c root
1⤵
PID:3211

/usr/bin/ls
ls -l .local_774
1⤵
PID:3210

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:3218

/usr/bin/grep
grep -v grep
1⤵
PID:3217

/usr/bin/grep
grep "./crond -t=all"
1⤵
PID:3216

/usr/bin/sudo
sudo ps auxff
1⤵
PID:3215
- /usr/bin/ps
  ps auxff
  2⤵
  - Reads CPU attributes
  PID:3219

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/root/.ssh/authorized_keys

Filesize
381B

MD5
9da18d38b6dd4c4aa84642378d63fa89

SHA1
c5a976691e4b5963b5e760044f22cc9685268db6

SHA256
43062900b2539d8d1f67f30fa7042c56b53541f63875b5f0de5d8fbde0e0a8bf

SHA512
222b20b5b2ff8956c13dbac1f8d3f81435613b751913d65f4c4082ea9c1a7c8ae91be17a24ef4ae0c708bfe09daab552bb209615714d70acfaaed89c536c71b3

Download Submit