883016830413f90bdf1cf7174e7fa70b716245a49884314e28e39c1528d4b144

Analysis

max time kernel
0s
max time network
128s
platform
ubuntu-22.04_amd64
resource
ubuntu2204-amd64-20240729-en
resource tags

arch:amd64arch:i386image:ubuntu2204-amd64-20240729-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system
submitted
28-07-2024 09:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

12265c4e68467b700b0dbfee317318dc_JaffaCakes118
Size

183KB
MD5

12265c4e68467b700b0dbfee317318dc
SHA1

f45358104fbd01d5dff17966f2ce7e84c763d8fc
SHA256

883016830413f90bdf1cf7174e7fa70b716245a49884314e28e39c1528d4b144
SHA512

00ef8bf1c9aa486f6eb1dd74cdb4f9aa29fa16f1e35c201d68b428d71c3208003d0cc7c52d72ec80d3b9238b5505ed89be8254f7ad14c74a129dc84f26718286
SSDEEP

3072:sIDk5JHhyP+pMUlVdR1p1ndZDEgSv8Zu4BQMv4mK6v/BU7b0bBejMvn/qNd7i3xC:NDk5xVrdZDE++QdK6v/BUn0bBeIvn/q9

Score

6^/10

Malware Config

Signatures

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 62 IoCs

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/198/cmdline	pkill
File opened for reading	/proc/1189/status	pkill
File opened for reading	/proc/1331/cmdline	pkill
File opened for reading	/proc/uptime	pkill
File opened for reading	/proc/26/status	pkill
File opened for reading	/proc/788/status	pkill
File opened for reading	/proc/689/status	pkill
File opened for reading	/proc/1189/status	pkill
File opened for reading	/proc/426/cmdline	pkill
File opened for reading	/proc/5/status	pkill
File opened for reading	/proc/164/status	pkill
File opened for reading	/proc/95/cmdline	pkill
File opened for reading	/proc/20/cmdline	pkill
File opened for reading	/proc/1189/cmdline	pkill
File opened for reading	/proc/608/status	pkill
File opened for reading	/proc/993/status	pkill
File opened for reading	/proc/497/cmdline	pkill
File opened for reading	/proc/1506/status	pkill
File opened for reading	/proc/1043/cmdline	pkill
File opened for reading	/proc/88/cmdline	pkill
File opened for reading	/proc/1506/status	pkill
File opened for reading	/proc/926/cmdline	pkill
File opened for reading	/proc/1158/cmdline	pkill
File opened for reading	/proc/804/status	pkill
File opened for reading	/proc/732/cmdline	pkill
File opened for reading	/proc/202/status	pkill
File opened for reading	/proc/774/cmdline	pkill
File opened for reading	/proc/933/cmdline	pkill
File opened for reading	/proc/225/cmdline	pkill
File opened for reading	/proc/198/cmdline	pkill
File opened for reading	/proc/951/status	pkill
File opened for reading	/proc/413/status	pkill
File opened for reading	/proc/1252/status	pkill
File opened for reading	/proc/1484/cmdline	pkill
File opened for reading	/proc/225/cmdline	pkill
File opened for reading	/proc/206/cmdline	pkill
File opened for reading	/proc/1175/cmdline	pkill
File opened for reading	/proc/415/cmdline	pkill
File opened for reading	/proc/741/cmdline	pkill
File opened for reading	/proc/1547/status	pkill
File opened for reading	/proc/82/cmdline	pkill
File opened for reading	/proc/1356/cmdline	pkill
File opened for reading	/proc/633/cmdline	pkill
File opened for reading	/proc/1097/cmdline	pkill
File opened for reading	/proc/749/cmdline	pkill
File opened for reading	/proc/1367/cmdline	pkill
File opened for reading	/proc/194/cmdline	pkill
File opened for reading	/proc/1164/cmdline	pkill
File opened for reading	/proc/1164/status	pkill
File opened for reading	/proc/6/cmdline	pkill
File opened for reading	/proc/993/status	pkill
File opened for reading	/proc/315/cmdline	pkill
File opened for reading	/proc/1154/status	pkill
File opened for reading	/proc/25/status	pkill
File opened for reading	/proc/194/cmdline	pkill
File opened for reading	/proc/411/status	pkill
File opened for reading	/proc/740/status	pkill
File opened for reading	/proc/520/status	pkill
File opened for reading	/proc/85/status	pkill
File opened for reading	/proc/1154/status	pkill
File opened for reading	/proc/1428/status	pkill
File opened for reading	/proc/1232/status	pkill
File opened for reading	/proc/1123/cmdline	pkill
File opened for reading	/proc/452/status	pkill

/tmp/12265c4e68467b700b0dbfee317318dc_JaffaCakes118
/tmp/12265c4e68467b700b0dbfee317318dc_JaffaCakes118
1⤵
PID:1509
- /bin/sh
  sh -c "pkill -9 mips || busybox pkill -9 mips || /usr/busybox pkill -9 mips || /bin/busybox pkill -9 mips > /dev/null"
  2⤵
  PID:1513
- - /usr/bin/pkill
    pkill -9 mips
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1514
- - /usr/busybox
    /usr/busybox pkill -9 mips
    3⤵
    PID:1515
- - /bin/busybox
    /bin/busybox pkill -9 mips
    3⤵
    PID:1516
- /bin/sh
  sh -c "pkill -9 mips64 || busybox pkill -9 mips64 || /usr/busybox pkill -9 mips64 || /bin/busybox pkill -9 mips64 > /dev/null"
  2⤵
  PID:1517
- - /usr/bin/pkill
    pkill -9 mips64
    3⤵
    - Reads CPU attributes
    PID:1518
- - /usr/busybox
    /usr/busybox pkill -9 mips64
    3⤵
    PID:1519
- - /bin/busybox
    /bin/busybox pkill -9 mips64
    3⤵
    PID:1520
- /bin/sh
  sh -c "pkill -9 mipsel || busybox pkill -9 mipsel || /usr/busybox pkill -9 mipsel || /bin/busybox pkill -9 mipsel > /dev/null"
  2⤵
  PID:1521
- - /usr/bin/pkill
    pkill -9 mipsel
    3⤵
    - Reads CPU attributes
    PID:1522
- - /usr/busybox
    /usr/busybox pkill -9 mipsel
    3⤵
    PID:1523
- - /bin/busybox
    /bin/busybox pkill -9 mipsel
    3⤵
    PID:1524
- /bin/sh
  sh -c "pkill -9 sh2eb || busybox pkill -9 sh2eb || /usr/busybox pkill -9 sh2eb || /bin/busybox pkill -9 sh2eb > /dev/null"
  2⤵
  PID:1525
- - /usr/bin/pkill
    pkill -9 sh2eb
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1526
- - /usr/busybox
    /usr/busybox pkill -9 sh2eb
    3⤵
    PID:1527
- - /bin/busybox
    /bin/busybox pkill -9 sh2eb
    3⤵
    PID:1528
- /bin/sh
  sh -c "pkill -9 sh2elf || busybox pkill -9 sh2elf || /usr/busybox pkill -9 sh2elf || /bin/busybox pkill -9 sh2elf > /dev/null"
  2⤵
  PID:1529
- - /usr/bin/pkill
    pkill -9 sh2elf
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1530
- - /usr/busybox
    /usr/busybox pkill -9 sh2elf
    3⤵
    PID:1531
- - /bin/busybox
    /bin/busybox pkill -9 sh2elf
    3⤵
    PID:1532
- /bin/sh
  sh -c "pkill -9 sh4 || busybox pkill -9 sh4 || /usr/busybox pkill -9 sh4 || /bin/busybox pkill -9 sh4 > /dev/null"
  2⤵
  PID:1533
- - /usr/bin/pkill
    pkill -9 sh4
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1534
- - /usr/busybox
    /usr/busybox pkill -9 sh4
    3⤵
    PID:1535
- - /bin/busybox
    /bin/busybox pkill -9 sh4
    3⤵
    PID:1536
- /bin/sh
  sh -c "pkill -9 x86 || busybox pkill -9 x86 || /usr/busybox pkill -9 x86 || /bin/busybox pkill -9 x86 > /dev/null"
  2⤵
  PID:1537
- - /usr/bin/pkill
    pkill -9 x86
    3⤵
    - Reads CPU attributes
    PID:1538
- - /usr/busybox
    /usr/busybox pkill -9 x86
    3⤵
    PID:1539
- - /bin/busybox
    /bin/busybox pkill -9 x86
    3⤵
    PID:1540
- /bin/sh
  sh -c "pkill -9 arm || busybox pkill -9 arm || /usr/busybox pkill -9 arm || /bin/busybox pkill -9 arm > /dev/null"
  2⤵
  PID:1541
- - /usr/bin/pkill
    pkill -9 arm
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1542
- /bin/sh
  sh -c "pkill -9 armv5 || busybox pkill -9 armv5 || /usr/busybox pkill -9 armv5 || /bin/busybox pkill -9 armv5 > /dev/null"
  2⤵
  PID:1550
- - /usr/bin/pkill
    pkill -9 armv5
    3⤵
    - Reads CPU attributes
    PID:1551
- - /usr/busybox
    /usr/busybox pkill -9 armv5
    3⤵
    PID:1552
- - /bin/busybox
    /bin/busybox pkill -9 armv5
    3⤵
    PID:1553
- /bin/sh
  sh -c "pkill -9 armv4tl || busybox pkill -9 armv4tl || /usr/busybox pkill -9 armv4tl || /bin/busybox pkill -9 armv4tl > /dev/null"
  2⤵
  PID:1554
- - /usr/bin/pkill
    pkill -9 armv4tl
    3⤵
    - Reads CPU attributes
    PID:1555
- - /usr/busybox
    /usr/busybox pkill -9 armv4tl
    3⤵
    PID:1556
- - /bin/busybox
    /bin/busybox pkill -9 armv4tl
    3⤵
    PID:1557
- /bin/sh
  sh -c "pkill -9 armv4 || busybox pkill -9 armv4 || /usr/busybox pkill -9 armv4 || /bin/busybox pkill -9 armv4 > /dev/null"
  2⤵
  PID:1558
- - /usr/bin/pkill
    pkill -9 armv4
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1559
- - /usr/busybox
    /usr/busybox pkill -9 armv4
    3⤵
    PID:1560
- - /bin/busybox
    /bin/busybox pkill -9 armv4
    3⤵
    PID:1561
- /bin/sh
  sh -c "pkill -9 armv6 || busybox pkill -9 armv6 || /usr/busybox pkill -9 armv6 || /bin/busybox pkill -9 armv6 > /dev/null"
  2⤵
  PID:1562
- - /usr/bin/pkill
    pkill -9 armv6
    3⤵
    - Reads CPU attributes
    PID:1563
- - /usr/busybox
    /usr/busybox pkill -9 armv6
    3⤵
    PID:1564
- - /bin/busybox
    /bin/busybox pkill -9 armv6
    3⤵
    PID:1565
- /bin/sh
  sh -c "pkill -9 i686 || busybox pkill -9 i686 || /usr/busybox pkill -9 i686 || /bin/busybox pkill -9 i686 > /dev/null"
  2⤵
  PID:1566
- - /usr/bin/pkill
    pkill -9 i686
    3⤵
    - Reads CPU attributes
    PID:1567
- - /usr/busybox
    /usr/busybox pkill -9 i686
    3⤵
    PID:1568
- - /bin/busybox
    /bin/busybox pkill -9 i686
    3⤵
    PID:1569
- /bin/sh
  sh -c "pkill -9 powerpc || busybox pkill -9 powerpc || /usr/busybox pkill -9 powerpc || /bin/busybox pkill -9 powerpc > /dev/null"
  2⤵
  PID:1570
- - /usr/bin/pkill
    pkill -9 powerpc
    3⤵
    - Reads CPU attributes
    PID:1571
- - /usr/busybox
    /usr/busybox pkill -9 powerpc
    3⤵
    PID:1572
- - /bin/busybox
    /bin/busybox pkill -9 powerpc
    3⤵
    PID:1573
- /bin/sh
  sh -c "pkill -9 powerpc440fp || busybox pkill -9 powerpc440fp || /usr/busybox pkill -9 powerpc440fp || /bin/busybox pkill -9 powerpc440fp > /dev/null"
  2⤵
  PID:1574
- - /usr/bin/pkill
    pkill -9 powerpc440fp
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1575
- - /usr/busybox
    /usr/busybox pkill -9 powerpc440fp
    3⤵
    PID:1576
- - /bin/busybox
    /bin/busybox pkill -9 powerpc440fp
    3⤵
    PID:1577
- /bin/sh
  sh -c "pkill -9 i586 || busybox pkill -9 i586 || /usr/busybox pkill -9 i586 || /bin/busybox pkill -9 i586 > /dev/null"
  2⤵
  PID:1578
- - /usr/bin/pkill
    pkill -9 i586
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1579
- - /usr/busybox
    /usr/busybox pkill -9 i586
    3⤵
    PID:1580
- - /bin/busybox
    /bin/busybox pkill -9 i586
    3⤵
    PID:1581
- /bin/sh
  sh -c "pkill -9 m68k || busybox pkill -9 m68k || /usr/busybox pkill -9 m68k || /bin/busybox pkill -9 m68k > /dev/null"
  2⤵
  PID:1582
- - /usr/bin/pkill
    pkill -9 m68k
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1583
- - /usr/busybox
    /usr/busybox pkill -9 m68k
    3⤵
    PID:1584
- - /bin/busybox
    /bin/busybox pkill -9 m68k
    3⤵
    PID:1585
- /bin/sh
  sh -c "pkill -9 sparc || busybox pkill -9 sparc || /usr/busybox pkill -9 sparc || /bin/busybox pkill -9 sparc > /dev/null"
  2⤵
  PID:1586
- - /usr/bin/pkill
    pkill -9 sparc
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1587
- - /usr/busybox
    /usr/busybox pkill -9 sparc
    3⤵
    PID:1588
- - /bin/busybox
    /bin/busybox pkill -9 sparc
    3⤵
    PID:1589
- /bin/sh
  sh -c "pkill -9 x86_64 || busybox pkill -9 x86_64 || /usr/busybox pkill -9 x86_64 || /bin/busybox pkill -9 x86_64 > /dev/null"
  2⤵
  PID:1590
- - /usr/bin/pkill
    pkill -9 x86_64
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1591
- - /usr/busybox
    /usr/busybox pkill -9 x86_64
    3⤵
    PID:1592
- - /bin/busybox
    /bin/busybox pkill -9 x86_64
    3⤵
    PID:1593
- /bin/sh
  sh -c "pkill -9 jackmymips || busybox pkill -9 jackmymips || /usr/busybox pkill -9 jackmymips || /bin/busybox pkill -9 jackmymips > /dev/null"
  2⤵
  PID:1594
- - /usr/bin/pkill
    pkill -9 jackmymips
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1595
- - /usr/busybox
    /usr/busybox pkill -9 jackmymips
    3⤵
    PID:1596
- - /bin/busybox
    /bin/busybox pkill -9 jackmymips
    3⤵
    PID:1597
- /bin/sh
  sh -c "pkill -9 jackmymips64 || busybox pkill -9 jackmymips64 || /usr/busybox pkill -9 jackmymips64 || /bin/busybox pkill -9 jackmymips64 > /dev/null"
  2⤵
  PID:1598
- - /usr/bin/pkill
    pkill -9 jackmymips64
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1599
- - /usr/busybox
    /usr/busybox pkill -9 jackmymips64
    3⤵
    PID:1600
- - /bin/busybox
    /bin/busybox pkill -9 jackmymips64
    3⤵
    PID:1601
- /bin/sh
  sh -c "pkill -9 jackmymipsel || busybox pkill -9 jackmymipsel || /usr/busybox pkill -9 jackmymipsel || /bin/busybox pkill -9 jackmymipsel > /dev/null"
  2⤵
  PID:1602
- - /usr/bin/pkill
    pkill -9 jackmymipsel
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1603
- - /usr/busybox
    /usr/busybox pkill -9 jackmymipsel
    3⤵
    PID:1604
- - /bin/busybox
    /bin/busybox pkill -9 jackmymipsel
    3⤵
    PID:1605
- /bin/sh
  sh -c "pkill -9 jackmysh2eb || busybox pkill -9 jackmysh2eb || /usr/busybox pkill -9 jackmysh2eb || /bin/busybox pkill -9 jackmysh2eb > /dev/null"
  2⤵
  PID:1606
- - /usr/bin/pkill
    pkill -9 jackmysh2eb
    3⤵
    - Reads CPU attributes
    PID:1607
- - /usr/busybox
    /usr/busybox pkill -9 jackmysh2eb
    3⤵
    PID:1608
- - /bin/busybox
    /bin/busybox pkill -9 jackmysh2eb
    3⤵
    PID:1609
- /bin/sh
  sh -c "pkill -9 jackmysh2elf || busybox pkill -9 jackmysh2elf || /usr/busybox pkill -9 jackmysh2elf || /bin/busybox pkill -9 jackmysh2elf > /dev/null"
  2⤵
  PID:1610
- - /usr/bin/pkill
    pkill -9 jackmysh2elf
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1611
- - /usr/busybox
    /usr/busybox pkill -9 jackmysh2elf
    3⤵
    PID:1612
- - /bin/busybox
    /bin/busybox pkill -9 jackmysh2elf
    3⤵
    PID:1613
- /bin/sh
  sh -c "pkill -9 jackmysh4 || busybox pkill -9 jackmysh4 || /usr/busybox pkill -9 jackmysh4 || /bin/busybox pkill -9 jackmysh4 > /dev/null"
  2⤵
  PID:1614
- - /usr/bin/pkill
    pkill -9 jackmysh4
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1615
- - /usr/busybox
    /usr/busybox pkill -9 jackmysh4
    3⤵
    PID:1616
- - /bin/busybox
    /bin/busybox pkill -9 jackmysh4
    3⤵
    PID:1617
- /bin/sh
  sh -c "pkill -9 jackmyx86 || busybox pkill -9 jackmyx86 || /usr/busybox pkill -9 jackmyx86 || /bin/busybox pkill -9 jackmyx86 > /dev/null"
  2⤵
  PID:1618
- - /usr/bin/pkill
    pkill -9 jackmyx86
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1619
- - /usr/busybox
    /usr/busybox pkill -9 jackmyx86
    3⤵
    PID:1620
- - /bin/busybox
    /bin/busybox pkill -9 jackmyx86
    3⤵
    PID:1621
- /bin/sh
  sh -c "pkill -9 jackmyarmv5 || busybox pkill -9 jackmyarmv5 || /usr/busybox pkill -9 jackmyarmv5 || /bin/busybox pkill -9 jackmyarmv5 > /dev/null"
  2⤵
  PID:1622
- - /usr/bin/pkill
    pkill -9 jackmyarmv5
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1623
- - /usr/busybox
    /usr/busybox pkill -9 jackmyarmv5
    3⤵
    PID:1624
- - /bin/busybox
    /bin/busybox pkill -9 jackmyarmv5
    3⤵
    PID:1625
- /bin/sh
  sh -c "pkill -9 jackmyarmv4tl || busybox pkill -9 jackmyarmv4tl || /usr/busybox pkill -9 jackmyarmv4tl || /bin/busybox pkill -9 jackmyarmv4tl > /dev/null"
  2⤵
  PID:1626
- - /usr/bin/pkill
    pkill -9 jackmyarmv4tl
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1627
- - /usr/busybox
    /usr/busybox pkill -9 jackmyarmv4tl
    3⤵
    PID:1628
- - /bin/busybox
    /bin/busybox pkill -9 jackmyarmv4tl
    3⤵
    PID:1629
- /bin/sh
  sh -c "pkill -9 jackmyarmv4 || busybox pkill -9 jackmyarmv4 || /usr/busybox pkill -9 jackmyarmv4 || /bin/busybox pkill -9 jackmyarmv4 > /dev/null"
  2⤵
  PID:1630
- - /usr/bin/pkill
    pkill -9 jackmyarmv4
    3⤵
    - Reads CPU attributes
    PID:1631
- - /usr/busybox
    /usr/busybox pkill -9 jackmyarmv4
    3⤵
    PID:1632
- - /bin/busybox
    /bin/busybox pkill -9 jackmyarmv4
    3⤵
    PID:1633
- /bin/sh
  sh -c "pkill -9 jackmyarmv6 || busybox pkill -9 jackmyarmv6 || /usr/busybox pkill -9 jackmyarmv6 || /bin/busybox pkill -9 jackmyarmv6 > /dev/null"
  2⤵
  PID:1634
- - /usr/bin/pkill
    pkill -9 jackmyarmv6
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1635
- - /usr/busybox
    /usr/busybox pkill -9 jackmyarmv6
    3⤵
    PID:1636
- - /bin/busybox
    /bin/busybox pkill -9 jackmyarmv6
    3⤵
    PID:1637
- /bin/sh
  sh -c "pkill -9 jackmyi686 || busybox pkill -9 jackmyi686 || /usr/busybox pkill -9 jackmyi686 || /bin/busybox pkill -9 jackmyi686 > /dev/null"
  2⤵
  PID:1638
- - /usr/bin/pkill
    pkill -9 jackmyi686
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1639
- - /usr/busybox
    /usr/busybox pkill -9 jackmyi686
    3⤵
    PID:1640
- - /bin/busybox
    /bin/busybox pkill -9 jackmyi686
    3⤵
    PID:1641
- /bin/sh
  sh -c "pkill -9 jackmypowerpc || busybox pkill -9 jackmypowerpc || /usr/busybox pkill -9 jackmypowerpc || /bin/busybox pkill -9 jackmypowerpc > /dev/null"
  2⤵
  PID:1642
- - /usr/bin/pkill
    pkill -9 jackmypowerpc
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1643
- - /usr/busybox
    /usr/busybox pkill -9 jackmypowerpc
    3⤵
    PID:1644
- - /bin/busybox
    /bin/busybox pkill -9 jackmypowerpc
    3⤵
    PID:1645
- /bin/sh
  sh -c "pkill -9 jackmypowerpc440fp || busybox pkill -9 jackmypowerpc440fp || /usr/busybox pkill -9 jackmypowerpc440fp || /bin/busybox pkill -9 jackmypowerpc440fp > /dev/null"
  2⤵
  PID:1646
- - /usr/bin/pkill
    pkill -9 jackmypowerpc440fp
    3⤵
    - Reads CPU attributes
    PID:1647
- - /usr/busybox
    /usr/busybox pkill -9 jackmypowerpc440fp
    3⤵
    PID:1648
- - /bin/busybox
    /bin/busybox pkill -9 jackmypowerpc440fp
    3⤵
    PID:1649
- /bin/sh
  sh -c "pkill -9 jackmyi586 || busybox pkill -9 jackmyi586 || /usr/busybox pkill -9 jackmyi586 || /bin/busybox pkill -9 jackmyi586 > /dev/null"
  2⤵
  PID:1650
- - /usr/bin/pkill
    pkill -9 jackmyi586
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1651
- - /usr/busybox
    /usr/busybox pkill -9 jackmyi586
    3⤵
    PID:1652
- - /bin/busybox
    /bin/busybox pkill -9 jackmyi586
    3⤵
    PID:1653
- /bin/sh
  sh -c "pkill -9 jackmym68k || busybox pkill -9 jackmym68k || /usr/busybox pkill -9 jackmym68k || /bin/busybox pkill -9 jackmym68k > /dev/null"
  2⤵
  PID:1654
- - /usr/bin/pkill
    pkill -9 jackmym68k
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1655
- - /usr/busybox
    /usr/busybox pkill -9 jackmym68k
    3⤵
    PID:1656
- - /bin/busybox
    /bin/busybox pkill -9 jackmym68k
    3⤵
    PID:1657
- /bin/sh
  sh -c "pkill -9 jackmysparc || busybox pkill -9 jackmysparc || /usr/busybox pkill -9 jackmysparc || /bin/busybox pkill -9 jackmysparc > /dev/null"
  2⤵
  PID:1658
- - /usr/bin/pkill
    pkill -9 jackmysparc
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1659
- - /usr/busybox
    /usr/busybox pkill -9 jackmysparc
    3⤵
    PID:1660
- - /bin/busybox
    /bin/busybox pkill -9 jackmysparc
    3⤵
    PID:1661
- /bin/sh
  sh -c "pkill -9 jackmyx86_64 || busybox pkill -9 jackmyx86_64 || /usr/busybox pkill -9 jackmyx86_64 || /bin/busybox pkill -9 jackmyx86_64 > /dev/null"
  2⤵
  PID:1662
- - /usr/bin/pkill
    pkill -9 jackmyx86_64
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1663
- - /usr/busybox
    /usr/busybox pkill -9 jackmyx86_64
    3⤵
    PID:1664
- - /bin/busybox
    /bin/busybox pkill -9 jackmyx86_64
    3⤵
    PID:1665
- /bin/sh
  sh -c "pkill -9 hackmymips || busybox pkill -9 hackmymips || /usr/busybox pkill -9 hackmymips || /bin/busybox pkill -9 hackmymips > /dev/null"
  2⤵
  PID:1666
- - /usr/bin/pkill
    pkill -9 hackmymips
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1667
- - /usr/busybox
    /usr/busybox pkill -9 hackmymips
    3⤵
    PID:1668
- - /bin/busybox
    /bin/busybox pkill -9 hackmymips
    3⤵
    PID:1669
- /bin/sh
  sh -c "pkill -9 hackmymips64 || busybox pkill -9 hackmymips64 || /usr/busybox pkill -9 hackmymips64 || /bin/busybox pkill -9 hackmymips64 > /dev/null"
  2⤵
  PID:1670
- - /usr/bin/pkill
    pkill -9 hackmymips64
    3⤵
    - Reads CPU attributes
    PID:1671
- - /usr/busybox
    /usr/busybox pkill -9 hackmymips64
    3⤵
    PID:1672
- - /bin/busybox
    /bin/busybox pkill -9 hackmymips64
    3⤵
    PID:1673
- /bin/sh
  sh -c "pkill -9 hackmymipsel || busybox pkill -9 hackmymipsel || /usr/busybox pkill -9 hackmymipsel || /bin/busybox pkill -9 hackmymipsel > /dev/null"
  2⤵
  PID:1674
- - /usr/bin/pkill
    pkill -9 hackmymipsel
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1675
- - /usr/busybox
    /usr/busybox pkill -9 hackmymipsel
    3⤵
    PID:1676
- - /bin/busybox
    /bin/busybox pkill -9 hackmymipsel
    3⤵
    PID:1677
- /bin/sh
  sh -c "pkill -9 hackmysh2eb || busybox pkill -9 hackmysh2eb || /usr/busybox pkill -9 hackmysh2eb || /bin/busybox pkill -9 hackmysh2eb > /dev/null"
  2⤵
  PID:1678
- - /usr/bin/pkill
    pkill -9 hackmysh2eb
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1679
- - /usr/busybox
    /usr/busybox pkill -9 hackmysh2eb
    3⤵
    PID:1680
- - /bin/busybox
    /bin/busybox pkill -9 hackmysh2eb
    3⤵
    PID:1681
- /bin/sh
  sh -c "pkill -9 hackmysh2elf || busybox pkill -9 hackmysh2elf || /usr/busybox pkill -9 hackmysh2elf || /bin/busybox pkill -9 hackmysh2elf > /dev/null"
  2⤵
  PID:1682
- - /usr/bin/pkill
    pkill -9 hackmysh2elf
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1683
- - /usr/busybox
    /usr/busybox pkill -9 hackmysh2elf
    3⤵
    PID:1684
- - /bin/busybox
    /bin/busybox pkill -9 hackmysh2elf
    3⤵
    PID:1685
- /bin/sh
  sh -c "pkill -9 hackmysh4 || busybox pkill -9 hackmysh4 || /usr/busybox pkill -9 hackmysh4 || /bin/busybox pkill -9 hackmysh4 > /dev/null"
  2⤵
  PID:1686
- - /usr/bin/pkill
    pkill -9 hackmysh4
    3⤵
    - Reads CPU attributes
    PID:1687
- - /usr/busybox
    /usr/busybox pkill -9 hackmysh4
    3⤵
    PID:1688
- - /bin/busybox
    /bin/busybox pkill -9 hackmysh4
    3⤵
    PID:1689
- /bin/sh
  sh -c "pkill -9 hackmyx86 || busybox pkill -9 hackmyx86 || /usr/busybox pkill -9 hackmyx86 || /bin/busybox pkill -9 hackmyx86 > /dev/null"
  2⤵
  PID:1690
- - /usr/bin/pkill
    pkill -9 hackmyx86
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1691
- - /usr/busybox
    /usr/busybox pkill -9 hackmyx86
    3⤵
    PID:1692
- - /bin/busybox
    /bin/busybox pkill -9 hackmyx86
    3⤵
    PID:1693
- /bin/sh
  sh -c "pkill -9 hackmyarmv5 || busybox pkill -9 hackmyarmv5 || /usr/busybox pkill -9 hackmyarmv5 || /bin/busybox pkill -9 hackmyarmv5 > /dev/null"
  2⤵
  PID:1694
- - /usr/bin/pkill
    pkill -9 hackmyarmv5
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1695
- - /usr/busybox
    /usr/busybox pkill -9 hackmyarmv5
    3⤵
    PID:1696
- - /bin/busybox
    /bin/busybox pkill -9 hackmyarmv5
    3⤵
    PID:1697
- /bin/sh
  sh -c "pkill -9 hackmyarmv4tl || busybox pkill -9 hackmyarmv4tl || /usr/busybox pkill -9 hackmyarmv4tl || /bin/busybox pkill -9 hackmyarmv4tl > /dev/null"
  2⤵
  PID:1698
- - /usr/bin/pkill
    pkill -9 hackmyarmv4tl
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1699
- - /usr/busybox
    /usr/busybox pkill -9 hackmyarmv4tl
    3⤵
    PID:1700
- - /bin/busybox
    /bin/busybox pkill -9 hackmyarmv4tl
    3⤵
    PID:1701
- /bin/sh
  sh -c "pkill -9 hackmyarmv4 || busybox pkill -9 hackmyarmv4 || /usr/busybox pkill -9 hackmyarmv4 || /bin/busybox pkill -9 hackmyarmv4 > /dev/null"
  2⤵
  PID:1702
- - /usr/bin/pkill
    pkill -9 hackmyarmv4
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1703
- - /usr/busybox
    /usr/busybox pkill -9 hackmyarmv4
    3⤵
    PID:1704
- - /bin/busybox
    /bin/busybox pkill -9 hackmyarmv4
    3⤵
    PID:1705
- /bin/sh
  sh -c "pkill -9 hackmyarmv6 || busybox pkill -9 hackmyarmv6 || /usr/busybox pkill -9 hackmyarmv6 || /bin/busybox pkill -9 hackmyarmv6 > /dev/null"
  2⤵
  PID:1706
- - /usr/bin/pkill
    pkill -9 hackmyarmv6
    3⤵
    - Reads CPU attributes
    PID:1707
- - /usr/busybox
    /usr/busybox pkill -9 hackmyarmv6
    3⤵
    PID:1708
- - /bin/busybox
    /bin/busybox pkill -9 hackmyarmv6
    3⤵
    PID:1709
- /bin/sh
  sh -c "pkill -9 hackmyi686 || busybox pkill -9 hackmyi686 || /usr/busybox pkill -9 hackmyi686 || /bin/busybox pkill -9 hackmyi686 > /dev/null"
  2⤵
  PID:1710
- - /usr/bin/pkill
    pkill -9 hackmyi686
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1711
- - /usr/busybox
    /usr/busybox pkill -9 hackmyi686
    3⤵
    PID:1712
- - /bin/busybox
    /bin/busybox pkill -9 hackmyi686
    3⤵
    PID:1713
- /bin/sh
  sh -c "pkill -9 hackmypowerpc || busybox pkill -9 hackmypowerpc || /usr/busybox pkill -9 hackmypowerpc || /bin/busybox pkill -9 hackmypowerpc > /dev/null"
  2⤵
  PID:1714
- - /usr/bin/pkill
    pkill -9 hackmypowerpc
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1715
- - /usr/busybox
    /usr/busybox pkill -9 hackmypowerpc
    3⤵
    PID:1716
- - /bin/busybox
    /bin/busybox pkill -9 hackmypowerpc
    3⤵
    PID:1717
- /bin/sh
  sh -c "pkill -9 hackmypowerpc440fp || busybox pkill -9 hackmypowerpc440fp || /usr/busybox pkill -9 hackmypowerpc440fp || /bin/busybox pkill -9 hackmypowerpc440fp > /dev/null"
  2⤵
  PID:1718
- - /usr/bin/pkill
    pkill -9 hackmypowerpc440fp
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1719
- - /usr/busybox
    /usr/busybox pkill -9 hackmypowerpc440fp
    3⤵
    PID:1720
- - /bin/busybox
    /bin/busybox pkill -9 hackmypowerpc440fp
    3⤵
    PID:1721
- /bin/sh
  sh -c "pkill -9 hackmyi586 || busybox pkill -9 hackmyi586 || /usr/busybox pkill -9 hackmyi586 || /bin/busybox pkill -9 hackmyi586 > /dev/null"
  2⤵
  PID:1722
- - /usr/bin/pkill
    pkill -9 hackmyi586
    3⤵
    - Reads CPU attributes
    PID:1723
- - /usr/busybox
    /usr/busybox pkill -9 hackmyi586
    3⤵
    PID:1724
- - /bin/busybox
    /bin/busybox pkill -9 hackmyi586
    3⤵
    PID:1725
- /bin/sh
  sh -c "pkill -9 hackmym68k || busybox pkill -9 hackmym68k || /usr/busybox pkill -9 hackmym68k || /bin/busybox pkill -9 hackmym68k > /dev/null"
  2⤵
  PID:1726
- - /usr/bin/pkill
    pkill -9 hackmym68k
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1727
- - /usr/busybox
    /usr/busybox pkill -9 hackmym68k
    3⤵
    PID:1728
- - /bin/busybox
    /bin/busybox pkill -9 hackmym68k
    3⤵
    PID:1729
- /bin/sh
  sh -c "pkill -9 hackmysparc || busybox pkill -9 hackmysparc || /usr/busybox pkill -9 hackmysparc || /bin/busybox pkill -9 hackmysparc > /dev/null"
  2⤵
  PID:1730
- - /usr/bin/pkill
    pkill -9 hackmysparc
    3⤵
    - Reads CPU attributes
    PID:1731
- - /usr/busybox
    /usr/busybox pkill -9 hackmysparc
    3⤵
    PID:1732
- - /bin/busybox
    /bin/busybox pkill -9 hackmysparc
    3⤵
    PID:1733
- /bin/sh
  sh -c "pkill -9 hackmyx86_64 || busybox pkill -9 hackmyx86_64 || /usr/busybox pkill -9 hackmyx86_64 || /bin/busybox pkill -9 hackmyx86_64 > /dev/null"
  2⤵
  PID:1734
- - /usr/bin/pkill
    pkill -9 hackmyx86_64
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1735
- - /usr/busybox
    /usr/busybox pkill -9 hackmyx86_64
    3⤵
    PID:1736
- - /bin/busybox
    /bin/busybox pkill -9 hackmyx86_64
    3⤵
    PID:1737
- /bin/sh
  sh -c "pkill -9 b1 || busybox pkill -9 b1 || /usr/busybox pkill -9 b1 || /bin/busybox pkill -9 b1 > /dev/null"
  2⤵
  PID:1738
- - /usr/bin/pkill
    pkill -9 b1
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1739
- - /usr/busybox
    /usr/busybox pkill -9 b1
    3⤵
    PID:1740
- - /bin/busybox
    /bin/busybox pkill -9 b1
    3⤵
    PID:1741
- /bin/sh
  sh -c "pkill -9 b2 || busybox pkill -9 b2 || /usr/busybox pkill -9 b2 || /bin/busybox pkill -9 b2 > /dev/null"
  2⤵
  PID:1742
- - /usr/bin/pkill
    pkill -9 b2
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1743
- - /usr/busybox
    /usr/busybox pkill -9 b2
    3⤵
    PID:1744
- - /bin/busybox
    /bin/busybox pkill -9 b2
    3⤵
    PID:1745
- /bin/sh
  sh -c "pkill -9 b3 || busybox pkill -9 b3 || /usr/busybox pkill -9 b3 || /bin/busybox pkill -9 b3 > /dev/null"
  2⤵
  PID:1746
- - /usr/bin/pkill
    pkill -9 b3
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1747
- - /usr/busybox
    /usr/busybox pkill -9 b3
    3⤵
    PID:1748
- - /bin/busybox
    /bin/busybox pkill -9 b3
    3⤵
    PID:1749
- /bin/sh
  sh -c "pkill -9 b4 || busybox pkill -9 b4 || /usr/busybox pkill -9 b4 || /bin/busybox pkill -9 b4 > /dev/null"
  2⤵
  PID:1750
- - /usr/bin/pkill
    pkill -9 b4
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1751
- - /usr/busybox
    /usr/busybox pkill -9 b4
    3⤵
    PID:1752
- - /bin/busybox
    /bin/busybox pkill -9 b4
    3⤵
    PID:1753
- /bin/sh
  sh -c "pkill -9 b5 || busybox pkill -9 b5 || /usr/busybox pkill -9 b5 || /bin/busybox pkill -9 b5 > /dev/null"
  2⤵
  PID:1754
- - /usr/bin/pkill
    pkill -9 b5
    3⤵
    - Reads CPU attributes
    PID:1755
- - /usr/busybox
    /usr/busybox pkill -9 b5
    3⤵
    PID:1756
- - /bin/busybox
    /bin/busybox pkill -9 b5
    3⤵
    PID:1757
- /bin/sh
  sh -c "pkill -9 b6 || busybox pkill -9 b6 || /usr/busybox pkill -9 b6 || /bin/busybox pkill -9 b6 > /dev/null"
  2⤵
  PID:1758
- - /usr/bin/pkill
    pkill -9 b6
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1759
- - /usr/busybox
    /usr/busybox pkill -9 b6
    3⤵
    PID:1760
- - /bin/busybox
    /bin/busybox pkill -9 b6
    3⤵
    PID:1761
- /bin/sh
  sh -c "pkill -9 b7 || busybox pkill -9 b7 || /usr/busybox pkill -9 b7 || /bin/busybox pkill -9 b7 > /dev/null"
  2⤵
  PID:1762
- - /usr/bin/pkill
    pkill -9 b7
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1763

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads