b7dd3bce3ebfbc2d5e3a9f00d47f27cb6a5895c4618c878e314e573a7c216df1

Analysis

max time kernel
149s
max time network
154s
platform
ubuntu-22.04_amd64
resource
ubuntu2204-amd64-20240522.1-en
resource tags

arch:amd64arch:i386image:ubuntu2204-amd64-20240522.1-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system
submitted
18-07-2024 21:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

The-MALWARE-Repo-master/Botnets/FritzFrog/103b8404dc64c9a44511675981a09fd01395ee837452d114f1350c295357c046
Size

8.6MB
MD5

ae747bc7fff9bc23f06635ef60ea0e8d
SHA1

64315e834f67905ed4e47f36155362a78ac23462
SHA256

103b8404dc64c9a44511675981a09fd01395ee837452d114f1350c295357c046
SHA512

e24914a58565a43883c27ae4a41061e8edd3d5eef7b86c1c0e9910d9fbe0eef3e78ed49136ac0c9378311e99901b1847bcfd926aa9a3ea44149a7478480f82b2
SSDEEP

98304:rDSceJ/GqDu6P0ypQ0Qv5knSTH20ejwBcHjI7Xk:rDSceJ/GqD18RZv5knS720e7s

Score

8^/10

antivm persistence

Malware Config

Signatures

Adds new SSH keys 1 IoCs

Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.

persistence

description	ioc	Process
File opened for modification	/root/.ssh/authorized_keys	103b8404dc64c9a44511675981a09fd01395ee837452d114f1350c295357c046

Deletes itself 1 IoCs

pid
1577

Deletes log files 1 TTPs 1 IoCs

Deletes log files on the system.

Indicator Removal

T1070

description	ioc	Process
File deleted	/var/log/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/103b8404dc64c9a44511675981a09fd01395ee837452d114f1350c295357c046	103b8404dc64c9a44511675981a09fd01395ee837452d114f1350c295357c046

Enumerates running processes
Discovers information about currently running processes on the system

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened for reading	/proc/cpuinfo	cat

Reads CPU attributes 1 TTPs 64 IoCs

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	uptime

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/17/cmdline	pkill
File opened for reading	/proc/590/cmdline	pidof
File opened for reading	/proc/860/stat	ps
File opened for reading	/proc/filesystems	sudo
File opened for reading	/proc/749/status	ps
File opened for reading	/proc/1442/stat	ps
File opened for reading	/proc/80/cmdline	ps
File opened for reading	/proc/1058/cmdline	ps
File opened for reading	/proc/588/stat	killall
File opened for reading	/proc/1164/cmdline	ps
File opened for reading	/proc/641/status	ps
File opened for reading	/proc/114/cmdline	pkill
File opened for reading	/proc/10/cmdline	ps
File opened for reading	/proc/1067/stat	ps
File opened for reading	/proc/1369/stat	killall
File opened for reading	/proc/1130/stat	killall
File opened for reading	/proc/1323/stat	killall
File opened for reading	/proc/102/cmdline	ps
File opened for reading	/proc/1572/stat	ps
File opened for reading	/proc/1369/stat	killall
File opened for reading	/proc/1058/status	ps
File opened for reading	/proc/1323/status	ps
File opened for reading	/proc/723/cmdline	pkill
File opened for reading	/proc/1167/status	pkill
File opened for reading	/proc/1137/stat	killall
File opened for reading	/proc/sys/kernel/pid_max	ps
File opened for reading	/proc/21/stat	ps
File opened for reading	/proc/610/stat	ps
File opened for reading	/proc/7/status	ps
File opened for reading	/proc/78/status	pkill
File opened for reading	/proc/1222/stat	ps
File opened for reading	/proc/tty/drivers	ps
File opened for reading	/proc/1291/status	pkill
File opened for reading	/proc/414/cmdline	pkill
File opened for reading	/proc/225/cmdline	ps
File opened for reading	/proc/617/cmdline	pkill
File opened for reading	/proc/99/stat	ps
File opened for reading	/proc/769/cmdline	pkill
File opened for reading	/proc/22/status	ps
File opened for reading	/proc/7/cmdline	ps
File opened for reading	/proc/77/cmdline	pkill
File opened for reading	/proc/1100/status	ps
File opened for reading	/proc/1170/status	pkill
File opened for reading	/proc/525/stat	killall
File opened for reading	/proc/12/stat	killall
File opened for reading	/proc/1291/status	ps
File opened for reading	/proc/452/cmdline	ps
File opened for reading	/proc/102/status	pkill
File opened for reading	/proc/617/cmdline	pidof
File opened for reading	/proc/1105/cmdline	pidof
File opened for reading	/proc/sys/kernel/osrelease	ps
File opened for reading	/proc/9/cmdline	pidof
File opened for reading	/proc/225/cmdline	ps
File opened for reading	/proc/1170/status	pkill
File opened for reading	/proc/1176/cmdline	pkill
File opened for reading	/proc/1658/cmdline	ps
File opened for reading	/proc/522/stat	killall
File opened for reading	/proc/5/stat	ps
File opened for reading	/proc/1455/cmdline	pkill
File opened for reading	/proc/426/cmdline	pkill
File opened for reading	/proc/22/cmdline	ps
File opened for reading	/proc/1162/stat	killall
File opened for reading	/proc/991/stat	ps
File opened for reading	/proc/1165/status	ps

Writes file to tmp directory 11 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_28659	touch
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_7885	touch
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_31595	touch
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_1615	touch
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_2830	touch
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_28642	touch
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/nc	103b8404dc64c9a44511675981a09fd01395ee837452d114f1350c295357c046
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_919	touch
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_5650	touch
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_19806	touch
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_9022	touch

/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/103b8404dc64c9a44511675981a09fd01395ee837452d114f1350c295357c046
/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/103b8404dc64c9a44511675981a09fd01395ee837452d114f1350c295357c046
1⤵
- Adds new SSH keys
- Deletes log files
- Writes file to tmp directory
PID:1574
- /usr/bin/uname
  uname -a
  2⤵
  PID:1584
- /usr/bin/cat
  cat /proc/cpuinfo
  2⤵
  - Checks CPU configuration
  PID:1585
- /usr/bin/cat
  cat /etc/issue
  2⤵
  PID:1589
- /usr/bin/free
  free -m
  2⤵
  PID:1590
- /usr/bin/uptime
  uptime
  2⤵
  PID:1591
- /usr/bin/journalctl
  journalctl -S "@0" -u sshd
  2⤵
  PID:1592
- /usr/bin/cat
  cat "/var/log/auth*"
  2⤵
  PID:1593
- /usr/bin/zcat
  zcat "/var/log/auth*"
  2⤵
  PID:1594
- /usr/local/sbin/gzip
  gzip -cd "/var/log/auth*"
  2⤵
  PID:1594
- /usr/local/bin/gzip
  gzip -cd "/var/log/auth*"
  2⤵
  PID:1594
- /usr/sbin/gzip
  gzip -cd "/var/log/auth*"
  2⤵
  PID:1594
- /usr/bin/gzip
  gzip -cd "/var/log/auth*"
  2⤵
  PID:1594
- /bin/bash
  /bin/bash -
  2⤵
  PID:1595
- - /usr/bin/wc
    wc -l
    3⤵
    PID:1598
- - /usr/bin/which
    which sudo
    3⤵
    PID:1597
- - /usr/bin/sudo
    sudo -S touch .local_919
    3⤵
    PID:1600
  - - /usr/bin/touch
      touch .local_919
      4⤵
      Writes file to tmp directory
      PID:1603
- - /usr/bin/grep
    grep -c root
    3⤵
    PID:1606
- - /usr/bin/ls
    ls -l .local_919
    3⤵
    PID:1605
- - /usr/bin/sudo
    sudo rm .local_919
    3⤵
    PID:1607
  - - /usr/bin/rm
      rm .local_919
      4⤵
      PID:1608
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:1613
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:1612
- - /usr/bin/grep
    grep "./crond -t=all"
    3⤵
    PID:1611
- - /usr/bin/sudo
    sudo ps auxff
    3⤵
    PID:1610
  - - /usr/bin/ps
      ps auxff
      4⤵
      PID:1614
- - /usr/bin/sudo
    sudo killall -9 bssh
    3⤵
    PID:1615
  - - /usr/bin/killall
      killall -9 bssh
      4⤵
      PID:1616
- - /usr/bin/sudo
    sudo rm -rf /tmp/.an
    3⤵
    PID:1617
  - - /usr/bin/rm
      rm -rf /tmp/.an
      4⤵
      PID:1618
- - /usr/bin/sudo
    sudo killall -9 xm64
    3⤵
    PID:1619
  - - /usr/bin/killall
      killall -9 xm64
      4⤵
      PID:1620
- - /usr/bin/sudo
    sudo killall -9 rpc.idmapd
    3⤵
    PID:1621
  - - /usr/bin/killall
      killall -9 rpc.idmapd
      4⤵
      PID:1622
- - /usr/bin/sudo
    sudo rm -rf /tmp/.m2
    3⤵
    PID:1623
  - - /usr/bin/rm
      rm -rf /tmp/.m2
      4⤵
      PID:1624
- - /usr/bin/sudo
    sudo killall -9 xorgg
    3⤵
    PID:1625
  - - /usr/bin/killall
      killall -9 xorgg
      4⤵
      PID:1626
- - /usr/bin/sudo
    sudo rm -rf /tmp/seconfig
    3⤵
    PID:1627
  - - /usr/bin/rm
      rm -rf /tmp/seconfig
      4⤵
      PID:1628
- - /usr/bin/sudo
    sudo killall -9 crond64
    3⤵
    PID:1629
  - - /usr/bin/killall
      killall -9 crond64
      4⤵
      PID:1630
- - /usr/bin/sudo
    sudo killall -9 tsm
    3⤵
    PID:1631
  - - /usr/bin/killall
      killall -9 tsm
      4⤵
      PID:1632
- - /usr/bin/sudo
    sudo rm -rf /tmp/.ssh
    3⤵
    PID:1633
  - - /usr/bin/rm
      rm -rf /tmp/.ssh
      4⤵
      PID:1634
- - /usr/bin/sudo
    sudo rm -rf /tmp/.java
    3⤵
    PID:1635
  - - /usr/bin/rm
      rm -rf /tmp/.java
      4⤵
      PID:1636
- - /usr/bin/sudo
    sudo rm -rf /tmp/.iolanda
    3⤵
    PID:1637
  - - /usr/bin/rm
      rm -rf /tmp/.iolanda
      4⤵
      PID:1638
- - /usr/bin/sudo
    sudo pkill test.mod
    3⤵
    PID:1639
  - - /usr/bin/pkill
      pkill test.mod
      4⤵
      PID:1640
- - /usr/bin/sudo
    sudo pkill daemon.i686.mod
    3⤵
    PID:1641
  - - /usr/bin/pkill
      pkill daemon.i686.mod
      4⤵
      PID:1642
- - /usr/bin/sudo
    sudo pkill daemon.armv4l.mod
    3⤵
    PID:1643
  - - /usr/bin/pkill
      pkill daemon.armv4l.mod
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1644
- - /usr/bin/sudo
    sudo pkill daemon.mips.mod
    3⤵
    PID:1645
  - - /usr/bin/pkill
      pkill daemon.mips.mod
      4⤵
      PID:1646
- - /usr/bin/sudo
    sudo pkill daemon.mipsel.mod
    3⤵
    PID:1647
  - - /usr/bin/pkill
      pkill daemon.mipsel.mod
      4⤵
      PID:1648
- - /usr/bin/sudo
    sudo rm -rf /tmp/.xs
    3⤵
    PID:1649
  - - /usr/bin/rm
      rm -rf /tmp/.xs
      4⤵
      PID:1650
- - /usr/bin/sudo
    sudo pkill ld-linux-x86-64
    3⤵
    PID:1651
  - - /usr/bin/pkill
      pkill ld-linux-x86-64
      4⤵
      PID:1652
- - /usr/bin/rm
    rm -rf "/var/tmp/. *"
    3⤵
    PID:1653
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:1658
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:1657
- - /usr/bin/grep
    grep xmr
    3⤵
    PID:1656
- - /usr/bin/sudo
    sudo ps auxf
    3⤵
    PID:1655
  - - /usr/bin/ps
      ps auxf
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1659
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:1664
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:1663
- - /usr/bin/grep
    grep cryptonight
    3⤵
    PID:1662
- - /usr/bin/sudo
    sudo ps auxf
    3⤵
    PID:1661
  - - /usr/bin/ps
      ps auxf
      4⤵
      Reads CPU attributes
      PID:1665
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:1670
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:1669
- - /usr/bin/grep
    grep stratum
    3⤵
    PID:1668
- - /usr/bin/sudo
    sudo ps auxf
    3⤵
    PID:1667
  - - /usr/bin/ps
      ps auxf
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1671
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:1676
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:1675
- - /usr/bin/grep
    grep dbus-daemon--system
    3⤵
    PID:1674
- - /usr/bin/sudo
    sudo ps auxf
    3⤵
    PID:1673
  - - /usr/bin/ps
      ps auxf
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1677
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:1682
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:1681
- - /usr/bin/grep
    grep "\\[\\]"
    3⤵
    PID:1680
- - /usr/bin/sudo
    sudo ps auxf
    3⤵
    PID:1679
  - - /usr/bin/ps
      ps auxf
      4⤵
      Reads CPU attributes
      PID:1683
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:1688
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:1687
- - /usr/bin/grep
    grep xm64
    3⤵
    PID:1686
- - /usr/bin/sudo
    sudo ps auxf
    3⤵
    PID:1685
  - - /usr/bin/ps
      ps auxf
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1689
- - /usr/bin/sudo
    sudo killall -9 "[atd]"
    3⤵
    PID:1690
  - - /usr/bin/killall
      killall -9 "[atd]"
      4⤵
      PID:1691
- - /usr/bin/sudo
    sudo rm -rf /tmp/.jk
    3⤵
    PID:1692
  - - /usr/bin/rm
      rm -rf /tmp/.jk
      4⤵
      PID:1693
- - /usr/bin/sudo
    sudo killall -9 "[ntpd]"
    3⤵
    PID:1694
  - - /usr/bin/killall
      killall -9 "[ntpd]"
      4⤵
      PID:1695
- - /usr/bin/sudo
    sudo killall -9 "[rpciod]"
    3⤵
    PID:1696
  - - /usr/bin/killall
      killall -9 "[rpciod]"
      4⤵
      PID:1697
- - /usr/bin/sudo
    sudo killall -9 "[ext4-dio-unwrit]"
    3⤵
    PID:1698
  - - /usr/bin/killall
      killall -9 "[ext4-dio-unwrit]"
      4⤵
      PID:1699
- - /usr/bin/sudo
    sudo rm -rf "/tmp/.xm*"
    3⤵
    PID:1700
  - - /usr/bin/rm
      rm -rf "/tmp/.xm*"
      4⤵
      PID:1701
- - /usr/bin/pidof
    pidof libexec
    3⤵
    PID:1702
- /usr/bin/free
  free -m
  2⤵
  PID:1601
- /usr/bin/uptime
  uptime
  2⤵
  PID:1602
- /usr/bin/free
  free -m
  2⤵
  - Reads CPU attributes
  PID:1703
- /usr/bin/uptime
  uptime
  2⤵
  - Reads CPU attributes
  PID:1704
- /bin/bash
  /bin/bash -
  2⤵
  PID:1705
- - /usr/bin/wc
    wc -l
    3⤵
    PID:1708
- - /usr/bin/which
    which sudo
    3⤵
    PID:1707
- - /usr/bin/sudo
    sudo -S touch .local_28659
    3⤵
    PID:1710
  - - /usr/bin/touch
      touch .local_28659
      4⤵
      Writes file to tmp directory
      PID:1711
- - /usr/bin/grep
    grep -c root
    3⤵
    PID:1714
- - /usr/bin/ls
    ls -l .local_28659
    3⤵
    PID:1713
- - /usr/bin/sudo
    sudo rm .local_28659
    3⤵
    PID:1715
  - - /usr/bin/rm
      rm .local_28659
      4⤵
      PID:1716
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:1721
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:1720
- - /usr/bin/grep
    grep "./crond -t=all"
    3⤵
    PID:1719
- - /usr/bin/sudo
    sudo ps auxff
    3⤵
    PID:1718
  - - /usr/bin/ps
      ps auxff
      4⤵
      PID:1722
- - /usr/bin/sudo
    sudo killall -9 bssh
    3⤵
    PID:1723
  - - /usr/bin/killall
      killall -9 bssh
      4⤵
      PID:1724
- - /usr/bin/sudo
    sudo rm -rf /tmp/.an
    3⤵
    PID:1725
  - - /usr/bin/rm
      rm -rf /tmp/.an
      4⤵
      PID:1726
- - /usr/bin/sudo
    sudo killall -9 xm64
    3⤵
    PID:1727
  - - /usr/bin/killall
      killall -9 xm64
      4⤵
      PID:1728
- - /usr/bin/sudo
    sudo killall -9 rpc.idmapd
    3⤵
    PID:1729
  - - /usr/bin/killall
      killall -9 rpc.idmapd
      4⤵
      PID:1730
- - /usr/bin/sudo
    sudo rm -rf /tmp/.m2
    3⤵
    PID:1731
  - - /usr/bin/rm
      rm -rf /tmp/.m2
      4⤵
      PID:1732
- - /usr/bin/sudo
    sudo killall -9 xorgg
    3⤵
    PID:1733
  - - /usr/bin/killall
      killall -9 xorgg
      4⤵
      PID:1734
- - /usr/bin/sudo
    sudo rm -rf /tmp/seconfig
    3⤵
    PID:1735
  - - /usr/bin/rm
      rm -rf /tmp/seconfig
      4⤵
      PID:1736
- - /usr/bin/sudo
