105e32c8ef13d4d001923c1a43a8849d069fc4adebe48e5e6a9e726eb605ce31

Analysis

max time kernel
34s
platform
debian-9_armhf
resource
debian9-armhf-20240226-en
resource tags

arch:armhfimage:debian9-armhf-20240226-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
07-03-2024 18:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

.rsync/a/init0
Size

9KB
MD5

019e23027bc3849142dd8625451ed5c0
SHA1

982c0318414c3fdf82e3726c4ef4e9021751bbd9
SHA256

0e8472f2005560c6f4db4e5aef39e5d35185b35c67f70a27c8b3dcb242eed25e
SHA512

89fd143e3060669df59feeb599cb5042bf8996983dd9073a53cf1d00d408ec9930e1ce29a1aa3aa1f1157a3a6dee1a0cc32f0791c92f75ed0f74c59f326cdc32
SSDEEP

96:97gXuXeR7P0YQH8h9GVQbxgeJwI222bznGWDKKFZ5W:97xeRb038hAGbxIz9/0

Score

6^/10

Malware Config

Signatures

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 35 IoCs

System Information Discovery

T1082

Processes:

pskillpspskillpskillpspskillpkillpspskillpskillkillpspskillpskillpspkillkillpskillkillpspskillpskillkillkill

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	kill

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

pkillpspspspskillallpspskillallpspspskillallpskillallkillallpspspspskillallpkillkillall

description	ioc	Process
File opened for reading	/proc/654/status	pkill
File opened for reading	/proc/674/cmdline	ps
File opened for reading	/proc/2/stat	ps
File opened for reading	/proc/21/status	ps
File opened for reading	/proc/647/cmdline	ps
File opened for reading	/proc/14/stat	killall
File opened for reading	/proc/18/stat	ps
File opened for reading	/proc/15/cmdline	ps
File opened for reading	/proc/296/status	ps
File opened for reading	/proc/604/cmdline	ps
File opened for reading	/proc/291/stat	ps
File opened for reading	/proc/12/stat	killall
File opened for reading	/proc/436/cmdline	ps
File opened for reading	/proc/11/stat	ps
File opened for reading	/proc/133/status	ps
File opened for reading	/proc/866/stat	ps
File opened for reading	/proc/106/stat	ps
File opened for reading	/proc/654/status	ps
File opened for reading	/proc/109/stat	killall
File opened for reading	/proc/674/status	ps
File opened for reading	/proc/9/status	ps
File opened for reading	/proc/311/cmdline	ps
File opened for reading	/proc/647/stat	killall
File opened for reading	/proc/8/status	ps
File opened for reading	/proc/76/stat	ps
File opened for reading	/proc/643/status	ps
File opened for reading	/proc/1/stat	killall
File opened for reading	/proc/436/stat	ps
File opened for reading	/proc/137/stat	ps
File opened for reading	/proc/643/status	ps
File opened for reading	/proc/43/stat	ps
File opened for reading	/proc/824/stat	ps
File opened for reading	/proc/23/stat	killall
File opened for reading	/proc/147/cmdline	ps
File opened for reading	/proc/15/cmdline	ps
File opened for reading	/proc/1/cmdline	ps
File opened for reading	/proc/321/stat	ps
File opened for reading	/proc/643/stat	ps
File opened for reading	/proc/4/cmdline	ps
File opened for reading	/proc/18/stat	killall
File opened for reading	/proc/9/status	ps
File opened for reading	/proc/223/status	ps
File opened for reading	/proc/106/stat	killall
File opened for reading	/proc/8/status	ps
File opened for reading	/proc/tty/drivers	ps
File opened for reading	/proc/745/status	ps
File opened for reading	/proc/677/status	ps
File opened for reading	/proc/8/stat	killall
File opened for reading	/proc/19/status	ps
File opened for reading	/proc/646/status	ps
File opened for reading	/proc/209/stat	killall
File opened for reading	/proc/25/stat	ps
File opened for reading	/proc/18/status	ps
File opened for reading	/proc/818/cmdline	ps
File opened for reading	/proc/41/cmdline	pkill
File opened for reading	/proc/647/stat	ps
File opened for reading	/proc/162/status	pkill
File opened for reading	/proc/649/stat	ps
File opened for reading	/proc/15/stat	ps
File opened for reading	/proc/19/status	ps
File opened for reading	/proc/133/stat	killall
File opened for reading	/proc/278/stat	killall
File opened for reading	/proc/27/stat	ps
File opened for reading	/proc/41/stat	ps

/tmp/.rsync/a/init0
/tmp/.rsync/a/init0
1⤵
PID:671
- /bin/rm
  rm /tmp/.cron
  2⤵
  PID:672
- /bin/rm
  rm "/tmp/Donald*"
  2⤵
  PID:678
- /bin/rm
  rm "/tmp/Macron*"
  2⤵
  PID:679
- /bin/rm
  rm /tmp/.main
  2⤵
  PID:680
- /bin/rm
  rm "/tmp/.yam*" -rf
  2⤵
  PID:681
- /bin/rm
  rm -f /tmp/irq
  2⤵
  PID:683
- /bin/rm
  rm -f /tmp/irq.sh
  2⤵
  PID:684
- /bin/rm
  rm -f /tmp/irqbalanc1
  2⤵
  PID:685
- /bin/rm
  rm -rf /boot/grub/deamon
  2⤵
  PID:686
- /bin/rm
  rm -rf /boot/grub/disk_genius
  2⤵
  PID:687
- /bin/rm
  rm -rf "/tmp/*httpd.conf"
  2⤵
  PID:689
- /bin/rm
  rm -rf "/tmp/*httpd.conf*"
  2⤵
  PID:690
- /bin/rm
  rm -rf "/tmp/*index_bak*"
  2⤵
  PID:691
- /bin/rm
  rm -rf "/tmp/.systemd-private-*"
  2⤵
  PID:692
- /bin/rm
  rm -rf "/tmp/.xm*"
  2⤵
  PID:693
- /bin/rm
  rm -rf /tmp/a7b104c270
  2⤵
  PID:694
- /bin/rm
  rm -rf /tmp/conn
  2⤵
  PID:695
- /bin/rm
  rm -rf /tmp/conns
  2⤵
  PID:696
- /bin/rm
  rm -rf /tmp/httpd.conf
  2⤵
  PID:697
- /bin/rm
  rm -rf "/tmp/java*"
  2⤵
  PID:698
- /bin/rm
  rm -rf /tmp/kworkerds /bin/kworkerds /bin/config.json /var/tmp/kworkerds /var/tmp/config.json /usr/local/lib/libjdk.so
  2⤵
  PID:699
- /bin/rm
  rm -rf /tmp/qW3xT.2 /tmp/ddgs.3013 /tmp/ddgs.3012 /tmp/wnTKYg /tmp/2t3ik
  2⤵
  PID:700
- /bin/rm
  rm -rf /tmp/root.sh /tmp/pools.txt /tmp/libapache /tmp/config.json /tmp/bashf /tmp/bashg /tmp/libapache
  2⤵
  PID:701
- /bin/rm
  rm -rf "/tmp/xm*"
  2⤵
  PID:702
- /bin/rm
  rm -rf "/var/tmp/java*"
  2⤵
  PID:703
- /bin/ps
  ps auxw
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:704
- /usr/bin/awk
  awk /34e2fg/
  2⤵
  PID:705
- /usr/bin/awk
  awk "!/awk/"
  2⤵
  PID:706
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:707
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:708
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:719
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:719
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:719
- - /usr/bin/kill
    kill -9
    3⤵
    PID:719
- - /sbin/kill
    kill -9
    3⤵
    PID:719
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:719
- /usr/bin/killall
  killall -9 chron-34e2fg
  2⤵
  - Reads runtime system information
  PID:710
- /usr/bin/awk
  awk "/34e|r\\/v3|moy5|defunct/"
  2⤵
  PID:712
- /bin/ps
  ps wx
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:711
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:713
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:714
- - /usr/local/sbin/kill
    kill -9 712
    3⤵
    PID:721
- - /usr/local/bin/kill
    kill -9 712
    3⤵
    PID:721
- - /usr/sbin/kill
    kill -9 712
    3⤵
    PID:721
- - /usr/bin/kill
    kill -9 712
    3⤵
    PID:721
- - /sbin/kill
    kill -9 712
    3⤵
    PID:721
- - /bin/kill
    kill -9 712
    3⤵
    - Reads CPU attributes
    PID:721
- /bin/ps
  ps axf -o "pid %cpu"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:716
- /usr/bin/awk
  awk "{if(\$2>=40.0) print \$1}"
  2⤵
  PID:717
- /usr/bin/killall
  killall .Historys
  2⤵
  PID:720
- /usr/bin/killall
  killall .sshd
  2⤵
  PID:722
- /usr/bin/killall
  killall neptune
  2⤵
  - Reads runtime system information
  PID:723
- /usr/bin/killall
  killall xm64
  2⤵
  - Reads runtime system information
  PID:724
- /usr/bin/killall
  killall xm32
  2⤵
  - Reads runtime system information
  PID:725
- /usr/bin/killall
  killall ld-linux
  2⤵
  - Reads runtime system information
  PID:726
- /usr/bin/killall
  killall xmrig
  2⤵
  - Reads runtime system information
  PID:727
- /usr/bin/killall
  killall .xmrig
  2⤵
  - Reads runtime system information
  PID:728
- /usr/bin/killall
  killall suppoieup
  2⤵
  PID:731
- /usr/bin/killall
  killall xrx
  2⤵
  PID:732
- /usr/bin/pkill
  pkill -f sourplum
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:735
- /usr/bin/pkill
  pkill wnTKYg
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:737
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:740
- /bin/grep
  grep -v grep
  2⤵
  PID:741
- /bin/grep
  grep mine.moneropool.com
  2⤵
  PID:742
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:743
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:744
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:748
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:748
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:748
- - /usr/bin/kill
    kill -9
    3⤵
    PID:748
- - /sbin/kill
    kill -9
    3⤵
    PID:748
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:748
- /bin/grep
  grep -v grep
  2⤵
  PID:750
- /bin/grep
  grep xmr.crypto-pool.fr:8080
  2⤵
  PID:751
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:749
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:752
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:753
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:756
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:756
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:756
- - /usr/bin/kill
    kill -9
    3⤵
    PID:756
- - /sbin/kill
    kill -9
    3⤵
    PID:756
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:756
- /bin/grep
  grep -v grep
  2⤵
  PID:759
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  PID:758
- /bin/grep
  grep xmr.crypto-pool.fr:8080
  2⤵
  PID:760
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:761
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:762
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:765
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:765
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:765
- - /usr/bin/kill
    kill -9
    3⤵
    PID:765
- - /sbin/kill
    kill -9
    3⤵
    PID:765
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:765
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:767
- /bin/grep
  grep -v grep
  2⤵
  PID:768
- /bin/grep
  grep 119.9.76.107:443
  2⤵
  PID:769
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:770
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:771
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:774
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:774
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:774
- - /usr/bin/kill
    kill -9
    3⤵
    PID:774
- - /sbin/kill
    kill -9
    3⤵
    PID:774
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:774
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:775
- /bin/grep
  grep -v grep
  2⤵
  PID:776
- /bin/grep
  grep monerohash.com
  2⤵
  PID:777
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:778
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:779
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:782
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:782
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:782
- - /usr/bin/kill
    kill -9
    3⤵
    PID:782
- - /sbin/kill
    kill -9
    3⤵
    PID:782
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:782
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:784
- /bin/grep
  grep -v grep
  2⤵
  PID:785
- /bin/grep
  grep /tmp/a7b104c270
  2⤵
  PID:786
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:787
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:788
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:791
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:791
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:791
- - /usr/bin/kill
    kill -9
    3⤵
    PID:791
- - /sbin/kill
    kill -9
    3⤵
    PID:791
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:791
- /bin/grep
  grep -v grep
  2⤵
  PID:794
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:793
- /bin/grep
  grep xmr.crypto-pool.fr:6666
  2⤵
  PID:795
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:796
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:797
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:800
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:800
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:800
- - /usr/bin/kill
    kill -9
    3⤵
    PID:800
- - /sbin/kill
    kill -9
    3⤵
    PID:800
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:800
- /bin/grep
  grep -v grep
  2⤵
  PID:803
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:802
- /bin/grep
  grep xmr.crypto-pool.fr:7777
  2⤵
  PID:804
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:805
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:806
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:809
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:809
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:809
- - /usr/bin/kill
    kill -9
    3⤵
    PID:809
- - /sbin/kill
    kill -9
    3⤵
    PID:809
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:809
- /bin/grep
  grep -v grep
  2⤵
  PID:812
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:811
- /bin/grep
  grep xmr.crypto-pool.fr:443
  2⤵
  PID:813
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:814
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:815
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:819
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:819
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:819
- - /usr/bin/kill
    kill -9
    3⤵
    PID:819
- - /sbin/kill
    kill -9
    3⤵
    PID:819
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:819
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:821
- /bin/grep
  grep -v grep
  2⤵
  PID:822
- /bin/grep
  grep stratum.f2pool.com:8888
  2⤵
  PID:823
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:824
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:825
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:827
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:827
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:827
- - /usr/bin/kill
    kill -9
    3⤵
    PID:827
- - /sbin/kill
    kill -9
    3⤵
    PID:827
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:827
- /bin/grep
  grep -v grep
  2⤵
  PID:831
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  PID:830
- /bin/grep
  grep xmrpool.eu
  2⤵
  PID:832
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:833
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:834
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:842
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:842
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:842
- - /usr/bin/kill
    kill -9
    3⤵
    PID:842
- - /sbin/kill
    kill -9
    3⤵
    PID:842
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:842
- /bin/grep
  grep -v grep
  2⤵
  PID:844
- /bin/grep
  grep xmrig
  2⤵
  PID:846
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:843
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:847
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:848
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:850
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:850
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:850
- - /usr/bin/kill
    kill -9
    3⤵
    PID:850
- - /sbin/kill
    kill -9
    3⤵
    PID:850
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:850
- /bin/grep
  grep -v grep
  2⤵
  PID:853
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  PID:852
- /bin/grep
  grep xmrigDaemon
  2⤵
  PID:854
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:855
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:856
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:861
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:861
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:861
- - /usr/bin/kill
    kill -9
    3⤵
    PID:861
- - /sbin/kill
    kill -9
    3⤵
    PID:861
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:861
- /bin/grep
  grep -v grep
  2⤵
  PID:863
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:862
- /bin/grep
  grep xmrigMiner
  2⤵
  PID:864
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:865
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:866
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:868
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:868
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:868
- - /usr/bin/kill
    kill -9
    3⤵
    PID:868
- - /sbin/kill
    kill -9
    3⤵
    PID:868
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads