196b528e7c816ef6dc101e193bb73338e2e6c696137302f991099682e52bc910

Analysis

max time kernel
17s
max time network
3s
platform
debian-9_armhf
resource
debian9-armhf-20240729-en
resource tags

arch:armhfimage:debian9-armhf-20240729-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
23-01-2025 06:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

196b528e7c816ef6dc101e193bb73338e2e6c696137302f991099682e52bc910.sh
Size

37KB
MD5

d6648f420423f9dad4292a606f743c4b
SHA1

dcae47ec15e96274a39fcce4352077846ebf7b70
SHA256

196b528e7c816ef6dc101e193bb73338e2e6c696137302f991099682e52bc910
SHA512

3820b4fb435732fef05157ff0713ed3a62269dc1c21240dbf7e2e59191a0f34050247573b4d9758cd84495fb28d8f346e381b8f09a9041c70ca88333b1303f93
SSDEEP

384:Q7pQQwQHDf6lpTWg3vM4Qdre21jT58vKpG2Y0orcfKLUv0KZnNEVdUeUoJpJydIi:Q7xFNB48Fkc2zq0xvMGdl18r

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

Deletes system logs 1 TTPs 1 IoCs

Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File deleted	/var/log/syslog	rm

Flushes firewall rules 1 TTPs 1 IoCs

Flushes/ disables firewall rules inside the Linux kernel.

defense_evasion

Disable or Modify System Firewall

T1562.004

pid	Process
694	iptables

Attempts to change immutable files 36 IoCs

Modifies inode attributes on the filesystem to allow changing of immutable files.

pid	Process
692	chattr
718	xargs
908	xargs
810	xargs
816	xargs
845	xargs
730	xargs
754	xargs
852	xargs
868	xargs
875	xargs
901	xargs
930	xargs
724	xargs
742	xargs
748	xargs
782	xargs
736	xargs
803	xargs
704	grep
706	grep
776	xargs
838	xargs
882	xargs
891	xargs
916	xargs
924	xargs
830	xargs
693	chattr
713	xargs
762	xargs
768	xargs
789	xargs
796	xargs
824	xargs
861	xargs

Enumerates running processes
Discovers information about currently running processes on the system

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl

Reads CPU attributes 1 TTPs 20 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	sysctl
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps

Process Discovery 1 TTPs 18 IoCs

Adversaries may try to discover information about running processes.

discovery

Process Discovery

T1057

pid	Process
841	ps
848	ps
904	ps
834	ps
826	ps
871	ps
878	ps
897	ps
703	ps
864	ps
926	ps
812	ps
820	ps
857	ps
887	ps
912	ps
920	ps
705	ps

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/586/cmdline	ps
File opened for reading	/proc/24/status	ps
File opened for reading	/proc/844/stat	ps
File opened for reading	/proc/41/cmdline	ps
File opened for reading	/proc/82/cmdline	ps
File opened for reading	/proc/644/stat	ps
File opened for reading	/proc/866/status	ps
File opened for reading	/proc/665/cmdline	ps
File opened for reading	/proc/10/cmdline	ps
File opened for reading	/proc/148/cmdline	ps
File opened for reading	/proc/600/cmdline	ps
File opened for reading	/proc/3/cmdline	ps
File opened for reading	/proc/303/status	ps
File opened for reading	/proc/607/stat	ps
File opened for reading	/proc/602/cmdline	ps
File opened for reading	/proc/3/cmdline	ps
File opened for reading	/proc/41/status	ps
File opened for reading	/proc/9/status	ps
File opened for reading	/proc/645/stat	ps
File opened for reading	/proc/337/cmdline	ps
File opened for reading	/proc/602/stat	ps
File opened for reading	/proc/13/cmdline	ps
File opened for reading	/proc/42/stat	ps
File opened for reading	/proc/815/cmdline	ps
File opened for reading	/proc/665/status	ps
File opened for reading	/proc/filesystems	ps
File opened for reading	/proc/23/cmdline	ps
File opened for reading	/proc/25/stat	ps
File opened for reading	/proc/23/status	ps
File opened for reading	/proc/286/stat	ps
File opened for reading	/proc/10/stat	ps
File opened for reading	/proc/287/cmdline	ps
File opened for reading	/proc/21/cmdline	ps
File opened for reading	/proc/3/status	ps
File opened for reading	/proc/650/cmdline	ps
File opened for reading	/proc/82/status	ps
File opened for reading	/proc/14/stat	ps
File opened for reading	/proc/644/status	ps
File opened for reading	/proc/8/status	ps
File opened for reading	/proc/901/stat	ps
File opened for reading	/proc/24/stat	ps
File opened for reading	/proc/3/cmdline	ps
File opened for reading	/proc/41/status	ps
File opened for reading	/proc/28/stat	ps
File opened for reading	/proc/144/status	ps
File opened for reading	/proc/314/cmdline	ps
File opened for reading	/proc/174/status	ps
File opened for reading	/proc/24/stat	ps
File opened for reading	/proc/20/status	ps
File opened for reading	/proc/887/cmdline	ps
File opened for reading	/proc/286/stat	ps
File opened for reading	/proc/29/status	ps
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/115/status	ps
File opened for reading	/proc/26/stat	ps
File opened for reading	/proc/656/cmdline	ps
File opened for reading	/proc/606/cmdline	ps
File opened for reading	/proc/12/status	ps
File opened for reading	/proc/1/stat	ps
File opened for reading	/proc/4/cmdline	ps
File opened for reading	/proc/9/cmdline	ps
File opened for reading	/proc/14/cmdline	ps
File opened for reading	/proc/self/fd	xargs
File opened for reading	/proc/2/status	ps

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/dev/null	196b528e7c816ef6dc101e193bb73338e2e6c696137302f991099682e52bc910.sh

/tmp/196b528e7c816ef6dc101e193bb73338e2e6c696137302f991099682e52bc910.sh
/tmp/196b528e7c816ef6dc101e193bb73338e2e6c696137302f991099682e52bc910.sh
1⤵
- Writes file to tmp directory
PID:652
- /bin/grep
  grep -i CN
  2⤵
  PID:655
- /bin/sed
  sed "s/,/\\n/g"
  2⤵
  PID:654
- /usr/bin/curl
  curl http://ip-api.com/json/
  2⤵
  - Checks CPU configuration
  PID:653
- /bin/sync
  sync
  2⤵
  PID:679
- /bin/cat
  cat /var/spool/cron/
  2⤵
  PID:681
- /bin/cat
  cat /root/.ssh/authorized_keys
  2⤵
  PID:683
- /bin/mv
  mv /usr/bin/curl /usr/bin/url
  2⤵
  PID:685
- /bin/mv
  mv /usr/bin/url /usr/bin/cd1
  2⤵
  PID:687
- /bin/mv
  mv /usr/bin/wget /usr/bin/get
  2⤵
  PID:688
- /bin/mv
  mv /usr/bin/get /usr/bin/wd1
  2⤵
  PID:689
- /bin/rm
  rm -rf /var/log/syslog
  2⤵
  - Deletes system logs
  PID:691
- /usr/bin/chattr
  chattr -iua /tmp/
  2⤵
  - Attempts to change immutable files
  PID:692
- /usr/bin/chattr
  chattr -iua /var/tmp/
  2⤵
  - Attempts to change immutable files
  PID:693
- /sbin/iptables
  iptables -F
  2⤵
  - Flushes firewall rules
  PID:694
- /usr/sbin/userdel
  userdel akay
  2⤵
  PID:698
- /usr/sbin/userdel
  userdel vfinder
  2⤵
  PID:699
- /bin/rm
  rm -rf "/tmp/addres*"
  2⤵
  PID:700
- /bin/rm
  rm -rf "/tmp/walle*"
  2⤵
  PID:701
- /bin/rm
  rm -rf /tmp/keys
  2⤵
  PID:702
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:703
- /bin/grep
  grep -i "[a]liyun"
  2⤵
  - Attempts to change immutable files
  PID:704
- /bin/grep
  grep -i "[y]unjing"
  2⤵
  - Attempts to change immutable files
  PID:706
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:705
- /bin/rm
  rm -f /tmp/.null
  2⤵
  PID:707
- /sbin/sysctl
  sysctl -w "vm.nr_hugepages=128"
  2⤵
  - Reads CPU attributes
  PID:708
- /bin/grep
  grep 185.71.65.238
  2⤵
  PID:710
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:711
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:712
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:713
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:716
- /bin/grep
  grep 140.82.52.87
  2⤵
  PID:715
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:718
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:717
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:722
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:721
- /bin/grep
  grep -v -
  2⤵
  PID:723
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:724
- /bin/grep
  grep :443
  2⤵
  PID:720
- /bin/grep
  grep -v -
  2⤵
  PID:729
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:727
- /bin/grep
  grep :23
  2⤵
  PID:726
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:730
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:728
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:734
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:733
- /bin/grep
  grep :443
  2⤵
  PID:732
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:736
- /bin/grep
  grep -v -
  2⤵
  PID:735
- /bin/grep
  grep :143
  2⤵
  PID:738
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:740
- /bin/grep
  grep -v -
  2⤵
  PID:741
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:739
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:742
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:746
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  - Reads runtime system information
  PID:745
- /bin/grep
  grep :2222
  2⤵
  PID:744
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:748
- /bin/grep
  grep -v -
  2⤵
  PID:747
- /bin/grep
  grep -v -
  2⤵
  PID:753
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:752
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:751
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:754
- /bin/grep
  grep :3333
  2⤵
  PID:750
- /bin/grep
  grep :3389
  2⤵
  PID:758
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:760
- /bin/grep
  grep -v -
  2⤵
  PID:761
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:762
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:759
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:765
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:766
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:768
- /bin/grep
  grep :5555
  2⤵
  PID:764
- /bin/grep
  grep -v -
  2⤵
  PID:767
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:774
- /bin/grep
  grep -v -
  2⤵
  PID:775
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:776
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:773
- /bin/grep
  grep :6666
  2⤵
  PID:772
- /bin/grep
  grep -v -
  2⤵
  PID:781
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:780
- /bin/grep
  grep :6665
  2⤵
  PID:778
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:782
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:779
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:787
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:786
- /bin/grep
  grep :6667
  2⤵
  PID:785
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:789
- /bin/grep
  grep -v -
  2⤵
  PID:788
- /bin/grep
  grep -v -
  2⤵
  PID:795
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:794
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:796
- /bin/grep
  grep :7777
  2⤵
  PID:792
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:793
- /bin/grep
  grep -v -
  2⤵
  PID:802
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:800
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:803
- /bin/grep
  grep :8444
  2⤵
  PID:799
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:801
- /bin/grep
  grep -v -
  2⤵
  PID:809
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:807
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:810
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:808
- /bin/grep
  grep :3347
  2⤵
  PID:806
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:815
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:816
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:812
- /bin/grep
  grep :3333
  2⤵
  PID:814
- /bin/grep
  grep -v grep
  2⤵
  PID:813
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:824
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:823
- /bin/grep
  grep :5555
  2⤵
  PID:822
- /bin/grep
  grep -v grep
  2⤵
  PID:821
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:820
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:830
- /bin/grep
  grep "kworker -c\\"
  2⤵
  PID:828
- /bin/grep
  grep -v grep
  2⤵
  PID:827
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:826
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:829
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:838
- /bin/grep
  grep log_
  2⤵
  PID:836
- /bin/grep
  grep -v grep
  2⤵
  PID:835
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:834
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:837
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  - Reads runtime system information
  PID:845
- /bin/grep
  grep systemten
  2⤵
  PID:843
- /bin/grep
  grep -v grep
  2⤵
  PID:842
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:841
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:844
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:852
- - /usr/local/sbin/kill
    kill -9 14
    3⤵
    PID:855
- - /usr/local/bin/kill
    kill -9 14
    3⤵
    PID:855
- - /usr/sbin/kill
    kill -9 14
    3⤵
    PID:855
- - /usr/bin/kill
    kill -9 14
    3⤵
    PID:855
- - /sbin/kill
    kill -9 14
    3⤵
    PID:855
- - /bin/kill
    kill -9 14
    3⤵
    - Reads CPU attributes
    PID:855
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:851
- /bin/grep
  grep netns
  2⤵
  PID:850
- /bin/grep
  grep -v grep
  2⤵
  PID:849
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:848
- /bin/grep
  grep -v grep
  2⤵
  PID:858
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:860
- /bin/grep
  grep voltuned
  2⤵
  PID:859
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:857
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:861
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:868
- /bin/grep
  grep darwin
  2⤵
  PID:866
- /bin/grep
  grep -v grep
  2⤵
  PID:865
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:864
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:867
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:875
- /bin/grep
  grep /tmp/dl
  2⤵
  PID:873
- /bin/grep
  grep -v grep
  2⤵
  PID:872
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:874
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:871
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:882
- /bin/grep
  grep /tmp/ddg
  2⤵
  PID:880
- /bin/grep
  grep -v grep
  2⤵
  PID:879
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:878
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:881
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:891
- /bin/grep
  grep /tmp/pprt
  2⤵
  PID:889
- /bin/grep
  grep -v grep
  2⤵
  PID:888
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:887
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:890
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:901
- /bin/grep
  grep /tmp/ppol
  2⤵
  PID:899
- /bin/grep
  grep -v grep
  2⤵
  PID:898
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:900
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:897
- /bin/grep
  grep -v grep
  2⤵
  PID:905
- /bin/grep
  grep "/tmp/65ccE*"
  2⤵
  PID:906
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:907
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:908
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:904
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:916
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:915
- /bin/grep
  grep "/tmp/jmx*"
  2⤵
  PID:914
- /bin/grep
  grep -v grep
  2⤵
  PID:913
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:912
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:923
- /bin/grep
  grep -v grep
  2⤵
  PID:921
- /bin/grep
  grep "/tmp/2Ne80*"
  2⤵
  PID:922
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:924
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:920
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:930
- /bin/grep
  grep IOFoqIgyC0zmf2UR
  2⤵
  PID:928
- /bin/grep
  grep -v grep
  2⤵
  PID:927
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:926
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:929

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

Clear Linux or Mac System Logs

T1070.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/etc/zzhs

Filesize
2B

MD5
b026324c6904b2a9cb4b88d6d61c81d1

SHA1
e5fa44f2b31c1fb553b6021e7360d07d5d91ff5e

SHA256
4355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865

SHA512
3abb6677af34ac57c0ca5828fd94f9d886c26ce59a8ce60ecf6778079423dccff1d6f19cb655805d56098e6d38a1a710dee59523eed7511e5a9e4b8ccb3a4686

Download Submit

pid	Process
841	ps
848	ps
904	ps
834	ps
826	ps
871	ps
878	ps
897	ps
703	ps
864	ps
926	ps
812	ps
820	ps
857	ps
887	ps
912	ps
920	ps
705	ps

pid	Process
841	ps
848	ps
904	ps
834	ps
826	ps
871	ps
878	ps
897	ps
703	ps
864	ps
926	ps
812	ps
820	ps
857	ps
887	ps
912	ps
920	ps
705	ps

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

pid	Process
841	ps
848	ps
904	ps
834	ps
826	ps
871	ps
878	ps
897	ps
703	ps
864	ps
926	ps
812	ps
820	ps
857	ps
887	ps
912	ps
920	ps
705	ps