    sudo killall -9 crond64
    3⤵
    PID:1737
  - - /usr/bin/killall
      killall -9 crond64
      4⤵
      PID:1738
- - /usr/bin/sudo
    sudo killall -9 tsm
    3⤵
    PID:1739
  - - /usr/bin/killall
      killall -9 tsm
      4⤵
      PID:1740
- - /usr/bin/sudo
    sudo rm -rf /tmp/.ssh
    3⤵
    PID:1741
  - - /usr/bin/rm
      rm -rf /tmp/.ssh
      4⤵
      PID:1742
- - /usr/bin/sudo
    sudo rm -rf /tmp/.java
    3⤵
    PID:1743
  - - /usr/bin/rm
      rm -rf /tmp/.java
      4⤵
      PID:1744
- - /usr/bin/sudo
    sudo rm -rf /tmp/.iolanda
    3⤵
    PID:1745
  - - /usr/bin/rm
      rm -rf /tmp/.iolanda
      4⤵
      PID:1746
- - /usr/bin/sudo
    sudo pkill test.mod
    3⤵
    PID:1747
  - - /usr/bin/pkill
      pkill test.mod
      4⤵
      Reads CPU attributes
      PID:1748
- - /usr/bin/sudo
    sudo pkill daemon.i686.mod
    3⤵
    PID:1749
  - - /usr/bin/pkill
      pkill daemon.i686.mod
      4⤵
      Reads CPU attributes
      PID:1750
- - /usr/bin/sudo
    sudo pkill daemon.armv4l.mod
    3⤵
    PID:1751
  - - /usr/bin/pkill
      pkill daemon.armv4l.mod
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1752
- - /usr/bin/sudo
    sudo pkill daemon.mips.mod
    3⤵
    PID:1753
  - - /usr/bin/pkill
      pkill daemon.mips.mod
      4⤵
      Reads CPU attributes
      PID:1754
- - /usr/bin/sudo
    sudo pkill daemon.mipsel.mod
    3⤵
    PID:1755
  - - /usr/bin/pkill
      pkill daemon.mipsel.mod
      4⤵
      Reads runtime system information
      PID:1756
- - /usr/bin/sudo
    sudo rm -rf /tmp/.xs
    3⤵
    PID:1757
  - - /usr/bin/rm
      rm -rf /tmp/.xs
      4⤵
      PID:1758
- - /usr/bin/sudo
    sudo pkill ld-linux-x86-64
    3⤵
    PID:1759
  - - /usr/bin/pkill
      pkill ld-linux-x86-64
      4⤵
      Reads CPU attributes
      PID:1760
- - /usr/bin/rm
    rm -rf "/var/tmp/. *"
    3⤵
    PID:1761
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:1766
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:1765
- - /usr/bin/grep
    grep xmr
    3⤵
    PID:1764
- - /usr/bin/sudo
    sudo ps auxf
    3⤵
    PID:1763
  - - /usr/bin/ps
      ps auxf
      4⤵
      Reads runtime system information
      PID:1767
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:1772
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:1771
- - /usr/bin/grep
    grep cryptonight
    3⤵
    PID:1770
- - /usr/bin/sudo
    sudo ps auxf
    3⤵
    PID:1769
  - - /usr/bin/ps
      ps auxf
      4⤵
      PID:1773
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:1778
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:1777
- - /usr/bin/grep
    grep stratum
    3⤵
    PID:1776
- - /usr/bin/sudo
    sudo ps auxf
    3⤵
    PID:1775
  - - /usr/bin/ps
      ps auxf
      4⤵
      Reads CPU attributes
      PID:1779
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:1784
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:1783
- - /usr/bin/grep
    grep dbus-daemon--system
    3⤵
    PID:1782
- - /usr/bin/sudo
    sudo ps auxf
    3⤵
    PID:1781
  - - /usr/bin/ps
      ps auxf
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1785
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:1790
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:1789
- - /usr/bin/grep
    grep "\\[\\]"
    3⤵
    PID:1788
- - /usr/bin/sudo
    sudo ps auxf
    3⤵
    PID:1787
  - - /usr/bin/ps
      ps auxf
      4⤵
      PID:1795
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:1800
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:1799
- - /usr/bin/grep
    grep xm64
    3⤵
    PID:1798
- - /usr/bin/sudo
    sudo ps auxf
    3⤵
    PID:1797
  - - /usr/bin/ps
      ps auxf
      4⤵
      Reads CPU attributes
      PID:1801
- - /usr/bin/sudo
    sudo killall -9 "[atd]"
    3⤵
    PID:1802
  - - /usr/bin/killall
      killall -9 "[atd]"
      4⤵
      PID:1803
- - /usr/bin/sudo
    sudo rm -rf /tmp/.jk
    3⤵
    PID:1804
  - - /usr/bin/rm
      rm -rf /tmp/.jk
      4⤵
      PID:1805
- - /usr/bin/sudo
    sudo killall -9 "[ntpd]"
    3⤵
    PID:1806
  - - /usr/bin/killall
      killall -9 "[ntpd]"
      4⤵
      PID:1807
- - /usr/bin/sudo
    sudo killall -9 "[rpciod]"
    3⤵
    PID:1808
  - - /usr/bin/killall
      killall -9 "[rpciod]"
      4⤵
      PID:1809
- - /usr/bin/sudo
    sudo killall -9 "[ext4-dio-unwrit]"
    3⤵
    PID:1810
  - - /usr/bin/killall
      killall -9 "[ext4-dio-unwrit]"
      4⤵
      PID:1811
- - /usr/bin/sudo
    sudo rm -rf "/tmp/.xm*"
    3⤵
    PID:1812
  - - /usr/bin/rm
      rm -rf "/tmp/.xm*"
      4⤵
      PID:1813
- - /usr/bin/pidof
    pidof libexec
    3⤵
    PID:1814
- /usr/bin/free
  free -m
  2⤵
  - Reads CPU attributes
  PID:1793
- /usr/bin/uptime
  uptime
  2⤵
  - Reads CPU attributes
  PID:1794
- /usr/bin/free
  free -m
  2⤵
  - Reads CPU attributes
  PID:1815
- /usr/bin/uptime
  uptime
  2⤵
  - Reads CPU attributes
  PID:1816
- /bin/bash
  /bin/bash -
  2⤵
  PID:1817
- - /usr/bin/wc
    wc -l
    3⤵
    PID:1820
- - /usr/bin/which
    which sudo
    3⤵
    PID:1819
- - /usr/bin/sudo
    sudo -S touch .local_7885
    3⤵
    PID:1822
  - - /usr/bin/touch
      touch .local_7885
      4⤵
      Writes file to tmp directory
      PID:1823
- - /usr/bin/grep
    grep -c root
    3⤵
    PID:1826
- - /usr/bin/ls
    ls -l .local_7885
    3⤵
    PID:1825
- - /usr/bin/sudo
    sudo rm .local_7885
    3⤵
    PID:1827
  - - /usr/bin/rm
      rm .local_7885
      4⤵
      PID:1828
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:1833
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:1832
- - /usr/bin/grep
    grep "./crond -t=all"
    3⤵
    PID:1831
- - /usr/bin/sudo
    sudo ps auxff
    3⤵
    PID:1830
  - - /usr/bin/ps
      ps auxff
      4⤵
      PID:1834
- - /usr/bin/sudo
    sudo killall -9 bssh
    3⤵
    PID:1835
  - - /usr/bin/killall
      killall -9 bssh
      4⤵
      PID:1836
- - /usr/bin/sudo
    sudo rm -rf /tmp/.an
    3⤵
    PID:1837
  - - /usr/bin/rm
      rm -rf /tmp/.an
      4⤵
      PID:1838
- - /usr/bin/sudo
    sudo killall -9 xm64
    3⤵
    PID:1839
  - - /usr/bin/killall
      killall -9 xm64
      4⤵
      Reads runtime system information
      PID:1840
- - /usr/bin/sudo
    sudo killall -9 rpc.idmapd
    3⤵
    PID:1841
  - - /usr/bin/killall
      killall -9 rpc.idmapd
      4⤵
      PID:1842
- - /usr/bin/sudo
    sudo rm -rf /tmp/.m2
    3⤵
    PID:1843
  - - /usr/bin/rm
      rm -rf /tmp/.m2
      4⤵
      PID:1844
- - /usr/bin/sudo
    sudo killall -9 xorgg
    3⤵
    PID:1845
  - - /usr/bin/killall
      killall -9 xorgg
      4⤵
      PID:1846
- - /usr/bin/sudo
    sudo rm -rf /tmp/seconfig
    3⤵
    PID:1847
  - - /usr/bin/rm
      rm -rf /tmp/seconfig
      4⤵
      PID:1848
- - /usr/bin/sudo
    sudo killall -9 crond64
    3⤵
    PID:1849
  - - /usr/bin/killall
      killall -9 crond64
      4⤵
      PID:1850
- - /usr/bin/sudo
    sudo killall -9 tsm
    3⤵
    PID:1851
  - - /usr/bin/killall
      killall -9 tsm
      4⤵
      PID:1852
- - /usr/bin/sudo
    sudo rm -rf /tmp/.ssh
    3⤵
    PID:1853
  - - /usr/bin/rm
      rm -rf /tmp/.ssh
      4⤵
      PID:1854
- - /usr/bin/sudo
    sudo rm -rf /tmp/.java
    3⤵
    PID:1855
  - - /usr/bin/rm
      rm -rf /tmp/.java
      4⤵
      PID:1856
- - /usr/bin/sudo
    sudo rm -rf /tmp/.iolanda
    3⤵
    PID:1857
  - - /usr/bin/rm
      rm -rf /tmp/.iolanda
      4⤵
      PID:1858
- - /usr/bin/sudo
    sudo pkill test.mod
    3⤵
    - Reads runtime system information
    PID:1859
  - - /usr/bin/pkill
      pkill test.mod
      4⤵
      Reads CPU attributes
      PID:1860
- - /usr/bin/sudo
    sudo pkill daemon.i686.mod
    3⤵
    PID:1861
  - - /usr/bin/pkill
      pkill daemon.i686.mod
      4⤵
      Reads CPU attributes
      PID:1862
- - /usr/bin/sudo
    sudo pkill daemon.armv4l.mod
    3⤵
    PID:1863
  - - /usr/bin/pkill
      pkill daemon.armv4l.mod
      4⤵
      PID:1864
- - /usr/bin/sudo
    sudo pkill daemon.mips.mod
    3⤵
    PID:1865
  - - /usr/bin/pkill
      pkill daemon.mips.mod
      4⤵
      PID:1866
- - /usr/bin/sudo
    sudo pkill daemon.mipsel.mod
    3⤵
    PID:1867
  - - /usr/bin/pkill
      pkill daemon.mipsel.mod
      4⤵
      PID:1868
- - /usr/bin/sudo
    sudo rm -rf /tmp/.xs
    3⤵
    PID:1869
  - - /usr/bin/rm
      rm -rf /tmp/.xs
      4⤵
      PID:1870
- - /usr/bin/sudo
    sudo pkill ld-linux-x86-64
    3⤵
    PID:1871
  - - /usr/bin/pkill
      pkill ld-linux-x86-64
      4⤵
      Reads CPU attributes
      PID:1872
- - /usr/bin/rm
    rm -rf "/var/tmp/. *"
    3⤵
    PID:1873
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:1878
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:1877
- - /usr/bin/grep
    grep xmr
    3⤵
    PID:1876
- - /usr/bin/sudo
    sudo ps auxf
    3⤵
    PID:1875
  - - /usr/bin/ps
      ps auxf
      4⤵
      Reads CPU attributes
      PID:1879
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:1884
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:1883
- - /usr/bin/grep
    grep cryptonight
    3⤵
    PID:1882
- - /usr/bin/sudo
    sudo ps auxf
    3⤵
    PID:1881
  - - /usr/bin/ps
      ps auxf
      4⤵
      PID:1885
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:1890
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:1889
- - /usr/bin/grep
    grep stratum
    3⤵
    PID:1888
- - /usr/bin/sudo
    sudo ps auxf
    3⤵
    PID:1887
  - - /usr/bin/ps
      ps auxf
      4⤵
      PID:1893
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:1898
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:1897
- - /usr/bin/grep
    grep dbus-daemon--system
    3⤵
    PID:1896
- - /usr/bin/sudo
    sudo ps auxf
    3⤵
    PID:1895
  - - /usr/bin/ps
      ps auxf
      4⤵
      PID:1899
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:1904
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:1903
- - /usr/bin/grep
    grep "\\[\\]"
    3⤵
    PID:1902
- - /usr/bin/sudo
    sudo ps auxf
    3⤵
    PID:1901
  - - /usr/bin/ps
      ps auxf
      4⤵
      Reads runtime system information
      PID:1905
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:1910
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:1909
- - /usr/bin/grep
    grep xm64
    3⤵
    PID:1908
- - /usr/bin/sudo
    sudo ps auxf
    3⤵
    PID:1907
  - - /usr/bin/ps
      ps auxf
      4⤵
      PID:1911
- - /usr/bin/sudo
    sudo killall -9 "[atd]"
    3⤵
    PID:1912
  - - /usr/bin/killall
      killall -9 "[atd]"
      4⤵
      PID:1913
- - /usr/bin/sudo
    sudo rm -rf /tmp/.jk
    3⤵
    PID:1914
  - - /usr/bin/rm
      rm -rf /tmp/.jk
      4⤵
      PID:1915
- - /usr/bin/sudo
    sudo killall -9 "[ntpd]"
    3⤵
    PID:1916
  - - /usr/bin/killall
      killall -9 "[ntpd]"
      4⤵
      PID:1917
- - /usr/bin/sudo
    sudo killall -9 "[rpciod]"
    3⤵
    PID:1918
  - - /usr/bin/killall
      killall -9 "[rpciod]"
      4⤵
      PID:1919
- - /usr/bin/sudo
    sudo killall -9 "[ext4-dio-unwrit]"
    3⤵
    PID:1920
  - - /usr/bin/killall
      killall -9 "[ext4-dio-unwrit]"
      4⤵
      PID:1921
- - /usr/bin/sudo
    sudo rm -rf "/tmp/.xm*"
    3⤵
    PID:1922
  - - /usr/bin/rm
      rm -rf "/tmp/.xm*"
      4⤵
      PID:1923
- - /usr/bin/pidof
    pidof libexec
    3⤵
    PID:1924
- /usr/bin/free
  free -m
  2⤵
  PID:1891
- /usr/bin/uptime
  uptime
  2⤵
  - Reads CPU attributes
  PID:1892
- /usr/bin/free
  free -m
  2⤵
  - Reads CPU attributes
  PID:1931
- /usr/bin/uptime
  uptime
  2⤵
  - Reads CPU attributes
  PID:1932
- /bin/bash
  /bin/bash -
  2⤵
  PID:1933
- - /usr/bin/wc
    wc -l
    3⤵
    PID:1936
- - /usr/bin/which
    which sudo
    3⤵
    PID:1935
- - /usr/bin/sudo
    sudo -S touch .local_19806
    3⤵
    PID:1938
  - - /usr/bin/touch
      touch .local_19806
      4⤵
      Writes file to tmp directory
      PID:1939
- - /usr/bin/grep
    grep -c root
    3⤵
    PID:1942
- - /usr/bin/ls
    ls -l .local_19806
    3⤵
    PID:1941
- - /usr/bin/sudo
    sudo rm .local_19806
    3⤵
    PID:1943
  - - /usr/bin/rm
      rm .local_19806
      4⤵
      PID:1944
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:1949
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:1948
- - /usr/bin/grep
    grep "./crond -t=all"
    3⤵
    PID:1947
- - /usr/bin/sudo
    sudo ps auxff
    3⤵
    PID:1946
  - - /usr/bin/ps
      ps auxff
      4⤵
      PID:1950
- - /usr/bin/sudo
    sudo killall -9 bssh
    3⤵
    PID:1951
  - - /usr/bin/killall
      killall -9 bssh
      4⤵
      PID:1952
- - /usr/bin/sudo
    sudo rm -rf /tmp/.an
    3⤵
    PID:1953
  - - /usr/bin/rm
      rm -rf /tmp/.an
      4⤵
      PID:1954
- - /usr/bin/sudo
    sudo killall -9 xm64
    3⤵
    PID:1955
  - - /usr/bin/killall
      killall -9 xm64
      4⤵
      Reads runtime system information
      PID:1956
- - /usr/bin/sudo
    sudo killall -9 rpc.idmapd
    3⤵
    PID:1957
  - - /usr/bin/killall
      killall -9 rpc.idmapd
      4⤵
      PID:1958
- - /usr/bin/sudo
    sudo rm -rf /tmp/.m2
    3⤵
    PID:1959
  - - /usr/bin/rm
      rm -rf /tmp/.m2
      4⤵
      PID:1960
- - /usr/bin/sudo
    sudo killall -9 xorgg
    3⤵
    PID:1961
  - - /usr/bin/killall
      killall -9 xorgg
      4⤵
      PID:1962
- - /usr/bin/sudo
    sudo rm -rf /tmp/seconfig
    3⤵
    PID:1963
  - - /usr/bin/rm
      rm -rf /tmp/seconfig
      4⤵
      PID:1964
- - /usr/bin/sudo
    sudo killall -9 crond64
    3⤵
    PID:1965
  - - /usr/bin/killall
      killall -9 crond64
      4⤵
      PID:1966
- - /usr/bin/sudo
    sudo killall -9 tsm
    3⤵
    PID:1967
  - - /usr/bin/killall
      killall -9 tsm
      4⤵
      PID:1968
- - /usr/bin/sudo
    sudo rm -rf /tmp/.ssh
    3⤵
    PID:1969
  - - /usr/bin/rm
      rm -rf /tmp/.ssh
      4⤵
      PID:1970
- - /usr/bin/sudo
    sudo rm -rf /tmp/.java
    3⤵
    PID:1971
  - - /usr/bin/rm
      rm -rf /tmp/.java
      4⤵
      PID:1972
- - /usr/bin/sudo
    sudo rm -rf /tmp/.iolanda
    3⤵
    PID:1973
  - - /usr/bin/rm
      rm -rf /tmp/.iolanda
      4⤵
      PID:1974
- - /usr/bin/sudo
    sudo pkill test.mod
    3⤵
    PID:1975
  - - /usr/bin/pkill
      pkill test.mod
      4⤵
      PID:1976
- - /usr/bin/sudo
    sudo pkill daemon.i686.mod
    3⤵
    PID:1977
  - - /usr/bin/pkill
      pkill daemon.i686.mod
      4⤵
      PID:1978
- - /usr/bin/sudo
    sudo pkill daemon.armv4l.mod
    3⤵
    PID:1979
  - - /usr/bin/pkill
      pkill daemon.armv4l.mod
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1980
- - /usr/bin/sudo
    sudo pkill daemon.mips.mod
    3⤵
    PID:1981
  - - /usr/bin/pkill
      pkill daemon.mips.mod
      4⤵
      Reads runtime system information
      PID:1982
- - /usr/bin/sudo
    sudo pkill daemon.mipsel.mod
    3⤵
    PID:1983
  - - /usr/bin/pkill
      pkill daemon.mipsel.mod
      4⤵
      Reads runtime system information
      PID:1984
- - /usr/bin/sudo
    sudo rm -rf /tmp/.xs
    3⤵
    PID:1985
  - - /usr/bin/rm
      rm -rf /tmp/.xs
      4⤵
      PID:1986
- - /usr/bin/sudo
    sudo pkill ld-linux-x86-64
    3⤵
    PID:1987
  - - /usr/bin/pkill
      pkill ld-linux-x86-64
      4⤵
      PID:1988
- - /usr/bin/rm
    rm -rf "/var/tmp/. *"
    3⤵
    PID:1989
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:1994
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:1993
- - /usr/bin/grep
    grep xmr
    3⤵
    PID:1992
- - /usr/bin/sudo
    sudo ps auxf
    3⤵
    PID:1991
  - - /usr/bin/ps
      ps auxf
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1995
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:2000
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:1999
- - /usr/bin/grep
    grep cryptonight
    3⤵
    PID:1998
- - /usr/bin/sudo
    sudo ps auxf
    3⤵
    PID:1997
  - - /usr/bin/ps
      ps auxf
      4⤵
      Reads runtime system information
      PID:2001
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:2006
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:2005
- - /usr/bin/grep
    grep stratum
    3⤵
    PID:2004
- - /usr/bin/sudo
    sudo ps auxf
    3⤵
    PID:2003
  - - /usr/bin/ps
      ps auxf
      4⤵
      PID:2007
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:2012
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:2011
- - /usr/bin/grep
    grep dbus-daemon--system
    3⤵
    PID:2010
- - /usr/bin/sudo
    sudo ps auxf
    3⤵
    PID:2009
  - - /usr/bin/ps
      ps auxf
      4⤵
      PID:2013
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:2018
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:2017
- - /usr/bin/grep
    grep "\\[\\]"
    3⤵
    PID:2016
- - /usr/bin/sudo
    sudo ps auxf
    3⤵
    PID:2015
  - - /usr/bin/ps
      ps auxf
      4⤵
      Reads CPU attributes
      PID:2019
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:2024
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:2023
- - /usr/bin/grep
    grep xm64
    3⤵
    PID:2022
- - /usr/bin/sudo
    sudo ps auxf
    3⤵
    PID:2021
  - - /usr/bin/ps
      ps auxf
      4⤵
      Reads runtime system information
      PID:2025
- - /usr/bin/sudo
    sudo killall -9 "[atd]"
    3⤵
    PID:2026
  - - /usr/bin/killall
      killall -9 "[atd]"
      4⤵
      Reads runtime system information
      PID:2027
- - /usr/bin/sudo
    sudo rm -rf /tmp/.jk
    3⤵
    PID:2028
  - - /usr/bin/rm
      rm -rf /tmp/.jk
      4⤵
      PID:2029
- - /usr/bin/sudo
    sudo killall -9 "[ntpd]"
    3⤵
    PID:2030
  - - /usr/bin/killall
      killall -9 "[ntpd]"
      4⤵
      Reads runtime system information
      PID:2031
- - /usr/bin/sudo
    sudo killall -9 "[rpciod]"
    3⤵
    PID:2032
  - - /usr/bin/killall
      killall -9 "[rpciod]"
      4⤵
      Reads runtime system information
      PID:2033
- - /usr/bin/sudo
    sudo killall -9 "[ext4-dio-unwrit]"
    3⤵
    PID:2034
  - - /usr/bin/killall
      killall -9 "[ext4-dio-unwrit]"
      4⤵
      PID:2035
- - /usr/bin/sudo
    sudo rm -rf "/tmp/.xm*"
    3⤵
    PID:2036
  - - /usr/bin/rm
      rm -rf "/tmp/.xm*"
      4⤵
      PID:2037
- - /usr/bin/pidof
    pidof libexec
    3⤵
    PID:2038
- /bin/bash
  /bin/bash -
  2⤵
  PID:2039
- - /usr/bin/wc
    wc -l
    3⤵
    PID:2042
- - /usr/bin/which
    which sudo
    3⤵
    PID:2041
- - /usr/bin/sudo
    sudo -S touch .local_31595
    3⤵
    PID:2044
  - - /usr/bin/touch
      touch .local_31595
      4⤵
      Writes file to tmp directory
      PID:2045
- - /usr/bin/grep
    grep -c root
    3⤵
    PID:2048
- - /usr/bin/ls
    ls -l .local_31595
    3⤵
    PID:2047
- - /usr/bin/sudo
    sudo rm .local_31595
    3⤵
    PID:2049
  - - /usr/bin/rm
      rm .local_31595
      4⤵
      PID:2050
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:2055
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:2054
- - /usr/bin/grep
    grep "./crond -t=all"
    3⤵
    PID:2053
- - /usr/bin/sudo
    sudo ps auxff
    3⤵
    PID:2052
  - - /usr/bin/ps
      ps auxff
      4⤵
      PID:2056
- - /usr/bin/sudo
    sudo killall -9 bssh
    3⤵
    PID:2057
  - - /usr/bin/killall
      killall -9 bssh
      4⤵
      PID:2058
- - /usr/bin/sudo
    sudo rm -rf /tmp/.an
    3⤵
    PID:2059
  - - /usr/bin/rm
      rm -rf /tmp/.an
      4⤵
      PID:2060
- - /usr/bin/sudo
    sudo killall -9 xm64
    3⤵
    PID:2061
  - - /usr/bin/killall
      killall -9 xm64
      4⤵
      PID:2062
- - /usr/bin/sudo
    sudo killall -9 rpc.idmapd
    3⤵
    PID:2063
  - - /usr/bin/killall
      killall -9 rpc.idmapd
      4⤵
      PID:2064
- - /usr/bin/sudo
    sudo rm -rf /tmp/.m2
    3⤵
    PID:2065
  - - /usr/bin/rm
      rm -rf /tmp/.m2
      4⤵
      PID:2066
- - /usr/bin/sudo
    sudo killall -9 xorgg
    3⤵
    PID:2067
  - - /usr/bin/killall
      killall -9 xorgg
      4⤵
      PID:2068
- - /usr/bin/sudo
    sudo rm -rf /tmp/seconfig
    3⤵
    PID:2069
  - - /usr/bin/rm
      rm -rf /tmp/seconfig
      4⤵
      PID:2070
- - /usr/bin/sudo
    sudo killall -9 crond64
    3⤵
    PID:2071
  - - /usr/bin/killall
      killall -9 crond64
      4⤵
      PID:2072
- - /usr/bin/sudo
    sudo killall -9 tsm
    3⤵
    PID:2073
  - - /usr/bin/killall
      killall -9 tsm
      4⤵
      PID:2074
- - /usr/bin/sudo
    sudo rm -rf /tmp/.ssh
    3⤵
    PID:2075
  - - /usr/bin/rm
      rm -rf /tmp/.ssh
      4⤵
      PID:2076
- - /usr/bin/sudo
    sudo rm -rf /tmp/.java
    3⤵
    PID:2077
  - - /usr/bin/rm
      rm -rf /tmp/.java
      4⤵
      PID:2078
- - /usr/bin/sudo
    sudo rm -rf /tmp/.iolanda
    3⤵
    PID:2079
  - - /usr/bin/rm
      rm -rf /tmp/.iolanda
      4⤵
      PID:2080
- - /usr/bin/sudo
    sudo pkill test.mod
    3⤵
    PID:2081
  - - /usr/bin/pkill
      pkill test.mod
      4⤵
      PID:2082
- - /usr/bin/sudo
    sudo pkill daemon.i686.mod
    3⤵
    PID:2083
  - - /usr/bin/pkill
      pkill daemon.i686.mod
      4⤵
      Reads runtime system information
      PID:2084
- - /usr/bin/sudo
    sudo pkill daemon.armv4l.mod
    3⤵
    PID:2085
  - - /usr/bin/pkill
      pkill daemon.armv4l.mod
      4⤵
      Reads runtime system information
      PID:2086
- - /usr/bin/sudo
    sudo pkill daemon.mips.mod
    3⤵
    PID:2087
  - - /usr/bin/pkill
      pkill daemon.mips.mod
      4⤵
      Reads runtime system information
      PID:2088
- - /usr/bin/sudo
    sudo pkill daemon.mipsel.mod
    3⤵
    PID:2089
  - - /usr/bin/pkill
      pkill daemon.mipsel.mod
      4⤵
      PID:2090
- - /usr/bin/sudo
    sudo rm -rf /tmp/.xs
    3⤵
    PID:2091
  - - /usr/bin/rm
      rm -rf /tmp/.xs
      4⤵
      PID:2092
- - /usr/bin/sudo
    sudo pkill ld-linux-x86-64
    3⤵
    PID:2093
  - - /usr/bin/pkill
      pkill ld-linux-x86-64
      4⤵
      Reads runtime system information
      PID:2094
- - /usr/bin/rm
    rm -rf "/var/tmp/. *"
    3⤵
    PID:2095
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:2100
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:2099
- - /usr/bin/grep
    grep xmr
    3⤵
    PID:2098
- - /usr/bin/sudo
    sudo ps auxf
    3⤵
    PID:2097
  - - /usr/bin/ps
      ps auxf
      4⤵
      PID:2101
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:2106
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:2105
- - /usr/bin/grep
    grep cryptonight
    3⤵
    PID:2104
- - /usr/bin/sudo
    sudo ps auxf
    3⤵
    PID:2103
  - - /usr/bin/ps
      ps auxf
      4⤵
      Reads CPU attributes
      PID:2109
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:2114
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:2113
- - /usr/bin/grep
    grep stratum
    3⤵
    PID:2112
- - /usr/bin/sudo
    sudo ps auxf
    3⤵
    PID:2111
  - - /usr/bin/ps
      ps auxf
      4⤵
      Reads runtime system information
      PID:2115
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:2120
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:2119
- - /usr/bin/grep
    grep dbus-daemon--system
    3⤵
    PID:2118
- - /usr/bin/sudo
    sudo ps auxf
    3⤵
    PID:2117
  - - /usr/bin/ps
      ps auxf
      4⤵
      Reads runtime system information
      PID:2121
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:2126
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:2125
- - /usr/bin/grep
    grep "\\[\\]"
    3⤵
    PID:2124
- - /usr/bin/sudo
    sudo ps auxf
    3⤵
    PID:2123
  - - /usr/bin/ps
      ps auxf
      4⤵
      Reads CPU attributes
      PID:2127
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:2132
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:2131
- - /usr/bin/grep
    grep xm64
    3⤵
    PID:2130
- - /usr/bin/sudo
    sudo ps auxf
    3⤵
    PID:2129
  - - /usr/bin/ps
      ps auxf
      4⤵
      PID:2133
- - /usr/bin/sudo
    sudo killall -9 "[atd]"
    3⤵
    PID:2134
  - - /usr/bin/killall
      killall -9 "[atd]"
      4⤵
      PID:2135
- - /usr/bin/sudo
    sudo rm -rf /tmp/.jk
    3⤵
    PID:2136
  - - /usr/bin/rm
      rm -rf /tmp/.jk
      4⤵
      PID:2137
- - /usr/bin/sudo
    sudo killall -9 "[ntpd]"
    3⤵
    PID:2138
  - - /usr/bin/killall
      killall -9 "[ntpd]"
      4⤵
      PID:2139
- - /usr/bin/sudo
    sudo killall -9 "[rpciod]"
    3⤵
    PID:2140
  - - /usr/bin/killall
      killall -9 "[rpciod]"
      4⤵
      PID:2141
- - /usr/bin/sudo
    sudo killall -9 "[ext4-dio-unwrit]"
    3⤵
    PID:2142
  - - /usr/bin/killall
      killall -9 "[ext4-dio-unwrit]"
      4⤵
      PID:2143
- - /usr/bin/sudo
    sudo rm -rf "/tmp/.xm*"
    3⤵
    PID:2144
  - - /usr/bin/rm
      rm -rf "/tmp/.xm*"
      4⤵
      PID:2145
- - /usr/bin/pidof
    pidof libexec
    3⤵
    - Reads runtime system information
    PID:2146
- /usr/bin/free
  free -m
  2⤵
  - Reads CPU attributes
  PID:2107
- /usr/bin/uptime
  uptime
  2⤵
  PID:2108
- /usr/bin/free
  free -m
  2⤵
  - Reads CPU attributes
  PID:2147
- /usr/bin/uptime
  uptime
  2⤵
  PID:2148
- /bin/bash
  /bin/bash -
  2⤵
  PID:2149
- - /usr/bin/wc
    wc -l
    3⤵
    PID:2152
- - /usr/bin/which
    which sudo
    3⤵
    PID:2151
- - /usr/bin/sudo
    sudo -S touch .local_1615
    3⤵
    PID:2154
  - - /usr/bin/touch
      touch .local_1615
      4⤵
      Writes file to tmp directory
      PID:2155
- - /usr/bin/grep
    grep -c root
    3⤵
    PID:2158
- - /usr/bin/ls
    ls -l .local_1615
    3⤵
    PID:2157
- - /usr/bin/sudo
    sudo rm .local_1615
    3⤵
    PID:2159
  - - /usr/bin/rm
      rm .local_1615
      4⤵
      PID:2162
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:2167
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:2166
- - /usr/bin/grep
    grep "./crond -t=all"
    3⤵
    PID:2165
- - /usr/bin/sudo
    sudo ps auxff
    3⤵
    PID:2164
  - - /usr/bin/ps
      ps auxff
      4⤵
      PID:2168
- - /usr/bin/sudo
    sudo killall -9 bssh
    3⤵
    PID:2169
  - - /usr/bin/killall
      killall -9 bssh
      4⤵
      PID:2170
- - /usr/bin/sudo
    sudo rm -rf /tmp/.an
    3⤵
    PID:2171
  - - /usr/bin/rm
      rm -rf /tmp/.an
      4⤵
      PID:2172
- - /usr/bin/sudo
    sudo killall -9 xm64
    3⤵
    PID:2173
  - - /usr/bin/killall
      killall -9 xm64
      4⤵
      PID:2174
- - /usr/bin/sudo
    sudo killall -9 rpc.idmapd
    3⤵
    PID:2175
  - - /usr/bin/killall
      killall -9 rpc.idmapd
      4⤵
      PID:2176
- - /usr/bin/sudo
    sudo rm -rf /tmp/.m2
    3⤵
    PID:2177
  - - /usr/bin/rm
      rm -rf /tmp/.m2
      4⤵
      PID:2178
- - /usr/bin/sudo
    sudo killall -9 xorgg
    3⤵
    PID:2179
  - - /usr/bin/killall
      killall -9 xorgg
      4⤵
      PID:2180
- - /usr/bin/sudo
    sudo rm -rf /tmp/seconfig
    3⤵
    PID:2181
  - - /usr/bin/rm
      rm -rf /tmp/seconfig
      4⤵
      PID:2182
- - /usr/bin/sudo
    sudo killall -9 crond64
    3⤵
    PID:2183
  - - /usr/bin/killall
      killall -9 crond64
      4⤵
      PID:2184
- - /usr/bin/sudo
    sudo killall -9 tsm
    3⤵
    PID:2185
  - - /usr/bin/killall
      killall -9 tsm
      4⤵
      PID:2186
- - /usr/bin/sudo
    sudo rm -rf /tmp/.ssh
    3⤵
    PID:2187
  - - /usr/bin/rm
      rm -rf /tmp/.ssh
      4⤵
      PID:2188
- - /usr/bin/sudo
    sudo rm -rf /tmp/.java
    3⤵
    PID:2189
  - - /usr/bin/rm
      rm -rf /tmp/.java
      4⤵
      PID:2190
- - /usr/bin/sudo
    sudo rm -rf /tmp/.iolanda
    3⤵
    PID:2191
  - - /usr/bin/rm
      rm -rf /tmp/.iolanda
      4⤵
      PID:2192
- - /usr/bin/sudo
    sudo pkill test.mod
    3⤵
    PID:2193
  - - /usr/bin/pkill
      pkill test.mod
      4⤵
      PID:2194
- - /usr/bin/sudo
    sudo pkill daemon.i686.mod
    3⤵
    PID:2195
  - - /usr/bin/pkill
      pkill daemon.i686.mod
      4⤵
      PID:2196
- - /usr/bin/sudo
    sudo pkill daemon.armv4l.mod
    3⤵
    PID:2197
  - - /usr/bin/pkill
      pkill daemon.armv4l.mod
      4⤵
      PID:2198
- - /usr/bin/sudo
    sudo pkill daemon.mips.mod
    3⤵
    PID:2199
  - - /usr/bin/pkill
      pkill daemon.mips.mod
      4⤵
      PID:2200
- - /usr/bin/sudo
    sudo pkill daemon.mipsel.mod
    3⤵
    PID:2201
  - - /usr/bin/pkill
      pkill daemon.mipsel.mod
      4⤵
      PID:2202
- - /usr/bin/sudo
    sudo rm -rf /tmp/.xs
    3⤵
    PID:2203
  - - /usr/bin/rm
      rm -rf /tmp/.xs
      4⤵
      PID:2204
- - /usr/bin/sudo
    sudo pkill ld-linux-x86-64
    3⤵
    PID:2205
  - - /usr/bin/pkill
      pkill ld-linux-x86-64
      4⤵
      Reads CPU attributes
      PID:2206
- - /usr/bin/rm
    rm -rf "/var/tmp/. *"
    3⤵
    PID:2207
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:2212
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:2211
- - /usr/bin/grep
    grep xmr
    3⤵
    PID:2210
- - /usr/bin/sudo
    sudo ps auxf
    3⤵
    PID:2209
  - - /usr/bin/ps
      ps auxf
      4⤵
      Reads runtime system information
      PID:2213
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:2218
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:2217
- - /usr/bin/grep
    grep cryptonight
    3⤵
    PID:2216
- - /usr/bin/sudo
    sudo ps auxf
    3⤵
    PID:2215
  - - /usr/bin/ps
      ps auxf
      4⤵
      Reads CPU attributes
      PID:2219
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:2224
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:2223
- - /usr/bin/grep
    grep stratum
    3⤵
    PID:2222
- - /usr/bin/sudo
    sudo ps auxf
    3⤵
    PID:2221
  - - /usr/bin/ps
      ps auxf
      4⤵
      PID:2225
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:2230
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:2229
- - /usr/bin/grep
    grep dbus-daemon--system
    3⤵
    PID:2228
- - /usr/bin/sudo
    sudo ps auxf
    3⤵
    PID:2227
  - - /usr/bin/ps
      ps auxf
      4⤵
      Reads CPU attributes
      PID:2231
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:2236
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:2235
- - /usr/bin/grep
    grep "\\[\\]"
    3⤵
    PID:2234
- - /usr/bin/sudo
    sudo ps auxf
    3⤵
    PID:2233
  - - /usr/bin/ps
      ps auxf
      4⤵
      PID:2237
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:2242
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:2241
- - /usr/bin/grep
    grep xm64
    3⤵
    PID:2240
- - /usr/bin/sudo
    sudo ps auxf
    3⤵
    PID:2239
  - - /usr/bin/ps
      ps auxf
      4⤵
      Reads CPU attributes
      PID:2243
- - /usr/bin/sudo
    sudo killall -9 "[atd]"
    3⤵
    PID:2244
  - - /usr/bin/killall
      killall -9 "[atd]"
      4⤵
      PID:2245
- - /usr/bin/sudo
    sudo rm -rf /tmp/.jk
    3⤵
    PID:2246
  - - /usr/bin/rm
      rm -rf /tmp/.jk
      4⤵
      PID:2247
- - /usr/bin/sudo
    sudo killall -9 "[ntpd]"
    3⤵
    PID:2248
  - - /usr/bin/killall
      killall -9 "[ntpd]"
      4⤵
      PID:2249
- - /usr/bin/sudo
    sudo killall -9 "[rpciod]"
    3⤵
    PID:2250
  - - /usr/bin/killall
      killall -9 "[rpciod]"
      4⤵
      Reads runtime system information
      PID:2251
- - /usr/bin/sudo
    sudo killall -9 "[ext4-dio-unwrit]"
    3⤵
    PID:2252
  - - /usr/bin/killall
      killall -9 "[ext4-dio-unwrit]"
      4⤵
      PID:2255
- - /usr/bin/sudo
    sudo rm -rf "/tmp/.xm*"
    3⤵
    PID:2256
  - - /usr/bin/rm
      rm -rf "/tmp/.xm*"
      4⤵
      PID:2257
- - /usr/bin/pidof
    pidof libexec
    3⤵
    PID:2258
- /usr/bin/free
  free -m
  2⤵
  - Reads CPU attributes
  PID:2160
- /usr/bin/uptime
  uptime
  2⤵
  PID:2161
- /usr/bin/free
  free -m
  2⤵
  PID:2253
- /usr/bin/uptime
  uptime
  2⤵
  - Reads CPU attributes
  PID:2254
- /bin/bash
  /bin/bash -
  2⤵
  PID:2259
- - /usr/bin/wc
    wc -l
    3⤵
    PID:2262
- - /usr/bin/which
    which sudo
    3⤵
    PID:2261
- - /usr/bin/sudo
    sudo -S touch .local_9022
    3⤵
    PID:2264
  - - /usr/bin/touch
      touch .local_9022
      4⤵
      Writes file to tmp directory
      PID:2265
- - /usr/bin/grep
    grep -c root
    3⤵
    PID:2268
- - /usr/bin/ls
    ls -l .local_9022
    3⤵
    PID:2267
- - /usr/bin/sudo
    sudo rm .local_9022
    3⤵
    PID:2269
  - - /usr/bin/rm
      rm .local_9022
      4⤵
      PID:2270
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:2275
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:2274
- - /usr/bin/grep
    grep "./crond -t=all"
    3⤵
    PID:2273
- - /usr/bin/sudo
    sudo ps auxff
    3⤵
    PID:2272
  - - /usr/bin/ps
      ps auxff
      4⤵
      PID:2278
- - /usr/bin/sudo
    sudo killall -9 bssh
    3⤵
    PID:2279
  - - /usr/bin/killall
      killall -9 bssh
      4⤵
      PID:2280
- - /usr/bin/sudo
    sudo rm -rf /tmp/.an
    3⤵
    PID:2281
  - - /usr/bin/rm
      rm -rf /tmp/.an
      4⤵
      PID:2282
- - /usr/bin/sudo
    sudo killall -9 xm64
    3⤵
    PID:2283
  - - /usr/bin/killall
      killall -9 xm64
      4⤵
      PID:2284
- - /usr/bin/sudo
    sudo killall -9 rpc.idmapd
    3⤵
    PID:2285
  - - /usr/bin/killall
      killall -9 rpc.idmapd
      4⤵
      PID:2286
- - /usr/bin/sudo
    sudo rm -rf /tmp/.m2
    3⤵
    PID:2287
  - - /usr/bin/rm
      rm -rf /tmp/.m2
      4⤵
      PID:2288
- - /usr/bin/sudo
    sudo killall -9 xorgg
    3⤵
    PID:2289
  - - /usr/bin/killall
      killall -9 xorgg
      4⤵
      PID:2290
- - /usr/bin/sudo
    sudo rm -rf /tmp/seconfig
    3⤵
    PID:2291
  - - /usr/bin/rm
      rm -rf /tmp/seconfig
      4⤵
      PID:2292
- - /usr/bin/sudo
    sudo killall -9 crond64
    3⤵
    PID:2293
  - - /usr/bin/killall
      killall -9 crond64
      4⤵
      Reads runtime system information
      PID:2294
- - /usr/bin/sudo
    sudo killall -9 tsm
    3⤵
    PID:2295
  - - /usr/bin/killall
      killall -9 tsm
      4⤵
      PID:2296
- - /usr/bin/sudo
    sudo rm -rf /tmp/.ssh
    3⤵
    PID:2297
  - - /usr/bin/rm
      rm -rf /tmp/.ssh
      4⤵
      PID:2298
- - /usr/bin/sudo
    sudo rm -rf /tmp/.java
    3⤵
    PID:2299
  - - /usr/bin/rm
      rm -rf /tmp/.java
      4⤵
      PID:2300
- - /usr/bin/sudo
    sudo rm -rf /tmp/.iolanda
    3⤵
    PID:2301
  - - /usr/bin/rm
      rm -rf /tmp/.iolanda
      4⤵
      PID:2302
- - /usr/bin/sudo
    sudo pkill test.mod
    3⤵
    PID:2303
  - - /usr/bin/pkill
      pkill test.mod
      4⤵
      PID:2304
- - /usr/bin/sudo
    sudo pkill daemon.i686.mod
    3⤵
    PID:2305
  - - /usr/bin/pkill
      pkill daemon.i686.mod
      4⤵
      PID:2306
- - /usr/bin/sudo
    sudo pkill daemon.armv4l.mod
    3⤵
    PID:2307
  - - /usr/bin/pkill
      pkill daemon.armv4l.mod
      4⤵
      PID:2308
- - /usr/bin/sudo
    sudo pkill daemon.mips.mod
    3⤵
    PID:2309
  - - /usr/bin/pkill
      pkill daemon.mips.mod
      4⤵
      Reads CPU attributes
      PID:2310
- - /usr/bin/sudo
    sudo pkill daemon.mipsel.mod
    3⤵
    PID:2311
  - - /usr/bin/pkill
      pkill daemon.mipsel.mod
      4⤵
      PID:2312
- - /usr/bin/sudo
    sudo rm -rf /tmp/.xs
    3⤵
    PID:2313
  - - /usr/bin/rm
      rm -rf /tmp/.xs
      4⤵
      PID:2314
- - /usr/bin/sudo
    sudo pkill ld-linux-x86-64
    3⤵
    PID:2315
  - - /usr/bin/pkill
      pkill ld-linux-x86-64
      4⤵
      PID:2316
- - /usr/bin/rm
    rm -rf "/var/tmp/. *"
    3⤵
    PID:2317
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:2322
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:2321
- - /usr/bin/grep
    grep xmr
    3⤵
    PID:2320
- - /usr/bin/sudo
    sudo ps auxf
    3⤵
    PID:2319
  - - /usr/bin/ps
      ps auxf
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:2323
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:2328
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:2327
- - /usr/bin/grep
    grep cryptonight
    3⤵
    PID:2326
- - /usr/bin/sudo
    sudo ps auxf
    3⤵
    PID:2325
  - - /usr/bin/ps
      ps auxf
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:2329
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:2334
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:2333
- - /usr/bin/grep
    grep stratum
    3⤵
    PID:2332
- - /usr/bin/sudo
    sudo ps auxf
    3⤵
    PID:2331
  - - /usr/bin/ps
      ps auxf
      4⤵
      PID:2335
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:2340
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:2339
- - /usr/bin/grep
    grep dbus-daemon--system
    3⤵
    PID:2338
- - /usr/bin/sudo
    sudo ps auxf
    3⤵
    PID:2337
  - - /usr/bin/ps
      ps auxf
      4⤵
      Reads runtime system information
      PID:2341
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:2346
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:2345
- - /usr/bin/grep
    grep "\\[\\]"
    3⤵
    PID:2344
- - /usr/bin/sudo
    sudo ps auxf
    3⤵
    PID:2343
  - - /usr/bin/ps
      ps auxf
      4⤵
      PID:2347
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:2352
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:2351
- - /usr/bin/grep
    grep xm64
    3⤵
    PID:2350
- - /usr/bin/sudo
    sudo ps auxf
    3⤵
    PID:2349
  - - /usr/bin/ps
      ps auxf
      4⤵
      Reads runtime system information
      PID:2353
- - /usr/bin/sudo
    sudo killall -9 "[atd]"
    3⤵
    PID:2354
  - - /usr/bin/killall
      killall -9 "[atd]"
      4⤵
      Reads runtime system information
      PID:2355
- - /usr/bin/sudo
    sudo rm -rf /tmp/.jk
    3⤵
    PID:2356
  - - /usr/bin/rm
      rm -rf /tmp/.jk
      4⤵
      PID:2357
- - /usr/bin/sudo
    sudo killall -9 "[ntpd]"
    3⤵
    PID:2358
  - - /usr/bin/killall
      killall -9 "[ntpd]"
      4⤵
      PID:2359
- - /usr/bin/sudo
    sudo killall -9 "[rpciod]"
    3⤵
    PID:2360
  - - /usr/bin/killall
      killall -9 "[rpciod]"
      4⤵
      PID:2361
- - /usr/bin/sudo
    sudo killall -9 "[ext4-dio-unwrit]"
    3⤵
    PID:2362
  - - /usr/bin/killall
      killall -9 "[ext4-dio-unwrit]"
      4⤵
      Reads runtime system information
      PID:2363
- - /usr/bin/sudo
    sudo rm -rf "/tmp/.xm*"
    3⤵
    PID:2364
  - - /usr/bin/rm
      rm -rf "/tmp/.xm*"
      4⤵
      PID:2365
- - /usr/bin/pidof
    pidof libexec
    3⤵
    PID:2366
- /usr/bin/free
  free -m
  2⤵
  - Reads CPU attributes
  PID:2276
- /usr/bin/uptime
  uptime
  2⤵
  - Reads CPU attributes
  PID:2277
- /bin/bash
  /bin/bash -
  2⤵
  PID:2370
- - /usr/bin/wc
    wc -l
    3⤵
    PID:2373
- - /usr/bin/which
    which sudo
    3⤵
    PID:2372
- - /usr/bin/sudo
    sudo -S touch .local_2830
    3⤵
    PID:2375
  - - /usr/bin/touch
      touch .local_2830
      4⤵
      Writes file to tmp directory
      PID:2376
- - /usr/bin/grep
    grep -c root
    3⤵
    PID:2379
- - /usr/bin/ls
    ls -l .local_2830
    3⤵
    PID:2378
- - /usr/bin/sudo
    sudo rm .local_2830
    3⤵
    PID:2380
  - - /usr/bin/rm
      rm .local_2830
      4⤵
      PID:2381
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:2386
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:2385
- - /usr/bin/grep
    grep "./crond -t=all"
    3⤵
    PID:2384
- - /usr/bin/sudo
    sudo ps auxff
    3⤵
    PID:2383
  - - /usr/bin/ps
      ps auxff
      4⤵
      PID:2387
- - /usr/bin/sudo
    sudo killall -9 bssh
    3⤵
    PID:2388
  - - /usr/bin/killall
      killall -9 bssh
      4⤵
      PID:2389
- - /usr/bin/sudo
    sudo rm -rf /tmp/.an
    3⤵
    PID:2390
  - - /usr/bin/rm
      rm -rf /tmp/.an
      4⤵
      PID:2391
- - /usr/bin/sudo
    sudo killall -9 xm64
    3⤵
    PID:2392
  - - /usr/bin/killall
      killall -9 xm64
      4⤵
      PID:2393
- - /usr/bin/sudo
    sudo killall -9 rpc.idmapd
    3⤵
    PID:2394
  - - /usr/bin/killall
      killall -9 rpc.idmapd
      4⤵
      PID:2395
- - /usr/bin/sudo
    sudo rm -rf /tmp/.m2
    3⤵
    PID:2396
  - - /usr/bin/rm
      rm -rf /tmp/.m2
      4⤵
      PID:2397
- - /usr/bin/sudo
    sudo killall -9 xorgg
    3⤵
    PID:2398
  - - /usr/bin/killall
      killall -9 xorgg
      4⤵
      PID:2399
- - /usr/bin/sudo
    sudo rm -rf /tmp/seconfig
    3⤵
    PID:2400
  - - /usr/bin/rm
      rm -rf /tmp/seconfig
      4⤵
      PID:2401
- - /usr/bin/sudo
    sudo killall -9 crond64
    3⤵
    PID:2402
  - - /usr/bin/killall
      killall -9 crond64
      4⤵
      PID:2403
- - /usr/bin/sudo
    sudo killall -9 tsm
    3⤵
    PID:2404
  - - /usr/bin/killall
      killall -9 tsm
      4⤵
      PID:2405
- - /usr/bin/sudo
    sudo rm -rf /tmp/.ssh
    3⤵
    PID:2406
  - - /usr/bin/rm
      rm -rf /tmp/.ssh
      4⤵
      PID:2407
- - /usr/bin/sudo
    sudo rm -rf /tmp/.java
    3⤵
    PID:2408
  - - /usr/bin/rm
      rm -rf /tmp/.java
      4⤵
      PID:2411
- - /usr/bin/sudo
    sudo rm -rf /tmp/.iolanda
    3⤵
    PID:2412
  - - /usr/bin/rm
      rm -rf /tmp/.iolanda
      4⤵
      PID:2413
- - /usr/bin/sudo
    sudo pkill test.mod
    3⤵
    PID:2414
  - - /usr/bin/pkill
      pkill test.mod
      4⤵
      Reads runtime system information
      PID:2415
- - /usr/bin/sudo
    sudo pkill daemon.i686.mod
    3⤵
    PID:2416
  - - /usr/bin/pkill
      pkill daemon.i686.mod
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:2417
- - /usr/bin/sudo
    sudo pkill daemon.armv4l.mod
    3⤵
    PID:2418
  - - /usr/bin/pkill
      pkill daemon.armv4l.mod
      4⤵
      PID:2419
- - /usr/bin/sudo
    sudo pkill daemon.mips.mod
    3⤵
    PID:2420
  - - /usr/bin/pkill
      pkill daemon.mips.mod
      4⤵
      Reads runtime system information
      PID:2421
- - /usr/bin/sudo
    sudo pkill daemon.mipsel.mod
    3⤵
    PID:2422
  - - /usr/bin/pkill
      pkill daemon.mipsel.mod
      4⤵
      Reads CPU attributes
      PID:2423
- - /usr/bin/sudo
    sudo rm -rf /tmp/.xs
    3⤵
    PID:2424
  - - /usr/bin/rm
      rm -rf /tmp/.xs
      4⤵
      PID:2425
- - /usr/bin/sudo
    sudo pkill ld-linux-x86-64
    3⤵
    PID:2426
  - - /usr/bin/pkill
      pkill ld-linux-x86-64
      4⤵
      Reads CPU attributes
      PID:2427
- - /usr/bin/rm
    rm -rf "/var/tmp/. *"
    3⤵
    PID:2428
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:2433
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:2432
- - /usr/bin/grep
    grep xmr
    3⤵
    PID:2431
- - /usr/bin/sudo
    sudo ps auxf
    3⤵
    PID:2430
  - - /usr/bin/ps
      ps auxf
      4⤵
      PID:2434
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:2439
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:2438
- - /usr/bin/grep
    grep cryptonight
    3⤵
    PID:2437
- - /usr/bin/sudo
    sudo ps auxf
    3⤵
    PID:2436
  - - /usr/bin/ps
      ps auxf
      4⤵
      PID:2440
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:2445
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:2444
- - /usr/bin/grep
    grep stratum
    3⤵
    PID:2443
- - /usr/bin/sudo
    sudo ps auxf
    3⤵
    PID:2442
  - - /usr/bin/ps
      ps auxf
      4⤵
      Reads CPU attributes
      PID:2446
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:2451
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:2450
- - /usr/bin/grep
    grep dbus-daemon--system
    3⤵
    PID:2449
- - /usr/bin/sudo
    sudo ps auxf
    3⤵
    PID:2448
  - - /usr/bin/ps
      ps auxf
      4⤵
      Reads runtime system information
      PID:2452
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:2457
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:2456
- - /usr/bin/grep
    grep "\\[\\]"
    3⤵
    PID:2455
- - /usr/bin/sudo
    sudo ps auxf
    3⤵
    PID:2454
  - - /usr/bin/ps
      ps auxf
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:2458
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:2463
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:2462
- - /usr/bin/grep
    grep xm64
    3⤵
    PID:2461
- - /usr/bin/sudo
    sudo ps auxf
    3⤵
    PID:2460
  - - /usr/bin/ps
      ps auxf
      4⤵
      Reads runtime system information
      PID:2464
- - /usr/bin/sudo
    sudo killall -9 "[atd]"
    3⤵
    PID:2465
  - - /usr/bin/killall
      killall -9 "[atd]"
      4⤵
      PID:2466
- - /usr/bin/sudo
    sudo rm -rf /tmp/.jk
    3⤵
    PID:2467
  - - /usr/bin/rm
      rm -rf /tmp/.jk
      4⤵
      PID:2468
- - /usr/bin/sudo
    sudo killall -9 "[ntpd]"
    3⤵
    PID:2469
  - - /usr/bin/killall
      killall -9 "[ntpd]"
      4⤵
      PID:2470
- - /usr/bin/sudo
    sudo killall -9 "[rpciod]"
    3⤵
    PID:2471
  - - /usr/bin/killall
      killall -9 "[rpciod]"
      4⤵
      PID:2474
- - /usr/bin/sudo
    sudo killall -9 "[ext4-dio-unwrit]"
    3⤵
    PID:2475
  - - /usr/bin/killall
      killall -9 "[ext4-dio-unwrit]"
      4⤵
      PID:2476
- - /usr/bin/sudo
    sudo rm -rf "/tmp/.xm*"
    3⤵
    PID:2477
  - - /usr/bin/rm
      rm -rf "/tmp/.xm*"
      4⤵
      PID:2478
- - /usr/bin/pidof
    pidof libexec
    3⤵
    - Reads runtime system information
    PID:2479
- /usr/bin/free
  free -m
  2⤵
  PID:2409
- /usr/bin/uptime
  uptime
  2⤵
  PID:2410
- /usr/bin/free
  free -m
  2⤵
  - Reads CPU attributes
  PID:2472
- /usr/bin/uptime
  uptime
  2⤵
  - Reads CPU attributes
  PID:2473
- /bin/bash
  /bin/bash -
  2⤵
  PID:2480
- - /usr/bin/wc
    wc -l
    3⤵
    PID:2483
- - /usr/bin/which
    which sudo
    3⤵
    PID:2482
- - /usr/bin/sudo
    sudo -S touch .local_28642
    3⤵
    PID:2485
  - - /usr/bin/touch
      touch .local_28642
      4⤵
      Writes file to tmp directory
      PID:2486
- - /usr/bin/grep
    grep -c root
    3⤵
    PID:2489
- - /usr/bin/ls
    ls -l .local_28642
    3⤵
    PID:2488
- - /usr/bin/sudo
    sudo rm .local_28642
    3⤵
    PID:2490
  - - /usr/bin/rm
      rm .local_28642
      4⤵
      PID:2491
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:2496
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:2495
- - /usr/bin/grep
    grep "./crond -t=all"
    3⤵
    PID:2494
- - /usr/bin/sudo
    sudo ps auxff
    3⤵
    PID:2493
  - - /usr/bin/ps
      ps auxff
      4⤵
      PID:2497
- - /usr/bin/sudo
    sudo killall -9 bssh
    3⤵
    PID:2498
  - - /usr/bin/killall
      killall -9 bssh
      4⤵
      PID:2499
- - /usr/bin/sudo
    sudo rm -rf /tmp/.an
    3⤵
    PID:2500
  - - /usr/bin/rm
      rm -rf /tmp/.an
      4⤵
      PID:2501
- - /usr/bin/sudo
    sudo killall -9 xm64
    3⤵
    PID:2502
  - - /usr/bin/killall
      killall -9 xm64
      4⤵
      PID:2503
- - /usr/bin/sudo
    sudo killall -9 rpc.idmapd
    3⤵
    PID:2504
  - - /usr/bin/killall
      killall -9 rpc.idmapd
      4⤵
      PID:2505
- - /usr/bin/sudo
    sudo rm -rf /tmp/.m2
    3⤵
    PID:2506
  - - /usr/bin/rm
      rm -rf /tmp/.m2
      4⤵
      PID:2507
- - /usr/bin/sudo
    sudo killall -9 xorgg
    3⤵
    PID:2508
  - - /usr/bin/killall
      killall -9 xorgg
      4⤵
      PID:2509
- - /usr/bin/sudo
    sudo rm -rf /tmp/seconfig
    3⤵
    PID:2510
  - - /usr/bin/rm
      rm -rf /tmp/seconfig
      4⤵
      PID:2511
- - /usr/bin/sudo
    sudo killall -9 crond64
    3⤵
    PID:2512
  - - /usr/bin/killall
      killall -9 crond64
      4⤵
      PID:2513
- - /usr/bin/sudo
    sudo killall -9 tsm
    3⤵
    PID:2514
  - - /usr/bin/killall
      killall -9 tsm
      4⤵
      PID:2515
- - /usr/bin/sudo
    sudo rm -rf /tmp/.ssh
    3⤵
    PID:2516
  - - /usr/bin/rm
      rm -rf /tmp/.ssh
      4⤵
      PID:2517
- - /usr/bin/sudo
    sudo rm -rf /tmp/.java
    3⤵
    PID:2518
  - - /usr/bin/rm
      rm -rf /tmp/.java
      4⤵
      PID:2519
- - /usr/bin/sudo
    sudo rm -rf /tmp/.iolanda
    3⤵
    PID:2520
  - - /usr/bin/rm
      rm -rf /tmp/.iolanda
      4⤵
      PID:2521
- - /usr/bin/sudo
    sudo pkill test.mod
    3⤵
    PID:2522
  - - /usr/bin/pkill
      pkill test.mod
      4⤵
      Reads CPU attributes
      PID:2523
- - /usr/bin/sudo
    sudo pkill daemon.i686.mod
    3⤵
    PID:2524
  - - /usr/bin/pkill
      pkill daemon.i686.mod
      4⤵
      PID:2525
- - /usr/bin/sudo
    sudo pkill daemon.armv4l.mod
    3⤵
    PID:2526
  - - /usr/bin/pkill
      pkill daemon.armv4l.mod
      4⤵
      PID:2527
- - /usr/bin/sudo
    sudo pkill daemon.mips.mod
    3⤵
    PID:2528
  - - /usr/bin/pkill
      pkill daemon.mips.mod
      4⤵
      Reads CPU attributes
      PID:2529
- - /usr/bin/sudo
    sudo pkill daemon.mipsel.mod
    3⤵
    PID:2530
  - - /usr/bin/pkill
      pkill daemon.mipsel.mod
      4⤵
      PID:2531
- - /usr/bin/sudo
    sudo rm -rf /tmp/.xs
    3⤵
    PID:2532
  - - /usr/bin/rm
      rm -rf /tmp/.xs
      4⤵
      PID:2533
- - /usr/bin/sudo
    sudo pkill ld-linux-x86-64
    3⤵
    PID:2534
  - - /usr/bin/pkill
      pkill ld-linux-x86-64
      4⤵
      Reads CPU attributes
      PID:2535
- - /usr/bin/rm
    rm -rf "/var/tmp/. *"
    3⤵
    PID:2536
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:2541
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:2540
- - /usr/bin/grep
    grep xmr
    3⤵
    PID:2539
- - /usr/bin/sudo
    sudo ps auxf
    3⤵
    PID:2538
  - - /usr/bin/ps
      ps auxf
      4⤵
      PID:2542
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:2547
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:2546
- - /usr/bin/grep
    grep cryptonight
    3⤵
    PID:2545
- - /usr/bin/sudo
    sudo ps auxf
    3⤵
    PID:2544
  - - /usr/bin/ps
      ps auxf
      4⤵
      PID:2548
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:2553
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:2552
- - /usr/bin/grep
    grep stratum
    3⤵
    PID:2551
- - /usr/bin/sudo
    sudo ps auxf
    3⤵
    PID:2550
  - - /usr/bin/ps
      ps auxf
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:2554
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:2559
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:2558
- - /usr/bin/grep
    grep dbus-daemon--system
    3⤵
    PID:2557
- - /usr/bin/sudo
    sudo ps auxf
    3⤵
    PID:2556
  - - /usr/bin/ps
      ps auxf
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:2560
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:2565
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:2564
- - /usr/bin/grep
    grep "\\[\\]"
    3⤵
    PID:2563
- - /usr/bin/sudo
    sudo ps auxf
    3⤵
    PID:2562
  - - /usr/bin/ps
      ps auxf
      4⤵
      Reads runtime system information
      PID:2566
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:2571
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:2570
- - /usr/bin/grep
    grep xm64
    3⤵
    PID:2569
- - /usr/bin/sudo
    sudo ps auxf
    3⤵
    PID:2568
  - - /usr/bin/ps
      ps auxf
      4⤵
      PID:2572
- - /usr/bin/sudo
    sudo killall -9 "[atd]"
    3⤵
    PID:2573
  - - /usr/bin/killall
      killall -9 "[atd]"
      4⤵
      PID:2574
- - /usr/bin/sudo
    sudo rm -rf /tmp/.jk
    3⤵
    PID:2575
  - - /usr/bin/rm
      rm -rf /tmp/.jk
      4⤵
      PID:2576
- - /usr/bin/sudo
    sudo killall -9 "[ntpd]"
    3⤵
    PID:2577
  - - /usr/bin/killall
      killall -9 "[ntpd]"
      4⤵
      PID:2578
- - /usr/bin/sudo
    sudo killall -9 "[rpciod]"
    3⤵
    PID:2579
  - - /usr/bin/killall
      killall -9 "[rpciod]"
      4⤵
      PID:2580
- - /usr/bin/sudo
    sudo killall -9 "[ext4-dio-unwrit]"
    3⤵
    PID:2581
  - - /usr/bin/killall
      killall -9 "[ext4-dio-unwrit]"
      4⤵
      PID:2582
- - /usr/bin/sudo
    sudo rm -rf "/tmp/.xm*"
    3⤵
    PID:2583
  - - /usr/bin/rm
      rm -rf "/tmp/.xm*"
      4⤵
      PID:2584
- - /usr/bin/pidof
    pidof libexec
    3⤵
    PID:2585
- /usr/bin/free
  free -m
  2⤵
  - Reads CPU attributes
  PID:2586
- /usr/bin/uptime
  uptime
  2⤵
  PID:2587
- /bin/bash
  /bin/bash -
  2⤵
  PID:2588
- - /usr/bin/wc
    wc -l
    3⤵
    PID:2591
- - /usr/bin/which
    which sudo
    3⤵
    PID:2590
- - /usr/bin/sudo
    sudo -S touch .local_5650
    3⤵
    PID:2593
  - - /usr/bin/touch
      touch .local_5650
      4⤵
      Writes file to tmp directory
      PID:2594
- - /usr/bin/grep
    grep -c root
    3⤵
    PID:2597
- - /usr/bin/ls
    ls -l .local_5650
    3⤵
    PID:2596
- - /usr/bin/sudo
    sudo rm .local_5650
    3⤵
    PID:2598
  - - /usr/bin/rm
      rm .local_5650
      4⤵
      PID:2599
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:2604
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:2603
- - /usr/bin/grep
    grep "./crond -t=all"
    3⤵
    PID:2602
- - /usr/bin/sudo
    sudo ps auxff
    3⤵
    PID:2601
  - - /usr/bin/ps
      ps auxff
      4⤵
      PID:2605
- - /usr/bin/sudo
    sudo killall -9 bssh
    3⤵
    PID:2606
  - - /usr/bin/killall
      killall -9 bssh
      4⤵
      PID:2607
- - /usr/bin/sudo
    sudo rm -rf /tmp/.an
    3⤵
    PID:2608
  - - /usr/bin/rm
      rm -rf /tmp/.an
      4⤵
      PID:2609
- - /usr/bin/sudo
    sudo killall -9 xm64
    3⤵
    PID:2610
  - - /usr/bin/killall
      killall -9 xm64
      4⤵
      PID:2611
- - /usr/bin/sudo
    sudo killall -9 rpc.idmapd
    3⤵
    PID:2612
  - - /usr/bin/killall
      killall -9 rpc.idmapd
      4⤵
      PID:2613
- - /usr/bin/sudo
    sudo rm -rf /tmp/.m2
    3⤵
    PID:2614
  - - /usr/bin/rm
      rm -rf /tmp/.m2
      4⤵
      PID:2615
- - /usr/bin/sudo
    sudo killall -9 xorgg
    3⤵
    PID:2616
  - - /usr/bin/killall
      killall -9 xorgg
      4⤵
      PID:2617
- - /usr/bin/sudo
    sudo rm -rf /tmp/seconfig
    3⤵
    PID:2618
  - - /usr/bin/rm
      rm -rf /tmp/seconfig
      4⤵
      PID:2619
- - /usr/bin/sudo
    sudo killall -9 crond64
    3⤵
    PID:2620
  - - /usr/bin/killall
      killall -9 crond64
      4⤵
      Reads runtime system information
      PID:2621
- - /usr/bin/sudo
    sudo killall -9 tsm
    3⤵
    PID:2622
  - - /usr/bin/killall
      killall -9 tsm
      4⤵
      PID:2623
- - /usr/bin/sudo
    sudo rm -rf /tmp/.ssh
    3⤵
    PID:2624
  - - /usr/bin/rm
      rm -rf /tmp/.ssh
      4⤵
      PID:2625
- - /usr/bin/sudo
    sudo rm -rf /tmp/.java
    3⤵
    PID:2626
  - - /usr/bin/rm
      rm -rf /tmp/.java
      4⤵
      PID:2627
- - /usr/bin/sudo
    sudo rm -rf /tmp/.iolanda
    3⤵
    PID:2628
  - - /usr/bin/rm
      rm -rf /tmp/.iolanda
      4⤵
      PID:2629
- - /usr/bin/sudo
    sudo pkill test.mod
    3⤵
    PID:2630
  - - /usr/bin/pkill
      pkill test.mod
      4⤵
      Reads runtime system information
      PID:2631
- - /usr/bin/sudo
    sudo pkill daemon.i686.mod
    3⤵
    PID:2632
  - - /usr/bin/pkill
      pkill daemon.i686.mod
      4⤵
      PID:2633
- - /usr/bin/sudo
    sudo pkill daemon.armv4l.mod
    3⤵
    PID:2634
  - - /usr/bin/pkill
      pkill daemon.armv4l.mod
      4⤵
      Reads CPU attributes
      PID:2635
- - /usr/bin/sudo
    sudo pkill daemon.mips.mod
    3⤵
    PID:2636
  - - /usr/bin/pkill
      pkill daemon.mips.mod
      4⤵
      Reads CPU attributes
      PID:2637
- - /usr/bin/sudo
    sudo pkill daemon.mipsel.mod
    3⤵
    PID:2638
  - - /usr/bin/pkill
      pkill daemon.mipsel.mod
      4⤵
      PID:2639
- - /usr/bin/sudo
    sudo rm -rf /tmp/.xs
    3⤵
    PID:2640
  - - /usr/bin/rm
      rm -rf /tmp/.xs
      4⤵
      PID:2641
- - /usr/bin/sudo
    sudo pkill ld-linux-x86-64
    3⤵
    PID:2642
  - - /usr/bin/pkill
      pkill ld-linux-x86-64
      4⤵
      Reads CPU attributes
      PID:2643
- - /usr/bin/rm
    rm -rf "/var/tmp/. *"
    3⤵
    PID:2644
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:2649
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:2648
- - /usr/bin/grep
    grep xmr
    3⤵
    PID:2647
- - /usr/bin/sudo
    sudo ps auxf
    3⤵
    PID:2646
  - - /usr/bin/ps
      ps auxf
      4⤵
      PID:2650
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:2655
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:2654
- - /usr/bin/grep
    grep cryptonight
    3⤵
    PID:2653
- - /usr/bin/sudo
    sudo ps auxf
    3⤵
    PID:2652
  - - /usr/bin/ps
      ps auxf
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:2656
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:2661
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:2660
- - /usr/bin/grep
    grep stratum
    3⤵
    PID:2659
- - /usr/bin/sudo
    sudo ps auxf
    3⤵
    PID:2658
  - - /usr/bin/ps
      ps auxf
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:2662
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:2667
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:2666
- - /usr/bin/grep
    grep dbus-daemon--system
    3⤵
    PID:2665
- - /usr/bin/sudo
    sudo ps auxf
    3⤵
    PID:2664
  - - /usr/bin/ps
      ps auxf
      4⤵
      PID:2668
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:2673
- - /usr/bin/grep
    grep -v grep
    3⤵
    PID:2672
- - /usr/bin/grep
    grep "\\[\\]"
    3⤵
    PID:2671
- - /usr/bin/sudo
    sudo ps auxf
    3⤵
    PID:2670

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/nc

Filesize
8.6MB

MD5
ae747bc7fff9bc23f06635ef60ea0e8d

SHA1
64315e834f67905ed4e47f36155362a78ac23462

SHA256
103b8404dc64c9a44511675981a09fd01395ee837452d114f1350c295357c046

SHA512
e24914a58565a43883c27ae4a41061e8edd3d5eef7b86c1c0e9910d9fbe0eef3e78ed49136ac0c9378311e99901b1847bcfd926aa9a3ea44149a7478480f82b2

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads