Deletes Audit logs

Deletes logs related to the Linux Audit framework.

Deletes system logs

Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.

Executes dropped EXE

Modifies PAM framework files

Modifies Linux PAM framework files, possibly to intercept credentials.

Traces itself

Traces itself to prevent debugging attempts

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

Attempts to change immutable files

Modifies inode attributes on the filesystem to allow changing of immutable files.

Deletes log files

Deletes log files on the system.

Write file to user bin folder