Overview

overview

10

Static

static

10

The-MALWAR...ot.exe

windows10-2004-x64

10

The-MALWAR...ll.exe

windows10-2004-x64

10

The-MALWAR...BS.exe

windows10-2004-x64

10

The-MALWAR...in.exe

windows10-2004-x64

7

The-MALWAR....A.exe

windows10-2004-x64

7

The-MALWAR....A.exe

windows10-2004-x64

10

The-MALWAR....A.dll

windows10-2004-x64

7

The-MALWAR...r.xlsm

windows10-2004-x64

10

The-MALWAR...36c859

ubuntu-24.04-amd64

8

The-MALWAR...caa742

ubuntu-24.04-amd64

8

The-MALWAR...c1a732

ubuntu-24.04-amd64

8

The-MALWAR...57c046

ubuntu-24.04-amd64

8

The-MALWAR...460a01

ubuntu-24.04-amd64

8

The-MALWAR...ece0c5

ubuntu-24.04-amd64

8

The-MALWAR...257619

ubuntu-18.04-amd64

8

The-MALWAR...fbcc59

ubuntu-24.04-amd64

8

The-MALWAR...54f69c

ubuntu-24.04-amd64

8

The-MALWAR...d539a6

ubuntu-24.04-amd64

8

The-MALWAR...4996dd

ubuntu-24.04-amd64

8

The-MALWAR...8232d5

ubuntu-18.04-amd64

8

The-MALWAR...66b948

ubuntu-22.04-amd64

8

The-MALWAR...f9db86

ubuntu-24.04-amd64

8

The-MALWAR...ea2485

ubuntu-24.04-amd64

8

The-MALWAR...us.exe

windows10-2004-x64

7

The-MALWAR....a.exe

windows10-2004-x64

3

The-MALWAR....a.exe

windows10-2004-x64

7

The-MALWAR...ok.exe

windows10-2004-x64

1

The-MALWAR...y.html

windows10-2004-x64

4

The-MALWAR...ft.exe

windows10-2004-x64

4

The-MALWAR...en.exe

windows10-2004-x64

6

The-MALWAR...ve.apk

android-9-x86

The-MALWAR...ve.apk

android-10-x64

Resubmissions

11/04/2025, 21:31

250411-1cz7lazpx8 10

Analysis

  • max time kernel
    29s
  • max time network
    2s
  • platform
    ubuntu-24.04_amd64
  • resource
    ubuntu2404-amd64-20250410-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2404-amd64-20250410-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system
  • submitted
    11/04/2025, 21:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    The-MALWARE-Repo-master/Botnets/FritzFrog/103b8404dc64c9a44511675981a09fd01395ee837452d114f1350c295357c046

  • Size

    8.6MB

  • MD5

    ae747bc7fff9bc23f06635ef60ea0e8d

  • SHA1

    64315e834f67905ed4e47f36155362a78ac23462

  • SHA256

    103b8404dc64c9a44511675981a09fd01395ee837452d114f1350c295357c046

  • SHA512

    e24914a58565a43883c27ae4a41061e8edd3d5eef7b86c1c0e9910d9fbe0eef3e78ed49136ac0c9378311e99901b1847bcfd926aa9a3ea44149a7478480f82b2

  • SSDEEP

    98304:rDSceJ/GqDu6P0ypQ0Qv5knSTH20ejwBcHjI7Xk:rDSceJ/GqD18RZv5knS720e7s

Score
8/10
antivmcredential_accessdefense_evasiondiscoverypersistenceprivilege_escalation

Malware Config

Signatures

  • Adds new SSH keys 1 TTPs 1 IoCs

    Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.

    persistenceprivilege_escalation
  • Deletes itself 1 IoCs
  • OS Credential Dumping 1 TTPs 64 IoCs

    Adversaries may attempt to dump credentials to use it in password cracking.

    credential_access
  • Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 64 IoCs

    Abuse sudo or cached sudo credentials to execute code.

    privilege_escalationdefense_evasion
  • Deletes log files 1 TTPs 1 IoCs

    Deletes log files on the system.

    defense_evasion
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Virtualization/Sandbox Evasion: Time Based Evasion 1 TTPs 3 IoCs

    Adversaries may detect and evade virtualized environments and sandboxes.

    defense_evasion
  • Checks CPU configuration 1 TTPs 29 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads CPU attributes 1 TTPs 52 IoCs
    discovery
  • Enumerates kernel/hardware configuration 1 TTPs 52 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 12 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 5 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/103b8404dc64c9a44511675981a09fd01395ee837452d114f1350c295357c046
    /tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/103b8404dc64c9a44511675981a09fd01395ee837452d114f1350c295357c046
    1⤵
    • Adds new SSH keys
    • Deletes itself
    • Deletes log files
    • Writes file to tmp directory
    PID:2019
    • /usr/bin/uname
      uname -a
      2⤵
        PID:2034
      • /usr/bin/cat
        cat /proc/cpuinfo
        2⤵
        • Checks CPU configuration
        PID:2035
      • /usr/bin/cat
        cat /etc/issue
        2⤵
          PID:2037
        • /usr/bin/free
          free -m
          2⤵
            PID:2038
          • /usr/bin/uptime
            uptime
            2⤵
            • Virtualization/Sandbox Evasion: Time Based Evasion
            PID:2039
          • /usr/bin/journalctl
            journalctl -S "@0" -u sshd
            2⤵
              PID:2040
            • /usr/bin/cat
              cat "/var/log/auth*"
              2⤵
                PID:2041
              • /usr/bin/zcat
                zcat "/var/log/auth*"
                2⤵
                  PID:2042
                • /usr/local/sbin/gzip
                  gzip -cd "/var/log/auth*"
                  2⤵
                  • System Network Configuration Discovery
                  PID:2042
                • /usr/local/bin/gzip
                  gzip -cd "/var/log/auth*"
                  2⤵
                  • System Network Configuration Discovery
                  PID:2042
                • /usr/sbin/gzip
                  gzip -cd "/var/log/auth*"
                  2⤵
                  • System Network Configuration Discovery
                  PID:2042
                • /usr/bin/gzip
                  gzip -cd "/var/log/auth*"
                  2⤵
                  • System Network Configuration Discovery
                  PID:2042
                • /bin/bash
                  /bin/bash -
                  2⤵
                    PID:2043
                    • /usr/bin/wc
                      wc -l
                      3⤵
                        PID:2046
                      • /usr/bin/which
                        which sudo
                        3⤵
                        • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                        PID:2045
                      • /usr/bin/sudo
                        sudo -S touch .local_3108
                        3⤵
                        • OS Credential Dumping
                        • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                        PID:2048
                        • /usr/bin/touch
                          touch .local_3108
                          4⤵
                          • Writes file to tmp directory
                          PID:2049
                      • /usr/bin/ls
                        ls -l .local_3108
                        3⤵
                          PID:2051
                        • /usr/bin/grep
                          grep -c root
                          3⤵
                            PID:2052
                          • /usr/bin/sudo
                            sudo rm .local_3108
                            3⤵
                            • OS Credential Dumping
                            • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                            PID:2053
                            • /usr/bin/rm
                              rm .local_3108
                              4⤵
                                PID:2054
                            • /usr/bin/grep
                              grep "./crond -t=all"
                              3⤵
                                PID:2057
                              • /usr/bin/sudo
                                sudo ps auxff
                                3⤵
                                • OS Credential Dumping
                                • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                PID:2056
                                • /usr/bin/ps
                                  ps auxff
                                  4⤵
                                  • Checks CPU configuration
                                  • Reads CPU attributes
                                  • Enumerates kernel/hardware configuration
                                  • Reads runtime system information
                                  PID:2060
                              • /usr/bin/grep
                                grep -v grep
                                3⤵
                                  PID:2058
                                • /usr/bin/awk
                                  awk "{ print \$2 }"
                                  3⤵
                                    PID:2059
                                  • /usr/bin/sudo
                                    sudo killall -9 bssh
                                    3⤵
                                      PID:2061
                                      • /usr/bin/killall
                                        killall -9 bssh
                                        4⤵
                                          PID:2062
                                      • /usr/bin/sudo
                                        sudo rm -rf /tmp/.an
                                        3⤵
                                        • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                        PID:2063
                                        • /usr/bin/rm
                                          rm -rf /tmp/.an
                                          4⤵
                                            PID:2064
                                        • /usr/bin/sudo
                                          sudo killall -9 xm64
                                          3⤵
                                          • OS Credential Dumping
                                          • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                          PID:2065
                                          • /usr/bin/killall
                                            killall -9 xm64
                                            4⤵
                                              PID:2066
                                          • /usr/bin/sudo
                                            sudo killall -9 rpc.idmapd
                                            3⤵
                                            • OS Credential Dumping
                                            PID:2067
                                            • /usr/bin/killall
                                              killall -9 rpc.idmapd
                                              4⤵
                                                PID:2068
                                            • /usr/bin/sudo
                                              sudo rm -rf /tmp/.m2
                                              3⤵
                                              • OS Credential Dumping
                                              PID:2069
                                              • /usr/bin/rm
                                                rm -rf /tmp/.m2
                                                4⤵
                                                  PID:2070
                                              • /usr/bin/sudo
                                                sudo killall -9 xorgg
                                                3⤵
                                                  PID:2071
                                                  • /usr/bin/killall
                                                    killall -9 xorgg
                                                    4⤵
                                                      PID:2072
                                                  • /usr/bin/sudo
                                                    sudo rm -rf /tmp/seconfig
                                                    3⤵
                                                    • OS Credential Dumping
                                                    PID:2073
                                                    • /usr/bin/rm
                                                      rm -rf /tmp/seconfig
                                                      4⤵
                                                        PID:2074
                                                    • /usr/bin/sudo
                                                      sudo killall -9 crond64
                                                      3⤵
                                                        PID:2075
                                                        • /usr/bin/killall
                                                          killall -9 crond64
                                                          4⤵
                                                            PID:2076
                                                        • /usr/bin/sudo
                                                          sudo killall -9 tsm
                                                          3⤵
                                                          • OS Credential Dumping
                                                          • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                          PID:2077
                                                          • /usr/bin/killall
                                                            killall -9 tsm
                                                            4⤵
                                                              PID:2078
                                                          • /usr/bin/sudo
                                                            sudo rm -rf /tmp/.ssh
                                                            3⤵
                                                            • OS Credential Dumping
                                                            • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                            PID:2079
                                                            • /usr/bin/rm
                                                              rm -rf /tmp/.ssh
                                                              4⤵
                                                                PID:2080
                                                            • /usr/bin/sudo
                                                              sudo rm -rf /tmp/.java
                                                              3⤵
                                                              • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                              PID:2081
                                                              • /usr/bin/rm
                                                                rm -rf /tmp/.java
                                                                4⤵
                                                                  PID:2082
                                                              • /usr/bin/sudo
                                                                sudo rm -rf /tmp/.iolanda
                                                                3⤵
                                                                  PID:2083
                                                                  • /usr/bin/rm
                                                                    rm -rf /tmp/.iolanda
                                                                    4⤵
                                                                      PID:2084
                                                                  • /usr/bin/sudo
                                                                    sudo pkill test.mod
                                                                    3⤵
                                                                    • OS Credential Dumping
                                                                    • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                    PID:2085
                                                                    • /usr/bin/pkill
                                                                      pkill test.mod
                                                                      4⤵
                                                                      • Reads CPU attributes
                                                                      • Enumerates kernel/hardware configuration
                                                                      PID:2086
                                                                  • /usr/bin/sudo
                                                                    sudo pkill daemon.i686.mod
                                                                    3⤵
                                                                    • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                    PID:2087
                                                                    • /usr/bin/pkill
                                                                      pkill daemon.i686.mod
                                                                      4⤵
                                                                      • Reads CPU attributes
                                                                      • Enumerates kernel/hardware configuration
                                                                      • Reads runtime system information
                                                                      PID:2088
                                                                  • /usr/bin/sudo
                                                                    sudo pkill daemon.armv4l.mod
                                                                    3⤵
                                                                    • OS Credential Dumping
                                                                    PID:2089
                                                                    • /usr/bin/pkill
                                                                      pkill daemon.armv4l.mod
                                                                      4⤵
                                                                      • Reads CPU attributes
                                                                      • Enumerates kernel/hardware configuration
                                                                      PID:2090
                                                                  • /usr/bin/sudo
                                                                    sudo pkill daemon.mips.mod
                                                                    3⤵
                                                                      PID:2091
                                                                      • /usr/bin/pkill
                                                                        pkill daemon.mips.mod
                                                                        4⤵
                                                                        • Reads CPU attributes
                                                                        • Enumerates kernel/hardware configuration
                                                                        • System Network Configuration Discovery
                                                                        PID:2092
                                                                    • /usr/bin/sudo
                                                                      sudo pkill daemon.mipsel.mod
                                                                      3⤵
                                                                        PID:2093
                                                                        • /usr/bin/pkill
                                                                          pkill daemon.mipsel.mod
                                                                          4⤵
                                                                          • Reads CPU attributes
                                                                          • Enumerates kernel/hardware configuration
                                                                          • Reads runtime system information
                                                                          • System Network Configuration Discovery
                                                                          PID:2094
                                                                      • /usr/bin/sudo
                                                                        sudo rm -rf /tmp/.xs
                                                                        3⤵
                                                                        • OS Credential Dumping
                                                                        PID:2095
                                                                        • /usr/bin/rm
                                                                          rm -rf /tmp/.xs
                                                                          4⤵
                                                                            PID:2096
                                                                        • /usr/bin/sudo
                                                                          sudo pkill ld-linux-x86-64
                                                                          3⤵
                                                                          • OS Credential Dumping
                                                                          PID:2097
                                                                          • /usr/bin/pkill
                                                                            pkill ld-linux-x86-64
                                                                            4⤵
                                                                            • Reads CPU attributes
                                                                            • Enumerates kernel/hardware configuration
                                                                            • Reads runtime system information
                                                                            PID:2098
                                                                        • /usr/bin/rm
                                                                          rm -rf "/var/tmp/. *"
                                                                          3⤵
                                                                            PID:2099
                                                                          • /usr/bin/sudo
                                                                            sudo ps auxf
                                                                            3⤵
                                                                            • OS Credential Dumping
                                                                            • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                            PID:2101
                                                                            • /usr/bin/ps
                                                                              ps auxf
                                                                              4⤵
                                                                              • Checks CPU configuration
                                                                              • Reads CPU attributes
                                                                              • Enumerates kernel/hardware configuration
                                                                              • Reads runtime system information
                                                                              PID:2105
                                                                          • /usr/bin/grep
                                                                            grep xmr
                                                                            3⤵
                                                                              PID:2102
                                                                            • /usr/bin/grep
                                                                              grep -v grep
                                                                              3⤵
                                                                                PID:2103
                                                                              • /usr/bin/awk
                                                                                awk "{ print \$2 }"
                                                                                3⤵
                                                                                  PID:2104
                                                                                • /usr/bin/sudo
                                                                                  sudo ps auxf
                                                                                  3⤵
                                                                                  • OS Credential Dumping
                                                                                  • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                  PID:2107
                                                                                  • /usr/bin/ps
                                                                                    ps auxf
                                                                                    4⤵
                                                                                    • Checks CPU configuration
                                                                                    • Reads CPU attributes
                                                                                    • Enumerates kernel/hardware configuration
                                                                                    • Reads runtime system information
                                                                                    PID:2111
                                                                                • /usr/bin/grep
                                                                                  grep cryptonight
                                                                                  3⤵
                                                                                    PID:2108
                                                                                  • /usr/bin/grep
                                                                                    grep -v grep
                                                                                    3⤵
                                                                                      PID:2109
                                                                                    • /usr/bin/awk
                                                                                      awk "{ print \$2 }"
                                                                                      3⤵
                                                                                        PID:2110
                                                                                      • /usr/bin/sudo
                                                                                        sudo ps auxf
                                                                                        3⤵
                                                                                          PID:2113
                                                                                          • /usr/bin/ps
                                                                                            ps auxf
                                                                                            4⤵
                                                                                            • Checks CPU configuration
                                                                                            • Reads CPU attributes
                                                                                            • Enumerates kernel/hardware configuration
                                                                                            • Reads runtime system information
                                                                                            PID:2117
                                                                                        • /usr/bin/grep
                                                                                          grep stratum
                                                                                          3⤵
                                                                                            PID:2114
                                                                                          • /usr/bin/awk
                                                                                            awk "{ print \$2 }"
                                                                                            3⤵
                                                                                              PID:2116
                                                                                            • /usr/bin/grep
                                                                                              grep -v grep
                                                                                              3⤵
                                                                                                PID:2115
                                                                                              • /usr/bin/sudo
                                                                                                sudo ps auxf
                                                                                                3⤵
                                                                                                  PID:2119
                                                                                                  • /usr/bin/ps
                                                                                                    ps auxf
                                                                                                    4⤵
                                                                                                    • Checks CPU configuration
                                                                                                    • Reads CPU attributes
                                                                                                    • Enumerates kernel/hardware configuration
                                                                                                    PID:2123
                                                                                                • /usr/bin/grep
                                                                                                  grep dbus-daemon--system
                                                                                                  3⤵
                                                                                                    PID:2120
                                                                                                  • /usr/bin/grep
                                                                                                    grep -v grep
                                                                                                    3⤵
                                                                                                      PID:2121
                                                                                                    • /usr/bin/awk
                                                                                                      awk "{ print \$2 }"
                                                                                                      3⤵
                                                                                                        PID:2122
                                                                                                      • /usr/bin/sudo
                                                                                                        sudo ps auxf
                                                                                                        3⤵
                                                                                                        • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                                        PID:2125
                                                                                                        • /usr/bin/ps
                                                                                                          ps auxf
                                                                                                          4⤵
                                                                                                          • Checks CPU configuration
                                                                                                          • Reads CPU attributes
                                                                                                          • Enumerates kernel/hardware configuration
                                                                                                          • Reads runtime system information
                                                                                                          PID:2129
                                                                                                      • /usr/bin/grep
                                                                                                        grep "\\[\\]"
                                                                                                        3⤵
                                                                                                          PID:2126
                                                                                                        • /usr/bin/grep
                                                                                                          grep -v grep
                                                                                                          3⤵
                                                                                                            PID:2127
                                                                                                          • /usr/bin/awk
                                                                                                            awk "{ print \$2 }"
                                                                                                            3⤵
                                                                                                              PID:2128
                                                                                                            • /usr/bin/sudo
                                                                                                              sudo ps auxf
                                                                                                              3⤵
                                                                                                                PID:2131
                                                                                                                • /usr/bin/ps
                                                                                                                  ps auxf
                                                                                                                  4⤵
                                                                                                                  • Checks CPU configuration
                                                                                                                  • Reads CPU attributes
                                                                                                                  • Enumerates kernel/hardware configuration
                                                                                                                  • Reads runtime system information
                                                                                                                  PID:2135
                                                                                                              • /usr/bin/grep
                                                                                                                grep xm64
                                                                                                                3⤵
                                                                                                                  PID:2132
                                                                                                                • /usr/bin/awk
                                                                                                                  awk "{ print \$2 }"
                                                                                                                  3⤵
                                                                                                                    PID:2134
                                                                                                                  • /usr/bin/grep
                                                                                                                    grep -v grep
                                                                                                                    3⤵
                                                                                                                      PID:2133
                                                                                                                    • /usr/bin/sudo
                                                                                                                      sudo killall -9 "[atd]"
                                                                                                                      3⤵
                                                                                                                      • OS Credential Dumping
                                                                                                                      • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                                                      PID:2136
                                                                                                                      • /usr/bin/killall
                                                                                                                        killall -9 "[atd]"
                                                                                                                        4⤵
                                                                                                                          PID:2137
                                                                                                                      • /usr/bin/sudo
                                                                                                                        sudo rm -rf /tmp/.jk
                                                                                                                        3⤵
                                                                                                                        • OS Credential Dumping
                                                                                                                        PID:2138
                                                                                                                        • /usr/bin/rm
                                                                                                                          rm -rf /tmp/.jk
                                                                                                                          4⤵
                                                                                                                            PID:2139
                                                                                                                        • /usr/bin/sudo
                                                                                                                          sudo killall -9 "[ntpd]"
                                                                                                                          3⤵
                                                                                                                            PID:2140
                                                                                                                            • /usr/bin/killall
                                                                                                                              killall -9 "[ntpd]"
                                                                                                                              4⤵
                                                                                                                                PID:2141
                                                                                                                            • /usr/bin/sudo
                                                                                                                              sudo killall -9 "[rpciod]"
                                                                                                                              3⤵
                                                                                                                              • OS Credential Dumping
                                                                                                                              PID:2142
                                                                                                                              • /usr/bin/killall
                                                                                                                                killall -9 "[rpciod]"
                                                                                                                                4⤵
                                                                                                                                  PID:2143
                                                                                                                              • /usr/bin/sudo
                                                                                                                                sudo killall -9 "[ext4-dio-unwrit]"
                                                                                                                                3⤵
                                                                                                                                • OS Credential Dumping
                                                                                                                                • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                                                                PID:2144
                                                                                                                                • /usr/bin/killall
                                                                                                                                  killall -9 "[ext4-dio-unwrit]"
                                                                                                                                  4⤵
                                                                                                                                    PID:2145
                                                                                                                                • /usr/bin/sudo
                                                                                                                                  sudo rm -rf "/tmp/.xm*"
                                                                                                                                  3⤵
                                                                                                                                  • OS Credential Dumping
                                                                                                                                  PID:2146
                                                                                                                                  • /usr/bin/rm
                                                                                                                                    rm -rf "/tmp/.xm*"
                                                                                                                                    4⤵
                                                                                                                                      PID:2147
                                                                                                                                  • /usr/bin/pidof
                                                                                                                                    pidof libexec
                                                                                                                                    3⤵
                                                                                                                                      PID:2148
                                                                                                                                  • /usr/bin/free
                                                                                                                                    free -m
                                                                                                                                    2⤵
                                                                                                                                      PID:2149
                                                                                                                                    • /usr/bin/uptime
                                                                                                                                      uptime
                                                                                                                                      2⤵
                                                                                                                                      • Virtualization/Sandbox Evasion: Time Based Evasion
                                                                                                                                      PID:2150
                                                                                                                                    • /bin/bash
                                                                                                                                      /bin/bash -
                                                                                                                                      2⤵
                                                                                                                                        PID:2151
                                                                                                                                        • /usr/bin/which
                                                                                                                                          which sudo
                                                                                                                                          3⤵
                                                                                                                                            PID:2153
                                                                                                                                          • /usr/bin/wc
                                                                                                                                            wc -l
                                                                                                                                            3⤵
                                                                                                                                              PID:2154
                                                                                                                                            • /usr/bin/sudo
                                                                                                                                              sudo -S touch .local_11336
                                                                                                                                              3⤵
                                                                                                                                              • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                                                                              PID:2156
                                                                                                                                              • /usr/bin/touch
                                                                                                                                                touch .local_11336
                                                                                                                                                4⤵
                                                                                                                                                • Writes file to tmp directory
                                                                                                                                                PID:2157
                                                                                                                                            • /usr/bin/ls
                                                                                                                                              ls -l .local_11336
                                                                                                                                              3⤵
                                                                                                                                                PID:2159
                                                                                                                                              • /usr/bin/grep
                                                                                                                                                grep -c root
                                                                                                                                                3⤵
                                                                                                                                                  PID:2160
                                                                                                                                                • /usr/bin/sudo
                                                                                                                                                  sudo rm .local_11336
                                                                                                                                                  3⤵
                                                                                                                                                    PID:2161
                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                      rm .local_11336
                                                                                                                                                      4⤵
                                                                                                                                                        PID:2162
                                                                                                                                                    • /usr/bin/sudo
                                                                                                                                                      sudo ps auxff
                                                                                                                                                      3⤵
                                                                                                                                                        PID:2164
                                                                                                                                                        • /usr/bin/ps
                                                                                                                                                          ps auxff
                                                                                                                                                          4⤵
                                                                                                                                                          • Checks CPU configuration
                                                                                                                                                          • Reads CPU attributes
                                                                                                                                                          • Enumerates kernel/hardware configuration
                                                                                                                                                          • Reads runtime system information
                                                                                                                                                          PID:2168
                                                                                                                                                      • /usr/bin/grep
                                                                                                                                                        grep "./crond -t=all"
                                                                                                                                                        3⤵
                                                                                                                                                          PID:2165
                                                                                                                                                        • /usr/bin/grep
                                                                                                                                                          grep -v grep
                                                                                                                                                          3⤵
                                                                                                                                                            PID:2166
                                                                                                                                                          • /usr/bin/awk
                                                                                                                                                            awk "{ print \$2 }"
                                                                                                                                                            3⤵
                                                                                                                                                              PID:2167
                                                                                                                                                            • /usr/bin/sudo
                                                                                                                                                              sudo killall -9 bssh
                                                                                                                                                              3⤵
                                                                                                                                                              • OS Credential Dumping
                                                                                                                                                              • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                                                                                              PID:2169
                                                                                                                                                              • /usr/bin/killall
                                                                                                                                                                killall -9 bssh
                                                                                                                                                                4⤵
                                                                                                                                                                • Reads runtime system information
                                                                                                                                                                PID:2170
                                                                                                                                                            • /usr/bin/sudo
                                                                                                                                                              sudo rm -rf /tmp/.an
                                                                                                                                                              3⤵
                                                                                                                                                              • OS Credential Dumping
                                                                                                                                                              PID:2171
                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                rm -rf /tmp/.an
                                                                                                                                                                4⤵
                                                                                                                                                                  PID:2172
                                                                                                                                                              • /usr/bin/sudo
                                                                                                                                                                sudo killall -9 xm64
                                                                                                                                                                3⤵
                                                                                                                                                                • OS Credential Dumping
                                                                                                                                                                • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                                                                                                PID:2173
                                                                                                                                                                • /usr/bin/killall
                                                                                                                                                                  killall -9 xm64
                                                                                                                                                                  4⤵
                                                                                                                                                                    PID:2174
                                                                                                                                                                • /usr/bin/sudo
                                                                                                                                                                  sudo killall -9 rpc.idmapd
                                                                                                                                                                  3⤵
                                                                                                                                                                  • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                                                                                                  PID:2175
                                                                                                                                                                  • /usr/bin/killall
                                                                                                                                                                    killall -9 rpc.idmapd
                                                                                                                                                                    4⤵
                                                                                                                                                                    • Reads runtime system information
                                                                                                                                                                    PID:2176
                                                                                                                                                                • /usr/bin/sudo
                                                                                                                                                                  sudo rm -rf /tmp/.m2
                                                                                                                                                                  3⤵
                                                                                                                                                                  • OS Credential Dumping
                                                                                                                                                                  PID:2177
                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                    rm -rf /tmp/.m2
                                                                                                                                                                    4⤵
                                                                                                                                                                      PID:2178
                                                                                                                                                                  • /usr/bin/sudo
                                                                                                                                                                    sudo killall -9 xorgg
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:2179
                                                                                                                                                                      • /usr/bin/killall
                                                                                                                                                                        killall -9 xorgg
                                                                                                                                                                        4⤵
                                                                                                                                                                          PID:2180
                                                                                                                                                                      • /usr/bin/sudo
                                                                                                                                                                        sudo rm -rf /tmp/seconfig
                                                                                                                                                                        3⤵
                                                                                                                                                                        • OS Credential Dumping
                                                                                                                                                                        PID:2181
                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                          rm -rf /tmp/seconfig
                                                                                                                                                                          4⤵
                                                                                                                                                                            PID:2182
                                                                                                                                                                        • /usr/bin/sudo
                                                                                                                                                                          sudo killall -9 crond64
                                                                                                                                                                          3⤵
                                                                                                                                                                          • OS Credential Dumping
                                                                                                                                                                          • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                                                                                                          PID:2183
                                                                                                                                                                          • /usr/bin/killall
                                                                                                                                                                            killall -9 crond64
                                                                                                                                                                            4⤵
                                                                                                                                                                              PID:2184
                                                                                                                                                                          • /usr/bin/sudo
                                                                                                                                                                            sudo killall -9 tsm
                                                                                                                                                                            3⤵
                                                                                                                                                                            • OS Credential Dumping
                                                                                                                                                                            • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                                                                                                            PID:2185
                                                                                                                                                                            • /usr/bin/killall
                                                                                                                                                                              killall -9 tsm
                                                                                                                                                                              4⤵
                                                                                                                                                                                PID:2186
                                                                                                                                                                            • /usr/bin/sudo
                                                                                                                                                                              sudo rm -rf /tmp/.ssh
                                                                                                                                                                              3⤵
                                                                                                                                                                              • OS Credential Dumping
                                                                                                                                                                              • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                                                                                                              PID:2187
                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                rm -rf /tmp/.ssh
                                                                                                                                                                                4⤵
                                                                                                                                                                                  PID:2188
                                                                                                                                                                              • /usr/bin/sudo
                                                                                                                                                                                sudo rm -rf /tmp/.java
                                                                                                                                                                                3⤵
                                                                                                                                                                                • OS Credential Dumping
                                                                                                                                                                                • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                                                                                                                PID:2189
                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                  rm -rf /tmp/.java
                                                                                                                                                                                  4⤵
                                                                                                                                                                                    PID:2190
                                                                                                                                                                                • /usr/bin/sudo
                                                                                                                                                                                  sudo rm -rf /tmp/.iolanda
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:2191
                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                      rm -rf /tmp/.iolanda
                                                                                                                                                                                      4⤵
                                                                                                                                                                                        PID:2192
                                                                                                                                                                                    • /usr/bin/sudo
                                                                                                                                                                                      sudo pkill test.mod
                                                                                                                                                                                      3⤵
                                                                                                                                                                                      • OS Credential Dumping
                                                                                                                                                                                      • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                                                                                                                      PID:2193
                                                                                                                                                                                      • /usr/bin/pkill
                                                                                                                                                                                        pkill test.mod
                                                                                                                                                                                        4⤵
                                                                                                                                                                                        • Reads CPU attributes
                                                                                                                                                                                        • Enumerates kernel/hardware configuration
                                                                                                                                                                                        PID:2194
                                                                                                                                                                                    • /usr/bin/sudo
                                                                                                                                                                                      sudo pkill daemon.i686.mod
                                                                                                                                                                                      3⤵
                                                                                                                                                                                      • OS Credential Dumping
                                                                                                                                                                                      PID:2195
                                                                                                                                                                                      • /usr/bin/pkill
                                                                                                                                                                                        pkill daemon.i686.mod
                                                                                                                                                                                        4⤵
                                                                                                                                                                                        • Reads CPU attributes
                                                                                                                                                                                        • Enumerates kernel/hardware configuration
                                                                                                                                                                                        PID:2196
                                                                                                                                                                                    • /usr/bin/sudo
                                                                                                                                                                                      sudo pkill daemon.armv4l.mod
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:2197
                                                                                                                                                                                        • /usr/bin/pkill
                                                                                                                                                                                          pkill daemon.armv4l.mod
                                                                                                                                                                                          4⤵
                                                                                                                                                                                          • Reads CPU attributes
                                                                                                                                                                                          • Enumerates kernel/hardware configuration
                                                                                                                                                                                          PID:2198
                                                                                                                                                                                      • /usr/bin/sudo
                                                                                                                                                                                        sudo pkill daemon.mips.mod
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:2199
                                                                                                                                                                                          • /usr/bin/pkill
                                                                                                                                                                                            pkill daemon.mips.mod
                                                                                                                                                                                            4⤵
                                                                                                                                                                                            • Reads CPU attributes
                                                                                                                                                                                            • Enumerates kernel/hardware configuration
                                                                                                                                                                                            • System Network Configuration Discovery
                                                                                                                                                                                            PID:2200
                                                                                                                                                                                        • /usr/bin/sudo
                                                                                                                                                                                          sudo pkill daemon.mipsel.mod
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                                                                                                                          PID:2201
                                                                                                                                                                                          • /usr/bin/pkill
                                                                                                                                                                                            pkill daemon.mipsel.mod
                                                                                                                                                                                            4⤵
                                                                                                                                                                                            • Reads CPU attributes
                                                                                                                                                                                            • Enumerates kernel/hardware configuration
                                                                                                                                                                                            • Reads runtime system information
                                                                                                                                                                                            • System Network Configuration Discovery
                                                                                                                                                                                            PID:2202
                                                                                                                                                                                        • /usr/bin/sudo
                                                                                                                                                                                          sudo rm -rf /tmp/.xs
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:2203
                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                              rm -rf /tmp/.xs
                                                                                                                                                                                              4⤵
                                                                                                                                                                                                PID:2204
                                                                                                                                                                                            • /usr/bin/sudo
                                                                                                                                                                                              sudo pkill ld-linux-x86-64
                                                                                                                                                                                              3⤵
                                                                                                                                                                                              • OS Credential Dumping
                                                                                                                                                                                              PID:2205
                                                                                                                                                                                              • /usr/bin/pkill
                                                                                                                                                                                                pkill ld-linux-x86-64
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                • Reads CPU attributes
                                                                                                                                                                                                • Enumerates kernel/hardware configuration
                                                                                                                                                                                                • Reads runtime system information
                                                                                                                                                                                                PID:2206
                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                              rm -rf "/var/tmp/. *"
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:2207
                                                                                                                                                                                              • /usr/bin/sudo
                                                                                                                                                                                                sudo ps auxf
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                                                                                                                                PID:2209
                                                                                                                                                                                                • /usr/bin/ps
                                                                                                                                                                                                  ps auxf
                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                  • Checks CPU configuration
                                                                                                                                                                                                  • Reads CPU attributes
                                                                                                                                                                                                  • Enumerates kernel/hardware configuration
                                                                                                                                                                                                  • Reads runtime system information
                                                                                                                                                                                                  PID:2213
                                                                                                                                                                                              • /usr/bin/grep
                                                                                                                                                                                                grep xmr
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:2210
                                                                                                                                                                                                • /usr/bin/grep
                                                                                                                                                                                                  grep -v grep
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:2211
                                                                                                                                                                                                  • /usr/bin/awk
                                                                                                                                                                                                    awk "{ print \$2 }"
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:2212
                                                                                                                                                                                                    • /usr/bin/sudo
                                                                                                                                                                                                      sudo ps auxf
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:2215
                                                                                                                                                                                                        • /usr/bin/ps
                                                                                                                                                                                                          ps auxf
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                          • Checks CPU configuration
                                                                                                                                                                                                          • Reads CPU attributes
                                                                                                                                                                                                          • Enumerates kernel/hardware configuration
                                                                                                                                                                                                          • Reads runtime system information
                                                                                                                                                                                                          PID:2219
                                                                                                                                                                                                      • /usr/bin/grep
                                                                                                                                                                                                        grep cryptonight
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:2216
                                                                                                                                                                                                        • /usr/bin/grep
                                                                                                                                                                                                          grep -v grep
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:2217
                                                                                                                                                                                                          • /usr/bin/awk
                                                                                                                                                                                                            awk "{ print \$2 }"
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:2218
                                                                                                                                                                                                            • /usr/bin/sudo
                                                                                                                                                                                                              sudo ps auxf
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                              • OS Credential Dumping
                                                                                                                                                                                                              PID:2221
                                                                                                                                                                                                              • /usr/bin/ps
                                                                                                                                                                                                                ps auxf
                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                • Checks CPU configuration
                                                                                                                                                                                                                • Reads CPU attributes
                                                                                                                                                                                                                • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                • Reads runtime system information
                                                                                                                                                                                                                PID:2225
                                                                                                                                                                                                            • /usr/bin/grep
                                                                                                                                                                                                              grep stratum
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:2222
                                                                                                                                                                                                              • /usr/bin/awk
                                                                                                                                                                                                                awk "{ print \$2 }"
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:2224
                                                                                                                                                                                                                • /usr/bin/grep
                                                                                                                                                                                                                  grep -v grep
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:2223
                                                                                                                                                                                                                  • /usr/bin/grep
                                                                                                                                                                                                                    grep dbus-daemon--system
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:2228
                                                                                                                                                                                                                    • /usr/bin/sudo
                                                                                                                                                                                                                      sudo ps auxf
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:2227
                                                                                                                                                                                                                        • /usr/bin/ps
                                                                                                                                                                                                                          ps auxf
                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                          • Checks CPU configuration
                                                                                                                                                                                                                          • Reads CPU attributes
                                                                                                                                                                                                                          • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                          PID:2231
                                                                                                                                                                                                                      • /usr/bin/grep
                                                                                                                                                                                                                        grep -v grep
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:2229
                                                                                                                                                                                                                        • /usr/bin/awk
                                                                                                                                                                                                                          awk "{ print \$2 }"
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:2230
                                                                                                                                                                                                                          • /usr/bin/sudo
                                                                                                                                                                                                                            sudo ps auxf
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                            • OS Credential Dumping
                                                                                                                                                                                                                            • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                                                                                                                                                            PID:2233
                                                                                                                                                                                                                            • /usr/bin/ps
                                                                                                                                                                                                                              ps auxf
                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                              • Checks CPU configuration
                                                                                                                                                                                                                              • Reads CPU attributes
                                                                                                                                                                                                                              • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                              PID:2237
                                                                                                                                                                                                                          • /usr/bin/grep
                                                                                                                                                                                                                            grep "\\[\\]"
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:2234
                                                                                                                                                                                                                            • /usr/bin/grep
                                                                                                                                                                                                                              grep -v grep
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:2235
                                                                                                                                                                                                                              • /usr/bin/awk
                                                                                                                                                                                                                                awk "{ print \$2 }"
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:2236
                                                                                                                                                                                                                                • /usr/bin/sudo
                                                                                                                                                                                                                                  sudo ps auxf
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                  • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                                                                                                                                                                  PID:2239
                                                                                                                                                                                                                                  • /usr/bin/ps
                                                                                                                                                                                                                                    ps auxf
                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                    • Checks CPU configuration
                                                                                                                                                                                                                                    • Reads CPU attributes
                                                                                                                                                                                                                                    • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                    PID:2243
                                                                                                                                                                                                                                • /usr/bin/grep
                                                                                                                                                                                                                                  grep xm64
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:2240
                                                                                                                                                                                                                                  • /usr/bin/grep
                                                                                                                                                                                                                                    grep -v grep
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                      PID:2241
                                                                                                                                                                                                                                    • /usr/bin/awk
                                                                                                                                                                                                                                      awk "{ print \$2 }"
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:2242
                                                                                                                                                                                                                                      • /usr/bin/sudo
                                                                                                                                                                                                                                        sudo killall -9 "[atd]"
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                        • OS Credential Dumping
                                                                                                                                                                                                                                        • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                                                                                                                                                                        PID:2244
                                                                                                                                                                                                                                        • /usr/bin/killall
                                                                                                                                                                                                                                          killall -9 "[atd]"
                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                          • Reads runtime system information
                                                                                                                                                                                                                                          PID:2245
                                                                                                                                                                                                                                      • /usr/bin/sudo
                                                                                                                                                                                                                                        sudo rm -rf /tmp/.jk
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                          PID:2246
                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                            rm -rf /tmp/.jk
                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                              PID:2247
                                                                                                                                                                                                                                          • /usr/bin/sudo
                                                                                                                                                                                                                                            sudo killall -9 "[ntpd]"
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                            • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                                                                                                                                                                            PID:2248
                                                                                                                                                                                                                                            • /usr/bin/killall
                                                                                                                                                                                                                                              killall -9 "[ntpd]"
                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                PID:2249
                                                                                                                                                                                                                                            • /usr/bin/sudo
                                                                                                                                                                                                                                              sudo killall -9 "[rpciod]"
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                              • OS Credential Dumping
                                                                                                                                                                                                                                              • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                                                                                                                                                                              PID:2250
                                                                                                                                                                                                                                              • /usr/bin/killall
                                                                                                                                                                                                                                                killall -9 "[rpciod]"
                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                  PID:2251
                                                                                                                                                                                                                                              • /usr/bin/sudo
                                                                                                                                                                                                                                                sudo killall -9 "[ext4-dio-unwrit]"
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                  PID:2252
                                                                                                                                                                                                                                                  • /usr/bin/killall
                                                                                                                                                                                                                                                    killall -9 "[ext4-dio-unwrit]"
                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                      PID:2253
                                                                                                                                                                                                                                                  • /usr/bin/sudo
                                                                                                                                                                                                                                                    sudo rm -rf "/tmp/.xm*"
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                      PID:2254
                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                        rm -rf "/tmp/.xm*"
                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                          PID:2255
                                                                                                                                                                                                                                                      • /usr/bin/pidof
                                                                                                                                                                                                                                                        pidof libexec
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                                                                                                        PID:2256
                                                                                                                                                                                                                                                    • /bin/bash
                                                                                                                                                                                                                                                      /bin/bash -
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:2257
                                                                                                                                                                                                                                                        • /usr/bin/which
                                                                                                                                                                                                                                                          which sudo
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                            PID:2259
                                                                                                                                                                                                                                                          • /usr/bin/wc
                                                                                                                                                                                                                                                            wc -l
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                              PID:2260
                                                                                                                                                                                                                                                            • /usr/bin/sudo
                                                                                                                                                                                                                                                              sudo -S touch .local_1443
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                              • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                                                                                                                                                                                              PID:2262
                                                                                                                                                                                                                                                              • /usr/bin/touch
                                                                                                                                                                                                                                                                touch .local_1443
                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                • Writes file to tmp directory
                                                                                                                                                                                                                                                                PID:2263
                                                                                                                                                                                                                                                            • /usr/bin/grep
                                                                                                                                                                                                                                                              grep -c root
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                PID:2266
                                                                                                                                                                                                                                                              • /usr/bin/ls
                                                                                                                                                                                                                                                                ls -l .local_1443
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                  PID:2265
                                                                                                                                                                                                                                                                • /usr/bin/sudo
                                                                                                                                                                                                                                                                  sudo rm .local_1443
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                    PID:2267
                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                      rm .local_1443
                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                        PID:2268
                                                                                                                                                                                                                                                                    • /usr/bin/sudo
                                                                                                                                                                                                                                                                      sudo ps auxff
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                      • OS Credential Dumping
                                                                                                                                                                                                                                                                      • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                                                                                                                                                                                                      PID:2270
                                                                                                                                                                                                                                                                      • /usr/bin/ps
                                                                                                                                                                                                                                                                        ps auxff
                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                        • Checks CPU configuration
                                                                                                                                                                                                                                                                        • Reads CPU attributes
                                                                                                                                                                                                                                                                        • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                                                                                                                        PID:2274
                                                                                                                                                                                                                                                                    • /usr/bin/grep
                                                                                                                                                                                                                                                                      grep "./crond -t=all"
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                        PID:2271
                                                                                                                                                                                                                                                                      • /usr/bin/grep
                                                                                                                                                                                                                                                                        grep -v grep
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                          PID:2272
                                                                                                                                                                                                                                                                        • /usr/bin/awk
                                                                                                                                                                                                                                                                          awk "{ print \$2 }"
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                            PID:2273
                                                                                                                                                                                                                                                                          • /usr/bin/sudo
                                                                                                                                                                                                                                                                            sudo killall -9 bssh
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                            • OS Credential Dumping
                                                                                                                                                                                                                                                                            PID:2275
                                                                                                                                                                                                                                                                            • /usr/bin/killall
                                                                                                                                                                                                                                                                              killall -9 bssh
                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                PID:2276
                                                                                                                                                                                                                                                                            • /usr/bin/sudo
                                                                                                                                                                                                                                                                              sudo rm -rf /tmp/.an
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                              • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                                                                                                                                                                                                              PID:2277
                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                rm -rf /tmp/.an
                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                  PID:2278
                                                                                                                                                                                                                                                                              • /usr/bin/sudo
                                                                                                                                                                                                                                                                                sudo killall -9 xm64
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                • OS Credential Dumping
                                                                                                                                                                                                                                                                                PID:2279
                                                                                                                                                                                                                                                                                • /usr/bin/killall
                                                                                                                                                                                                                                                                                  killall -9 xm64
                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                    PID:2280
                                                                                                                                                                                                                                                                                • /usr/bin/sudo
                                                                                                                                                                                                                                                                                  sudo killall -9 rpc.idmapd
                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                  • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                                                                                                                                                                                                                  PID:2281
                                                                                                                                                                                                                                                                                  • /usr/bin/killall
                                                                                                                                                                                                                                                                                    killall -9 rpc.idmapd
                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                    • Reads runtime system information
                                                                                                                                                                                                                                                                                    PID:2282
                                                                                                                                                                                                                                                                                • /usr/bin/sudo
                                                                                                                                                                                                                                                                                  sudo rm -rf /tmp/.m2
                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                    PID:2283
                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                      rm -rf /tmp/.m2
                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                        PID:2284
                                                                                                                                                                                                                                                                                    • /usr/bin/sudo
                                                                                                                                                                                                                                                                                      sudo killall -9 xorgg
                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                        PID:2285
                                                                                                                                                                                                                                                                                        • /usr/bin/killall
                                                                                                                                                                                                                                                                                          killall -9 xorgg
                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                            PID:2286
                                                                                                                                                                                                                                                                                        • /usr/bin/sudo
                                                                                                                                                                                                                                                                                          sudo rm -rf /tmp/seconfig
                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                          • OS Credential Dumping
                                                                                                                                                                                                                                                                                          PID:2287
                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                            rm -rf /tmp/seconfig
                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                              PID:2288
                                                                                                                                                                                                                                                                                          • /usr/bin/sudo
                                                                                                                                                                                                                                                                                            sudo killall -9 crond64
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                            • OS Credential Dumping
                                                                                                                                                                                                                                                                                            • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                                                                                                                                                                                                                            PID:2289
                                                                                                                                                                                                                                                                                            • /usr/bin/killall
                                                                                                                                                                                                                                                                                              killall -9 crond64
                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                PID:2290
                                                                                                                                                                                                                                                                                            • /usr/bin/sudo
                                                                                                                                                                                                                                                                                              sudo killall -9 tsm
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                              • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                                                                                                                                                                                                                              PID:2291
                                                                                                                                                                                                                                                                                              • /usr/bin/killall
                                                                                                                                                                                                                                                                                                killall -9 tsm
                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                  PID:2292
                                                                                                                                                                                                                                                                                              • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                sudo rm -rf /tmp/.ssh
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                  PID:2293
                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                    rm -rf /tmp/.ssh
                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                      PID:2294
                                                                                                                                                                                                                                                                                                  • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                    sudo rm -rf /tmp/.java
                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                    • OS Credential Dumping
                                                                                                                                                                                                                                                                                                    PID:2295
                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                      rm -rf /tmp/.java
                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                        PID:2296
                                                                                                                                                                                                                                                                                                    • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                      sudo rm -rf /tmp/.iolanda
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                      • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                                                                                                                                                                                                                                      PID:2297
                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                        rm -rf /tmp/.iolanda
                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                          PID:2298
                                                                                                                                                                                                                                                                                                      • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                        sudo pkill test.mod
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                          PID:2299
                                                                                                                                                                                                                                                                                                          • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                            pkill test.mod
                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                            • Reads CPU attributes
                                                                                                                                                                                                                                                                                                            • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                            • Reads runtime system information
                                                                                                                                                                                                                                                                                                            PID:2300
                                                                                                                                                                                                                                                                                                        • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                          sudo pkill daemon.i686.mod
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                          • OS Credential Dumping
                                                                                                                                                                                                                                                                                                          PID:2301
                                                                                                                                                                                                                                                                                                          • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                            pkill daemon.i686.mod
                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                            • Reads CPU attributes
                                                                                                                                                                                                                                                                                                            • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                            • Reads runtime system information
                                                                                                                                                                                                                                                                                                            PID:2302
                                                                                                                                                                                                                                                                                                        • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                          sudo pkill daemon.armv4l.mod
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                          • OS Credential Dumping
                                                                                                                                                                                                                                                                                                          PID:2303
                                                                                                                                                                                                                                                                                                          • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                            pkill daemon.armv4l.mod
                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                            • Reads CPU attributes
                                                                                                                                                                                                                                                                                                            • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                            • Reads runtime system information
                                                                                                                                                                                                                                                                                                            PID:2304
                                                                                                                                                                                                                                                                                                        • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                          sudo pkill daemon.mips.mod
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                          • OS Credential Dumping
                                                                                                                                                                                                                                                                                                          • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                                                                                                                                                                                                                                          PID:2305
                                                                                                                                                                                                                                                                                                          • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                            pkill daemon.mips.mod
                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                            • Reads CPU attributes
                                                                                                                                                                                                                                                                                                            • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                            • Reads runtime system information
                                                                                                                                                                                                                                                                                                            • System Network Configuration Discovery
                                                                                                                                                                                                                                                                                                            PID:2306
                                                                                                                                                                                                                                                                                                        • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                          sudo pkill daemon.mipsel.mod
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                          • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                                                                                                                                                                                                                                          PID:2307
                                                                                                                                                                                                                                                                                                          • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                            pkill daemon.mipsel.mod
                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                            • Reads CPU attributes
                                                                                                                                                                                                                                                                                                            • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                            • Reads runtime system information
                                                                                                                                                                                                                                                                                                            • System Network Configuration Discovery
                                                                                                                                                                                                                                                                                                            PID:2308
                                                                                                                                                                                                                                                                                                        • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                          sudo rm -rf /tmp/.xs
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                          • OS Credential Dumping
                                                                                                                                                                                                                                                                                                          • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                                                                                                                                                                                                                                          PID:2309
                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                            rm -rf /tmp/.xs
                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                              PID:2310
                                                                                                                                                                                                                                                                                                          • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                            sudo pkill ld-linux-x86-64
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                            • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                                                                                                                                                                                                                                            PID:2311
                                                                                                                                                                                                                                                                                                            • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                              pkill ld-linux-x86-64
                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                              • Reads CPU attributes
                                                                                                                                                                                                                                                                                                              • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                              • Reads runtime system information
                                                                                                                                                                                                                                                                                                              PID:2312
                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                            rm -rf "/var/tmp/. *"
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                              PID:2313
                                                                                                                                                                                                                                                                                                            • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                              sudo ps auxf
                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                              • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                                                                                                                                                                                                                                              PID:2315
                                                                                                                                                                                                                                                                                                              • /usr/bin/ps
                                                                                                                                                                                                                                                                                                                ps auxf
                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                • Checks CPU configuration
                                                                                                                                                                                                                                                                                                                • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                                • Reads runtime system information
                                                                                                                                                                                                                                                                                                                PID:2319
                                                                                                                                                                                                                                                                                                            • /usr/bin/grep
                                                                                                                                                                                                                                                                                                              grep xmr
                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                PID:2316
                                                                                                                                                                                                                                                                                                              • /usr/bin/grep
                                                                                                                                                                                                                                                                                                                grep -v grep
                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                  PID:2317
                                                                                                                                                                                                                                                                                                                • /usr/bin/awk
                                                                                                                                                                                                                                                                                                                  awk "{ print \$2 }"
                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                    PID:2318
                                                                                                                                                                                                                                                                                                                  • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                    sudo ps auxf
                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                    • OS Credential Dumping
                                                                                                                                                                                                                                                                                                                    PID:2321
                                                                                                                                                                                                                                                                                                                    • /usr/bin/ps
                                                                                                                                                                                                                                                                                                                      ps auxf
                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                      • Checks CPU configuration
                                                                                                                                                                                                                                                                                                                      • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                      • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                                      • Reads runtime system information
                                                                                                                                                                                                                                                                                                                      PID:2325
                                                                                                                                                                                                                                                                                                                  • /usr/bin/grep
                                                                                                                                                                                                                                                                                                                    grep cryptonight
                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                      PID:2322
                                                                                                                                                                                                                                                                                                                    • /usr/bin/awk
                                                                                                                                                                                                                                                                                                                      awk "{ print \$2 }"
                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                        PID:2324
                                                                                                                                                                                                                                                                                                                      • /usr/bin/grep
                                                                                                                                                                                                                                                                                                                        grep -v grep
                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                          PID:2323
                                                                                                                                                                                                                                                                                                                        • /usr/bin/grep
                                                                                                                                                                                                                                                                                                                          grep stratum
                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                            PID:2328
                                                                                                                                                                                                                                                                                                                          • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                            sudo ps auxf
                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                            • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                                                                                                                                                                                                                                                            PID:2327
                                                                                                                                                                                                                                                                                                                            • /usr/bin/ps
                                                                                                                                                                                                                                                                                                                              ps auxf
                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                              • Checks CPU configuration
                                                                                                                                                                                                                                                                                                                              • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                              • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                                              • Reads runtime system information
                                                                                                                                                                                                                                                                                                                              PID:2331
                                                                                                                                                                                                                                                                                                                          • /usr/bin/grep
                                                                                                                                                                                                                                                                                                                            grep -v grep
                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                              PID:2329
                                                                                                                                                                                                                                                                                                                            • /usr/bin/awk
                                                                                                                                                                                                                                                                                                                              awk "{ print \$2 }"
                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                PID:2330
                                                                                                                                                                                                                                                                                                                              • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                                sudo ps auxf
                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                  PID:2333
                                                                                                                                                                                                                                                                                                                                  • /usr/bin/ps
                                                                                                                                                                                                                                                                                                                                    ps auxf
                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                    • Checks CPU configuration
                                                                                                                                                                                                                                                                                                                                    • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                                    • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                                                    PID:2337
                                                                                                                                                                                                                                                                                                                                • /usr/bin/grep
                                                                                                                                                                                                                                                                                                                                  grep dbus-daemon--system
                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                    PID:2334
                                                                                                                                                                                                                                                                                                                                  • /usr/bin/grep
                                                                                                                                                                                                                                                                                                                                    grep -v grep
                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                      PID:2335
                                                                                                                                                                                                                                                                                                                                    • /usr/bin/awk
                                                                                                                                                                                                                                                                                                                                      awk "{ print \$2 }"
                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                        PID:2336
                                                                                                                                                                                                                                                                                                                                      • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                                        sudo ps auxf
                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                        • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                                                                                                                                                                                                                                                                        PID:2339
                                                                                                                                                                                                                                                                                                                                        • /usr/bin/ps
                                                                                                                                                                                                                                                                                                                                          ps auxf
                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                          • Checks CPU configuration
                                                                                                                                                                                                                                                                                                                                          • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                                          • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                                                          • Reads runtime system information
                                                                                                                                                                                                                                                                                                                                          PID:2343
                                                                                                                                                                                                                                                                                                                                      • /usr/bin/grep
                                                                                                                                                                                                                                                                                                                                        grep "\\[\\]"
                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                          PID:2340
                                                                                                                                                                                                                                                                                                                                        • /usr/bin/grep
                                                                                                                                                                                                                                                                                                                                          grep -v grep
                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                            PID:2341
                                                                                                                                                                                                                                                                                                                                          • /usr/bin/awk
                                                                                                                                                                                                                                                                                                                                            awk "{ print \$2 }"
                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                              PID:2342
                                                                                                                                                                                                                                                                                                                                            • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                                              sudo ps auxf
                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                PID:2345
                                                                                                                                                                                                                                                                                                                                                • /usr/bin/ps
                                                                                                                                                                                                                                                                                                                                                  ps auxf
                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                  • Checks CPU configuration
                                                                                                                                                                                                                                                                                                                                                  • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                                                  • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                                                                  • Reads runtime system information
                                                                                                                                                                                                                                                                                                                                                  PID:2351
                                                                                                                                                                                                                                                                                                                                              • /usr/bin/grep
                                                                                                                                                                                                                                                                                                                                                grep xm64
                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                  PID:2346
                                                                                                                                                                                                                                                                                                                                                • /usr/bin/grep
                                                                                                                                                                                                                                                                                                                                                  grep -v grep
                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                    PID:2347
                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/awk
                                                                                                                                                                                                                                                                                                                                                    awk "{ print \$2 }"
                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                      PID:2348
                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                                                      sudo killall -9 "[atd]"
                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                      • OS Credential Dumping
                                                                                                                                                                                                                                                                                                                                                      PID:2352
                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/killall
                                                                                                                                                                                                                                                                                                                                                        killall -9 "[atd]"
                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                          PID:2353
                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                                                        sudo rm -rf /tmp/.jk
                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                        • OS Credential Dumping
                                                                                                                                                                                                                                                                                                                                                        • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                                                                                                                                                                                                                                                                                        PID:2354
                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                          rm -rf /tmp/.jk
                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                            PID:2355
                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                                                          sudo killall -9 "[ntpd]"
                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                          • OS Credential Dumping
                                                                                                                                                                                                                                                                                                                                                          PID:2356
                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/killall
                                                                                                                                                                                                                                                                                                                                                            killall -9 "[ntpd]"
                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                              PID:2357
                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                                                            sudo killall -9 "[rpciod]"
                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                            • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                                                                                                                                                                                                                                                                                            PID:2358
                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/killall
                                                                                                                                                                                                                                                                                                                                                              killall -9 "[rpciod]"
                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                PID:2359
                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                                                              sudo killall -9 "[ext4-dio-unwrit]"
                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                              • OS Credential Dumping
                                                                                                                                                                                                                                                                                                                                                              • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                                                                                                                                                                                                                                                                                              PID:2360
                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/killall
                                                                                                                                                                                                                                                                                                                                                                killall -9 "[ext4-dio-unwrit]"
                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:2361
                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                                                                sudo rm -rf "/tmp/.xm*"
                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                • OS Credential Dumping
                                                                                                                                                                                                                                                                                                                                                                PID:2362
                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                  rm -rf "/tmp/.xm*"
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:2363
                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/pidof
                                                                                                                                                                                                                                                                                                                                                                  pidof libexec
                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:2364
                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/free
                                                                                                                                                                                                                                                                                                                                                                  free -m
                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:2349
                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/uptime
                                                                                                                                                                                                                                                                                                                                                                    uptime
                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                    • Virtualization/Sandbox Evasion: Time Based Evasion
                                                                                                                                                                                                                                                                                                                                                                    PID:2350
                                                                                                                                                                                                                                                                                                                                                                  • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                    /bin/bash -
                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:2365
                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/which
                                                                                                                                                                                                                                                                                                                                                                        which sudo
                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:2367
                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/wc
                                                                                                                                                                                                                                                                                                                                                                          wc -l
                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:2368
                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                                                                            sudo -S touch .local_16893
                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:2370
                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/touch
                                                                                                                                                                                                                                                                                                                                                                                touch .local_16893
                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                • Writes file to tmp directory
                                                                                                                                                                                                                                                                                                                                                                                PID:2371
                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/grep
                                                                                                                                                                                                                                                                                                                                                                              grep -c root
                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:2374
                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/ls
                                                                                                                                                                                                                                                                                                                                                                                ls -l .local_16893
                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:2373
                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                                                                                  sudo rm .local_16893
                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                                                                                                                                                                                                                                                                                                                  PID:2375
                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                    rm .local_16893
                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:2376
                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                                                                                    sudo ps auxff
                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:2378
                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/ps
                                                                                                                                                                                                                                                                                                                                                                                        ps auxff
                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Checks CPU configuration
                                                                                                                                                                                                                                                                                                                                                                                        • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                                                                                        • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                                                                                                        PID:2382
                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/grep
                                                                                                                                                                                                                                                                                                                                                                                      grep -v grep
                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:2380
                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/grep
                                                                                                                                                                                                                                                                                                                                                                                        grep "./crond -t=all"
                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:2379
                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/awk
                                                                                                                                                                                                                                                                                                                                                                                          awk "{ print \$2 }"
                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:2381
                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                                                                                            sudo killall -9 bssh
                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:2383
                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/killall
                                                                                                                                                                                                                                                                                                                                                                                                killall -9 bssh
                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Reads runtime system information
                                                                                                                                                                                                                                                                                                                                                                                                PID:2384
                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                                                                                              sudo rm -rf /tmp/.an
                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                              • OS Credential Dumping
                                                                                                                                                                                                                                                                                                                                                                                              PID:2385
                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                rm -rf /tmp/.an
                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:2386
                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                                                                                                sudo killall -9 xm64
                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                                                                                                                                                                                                                                                                                                                                PID:2387
                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/killall
                                                                                                                                                                                                                                                                                                                                                                                                  killall -9 xm64
                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:2388
                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                                                                                                  sudo killall -9 rpc.idmapd
                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • OS Credential Dumping
                                                                                                                                                                                                                                                                                                                                                                                                  • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                                                                                                                                                                                                                                                                                                                                  PID:2389
                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/killall
                                                                                                                                                                                                                                                                                                                                                                                                    killall -9 rpc.idmapd
                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:2390
                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                                                                                                    sudo rm -rf /tmp/.m2
                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                                                                                                                                                                                                                                                                                                                                    PID:2391
                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                      rm -rf /tmp/.m2
                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:2392
                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                                                                                                      sudo killall -9 xorgg
                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • OS Credential Dumping
                                                                                                                                                                                                                                                                                                                                                                                                      • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                                                                                                                                                                                                                                                                                                                                      PID:2393
                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/killall
                                                                                                                                                                                                                                                                                                                                                                                                        killall -9 xorgg
                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2394
                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                                                                                                        sudo rm -rf /tmp/seconfig
                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • OS Credential Dumping
                                                                                                                                                                                                                                                                                                                                                                                                        PID:2395
                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                          rm -rf /tmp/seconfig
                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:2396
                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                                                                                                          sudo killall -9 crond64
                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:2397
                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/killall
                                                                                                                                                                                                                                                                                                                                                                                                              killall -9 crond64
                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2398
                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                                                                                                              sudo killall -9 tsm
                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2399
                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/killall
                                                                                                                                                                                                                                                                                                                                                                                                                  killall -9 tsm
                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Reads runtime system information
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2400
                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                                                                                                                sudo rm -rf /tmp/.ssh
                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2401
                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                    rm -rf /tmp/.ssh
                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2402
                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                                                                                                                    sudo rm -rf /tmp/.java
                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2403
                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                        rm -rf /tmp/.java
                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2404
                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                                                                                                                        sudo rm -rf /tmp/.iolanda
                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • OS Credential Dumping
                                                                                                                                                                                                                                                                                                                                                                                                                        • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2405
                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                          rm -rf /tmp/.iolanda
                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2406
                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                                                                                                                          sudo pkill test.mod
                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2407
                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                                                                                                                            pkill test.mod
                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                                                                                                                            • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                                                                                                                                            • Reads runtime system information
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2408
                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                                                                                                                          sudo pkill daemon.i686.mod
                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • OS Credential Dumping
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2409
                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                                                                                                                            pkill daemon.i686.mod
                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                                                                                                                            • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                                                                                                                                            • Reads runtime system information
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2410
                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                                                                                                                          sudo pkill daemon.armv4l.mod
                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • OS Credential Dumping
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2411
                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                                                                                                                            pkill daemon.armv4l.mod
                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                                                                                                                            • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2412
                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                                                                                                                          sudo pkill daemon.mips.mod
                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • OS Credential Dumping
                                                                                                                                                                                                                                                                                                                                                                                                                          • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2413
                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                                                                                                                            pkill daemon.mips.mod
                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                                                                                                                            • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                                                                                                                                            • Reads runtime system information
                                                                                                                                                                                                                                                                                                                                                                                                                            • System Network Configuration Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2414
                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                                                                                                                          sudo pkill daemon.mipsel.mod
                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2415
                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                                                                                                                              pkill daemon.mipsel.mod
                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                                                                                                                              • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                                                                                                                                              • Reads runtime system information
                                                                                                                                                                                                                                                                                                                                                                                                                              • System Network Configuration Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2416
                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                                                                                                                            sudo rm -rf /tmp/.xs
                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2417
                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                rm -rf /tmp/.xs
                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2418
                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                                                                                                                                sudo pkill ld-linux-x86-64
                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2419
                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                                                                                                                                    pkill ld-linux-x86-64
                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Reads runtime system information
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2420
                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                  rm -rf "/var/tmp/. *"
                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2421
                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                                                                                                                                    sudo ps auxf
                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • OS Credential Dumping
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2423
                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/ps
                                                                                                                                                                                                                                                                                                                                                                                                                                      ps auxf
                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Checks CPU configuration
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2427
                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/grep
                                                                                                                                                                                                                                                                                                                                                                                                                                    grep -v grep
                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2425
                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/grep
                                                                                                                                                                                                                                                                                                                                                                                                                                      grep xmr
                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2424
                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/awk
                                                                                                                                                                                                                                                                                                                                                                                                                                        awk "{ print \$2 }"
                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2426
                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                                                                                                                                          sudo ps auxf
                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • OS Credential Dumping
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2429
                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/ps
                                                                                                                                                                                                                                                                                                                                                                                                                                            ps auxf
                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Checks CPU configuration
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Reads runtime system information
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2433
                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/grep
                                                                                                                                                                                                                                                                                                                                                                                                                                          grep cryptonight
                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2430
                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/grep
                                                                                                                                                                                                                                                                                                                                                                                                                                            grep -v grep
                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2431
                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/awk
                                                                                                                                                                                                                                                                                                                                                                                                                                              awk "{ print \$2 }"
                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2432
                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                                                                                                                                                sudo ps auxf
                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2435
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/ps
                                                                                                                                                                                                                                                                                                                                                                                                                                                    ps auxf
                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Checks CPU configuration
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Reads runtime system information
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2439
                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/grep
                                                                                                                                                                                                                                                                                                                                                                                                                                                  grep stratum
                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2436
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/grep
                                                                                                                                                                                                                                                                                                                                                                                                                                                    grep -v grep
                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2437
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/awk
                                                                                                                                                                                                                                                                                                                                                                                                                                                      awk "{ print \$2 }"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2438
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                                                                                                                                                        sudo ps auxf
                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2441
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/ps
                                                                                                                                                                                                                                                                                                                                                                                                                                                          ps auxf
                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Checks CPU configuration
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Reads runtime system information
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2445
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/grep
                                                                                                                                                                                                                                                                                                                                                                                                                                                        grep dbus-daemon--system
                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2442
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/grep
                                                                                                                                                                                                                                                                                                                                                                                                                                                          grep -v grep
                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2443
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/awk
                                                                                                                                                                                                                                                                                                                                                                                                                                                            awk "{ print \$2 }"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2444
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                                                                                                                                                              sudo ps auxf
                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2447
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/ps
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ps auxf
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks CPU configuration
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2451
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/grep
                                                                                                                                                                                                                                                                                                                                                                                                                                                                grep "\\[\\]"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/awk
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  awk "{ print \$2 }"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2450
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/grep
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    grep -v grep
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2449
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      sudo ps auxf
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • OS Credential Dumping
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2453
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/ps
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        ps auxf
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Checks CPU configuration
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2457
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/grep
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      grep xm64
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2454
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/grep
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        grep -v grep
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2455
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/awk
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          awk "{ print \$2 }"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            sudo killall -9 "[atd]"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • OS Credential Dumping
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2458
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/killall
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              killall -9 "[atd]"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2459
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              sudo rm -rf /tmp/.jk
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                rm -rf /tmp/.jk
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2461
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                sudo killall -9 "[ntpd]"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2462
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/killall
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    killall -9 "[ntpd]"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2463
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    sudo killall -9 "[rpciod]"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/killall
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        killall -9 "[rpciod]"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2465
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        sudo killall -9 "[ext4-dio-unwrit]"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2466
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/killall
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          killall -9 "[ext4-dio-unwrit]"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Reads runtime system information
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2467
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        sudo rm -rf "/tmp/.xm*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          rm -rf "/tmp/.xm*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2469
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/pidof
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          pidof libexec
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Reads runtime system information
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2470

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Reconnaissance

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Resource Development

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Initial Access

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Persistence

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Account Manipulation

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1098

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SSH Authorized Keys

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1098.004

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Privilege Escalation

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1548

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Sudo and Sudo Caching

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1548.003

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Account Manipulation

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1098

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SSH Authorized Keys

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1098.004

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Defense Evasion

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1548

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Sudo and Sudo Caching

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1548.003

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Indicator Removal

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1070

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Clear Linux or Mac System Logs

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1070.002

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1497

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    System Checks

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1497.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Time Based Evasion

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1497.003

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Credential Access

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    OS Credential Dumping

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1003

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    /etc/passwd and /etc/shadow

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1003.008

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    System Information Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1082

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    System Network Configuration Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1016

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1497

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    System Checks

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1497.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Time Based Evasion

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1497.003

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Lateral Movement

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Collection

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Command and Control

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Exfiltration

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Impact

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/nc
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      8.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      ae747bc7fff9bc23f06635ef60ea0e8d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      64315e834f67905ed4e47f36155362a78ac23462

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      103b8404dc64c9a44511675981a09fd01395ee837452d114f1350c295357c046

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      e24914a58565a43883c27ae4a41061e8edd3d5eef7b86c1c0e9910d9fbe0eef3e78ed49136ac0c9378311e99901b1847bcfd926aa9a3ea44149a7478480f82b2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit