xmrig_linux | 88615f7d7e2b67a28e5ec2a1ba6dfd302bec926f093b9efae9b341b452b63167

Analysis

max time kernel
6s
max time network
144s
platform
debian-12_armhf
resource
debian12-armhf-20260127-en
resource tags

arch:armhfimage:debian12-armhf-20260127-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
05/02/2026, 03:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
armv6.elf
Size 137KB
Sample260205-dkpphadz7e
SHA256 88615f7d7e2b67a28e5ec2a1ba6dfd302bec926f093b9efae9b341b452b63167
MD5 6c7450aac479951d6443eb15dbb24dd7
SHA1 b5b0fe7a3157c19dbec45532e13e2631bf24941b
SHA512 8605f2fa8cf2636d6df78addee12b6489bebe75235c77dc7c6d929f9ebdf0a174bbbf1ad2c617885d70280ec5c55dc2b70124c09f7dfa92a42d5cd97508969ed
SSDEEP 3072:ftiv4y0ou8LiS0cnghEvchl3kqvh5jIZcLEc2w5BrWmE7SHtLu:V4xM8oR6ch+ovLEcXFTa
TLSH
T1A8D3128ABDF5CD98C653A4B4C2DE612C419D8285BC113B536F27AC8F6C806CD37667CA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery xmrig_linux miner

Malware Config

Signatures

Xmrig_linux family
xmrig_linux
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig_linux

Flushes firewall rules 1 TTPs 19 IoCs

Flushes/ disables firewall rules inside the Linux kernel.

defense_evasion

Disable or Modify System Firewall

T1562.004

pid	Process
1064	iptables
1066	iptables
1067	iptables
1068	iptables
1069	iptables
1080	iptables
1075	iptables
1081	iptables
1065	iptables
1070	iptables
1072	iptables
1073	iptables
1074	iptables
1076	iptables
1078	iptables
1071	iptables
1077	iptables
1079	iptables
1086	iptables

Enumerates running processes
Discovers information about currently running processes on the system

Changes its process name 3 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	rcu_sched	786	armv6.elf
Changes the process name, possibly in an attempt to hide itself	ksoftirqd/2	786	armv6.elf
Changes the process name, possibly in an attempt to hide itself	ksoftirqd/2	786	armv6.elf

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/313/stat	killall
File opened for reading	/proc/338/stat	killall
File opened for reading	/proc/11/stat	killall
File opened for reading	/proc/35	killall
File opened for reading	/proc/22/stat	killall
File opened for reading	/proc/22/stat	killall
File opened for reading	/proc/22/stat	killall
File opened for reading	/proc/29	killall
File opened for reading	/proc/45/stat	killall
File opened for reading	/proc/11/stat	killall
File opened for reading	/proc/30/stat	killall
File opened for reading	/proc/4	killall
File opened for reading	/proc/683	killall
File opened for reading	/proc/785	killall
File opened for reading	/proc/18/stat	killall
File opened for reading	/proc/30	killall
File opened for reading	/proc/32	killall
File opened for reading	/proc/348	killall
File opened for reading	/proc/28	killall
File opened for reading	/proc/367/stat	killall
File opened for reading	/proc/31/stat	killall
File opened for reading	/proc/193/cmdline	killall
File opened for reading	/proc/643	killall
File opened for reading	/proc/35/stat	killall
File opened for reading	/proc/643	killall
File opened for reading	/proc/8/stat	killall
File opened for reading	/proc/51	killall
File opened for reading	/proc/19	killall
File opened for reading	/proc/254	killall
File opened for reading	/proc/2/stat	killall
File opened for reading	/proc/362	killall
File opened for reading	/proc/6	killall
File opened for reading	/proc/19/stat	killall
File opened for reading	/proc/45/stat	killall
File opened for reading	/proc/193/stat	killall
File opened for reading	/proc/143/cmdline	killall
File opened for reading	/proc/1/stat	killall
File opened for reading	/proc/642	killall
File opened for reading	/proc/33	killall
File opened for reading	/proc/16	killall
File opened for reading	/proc/19	killall
File opened for reading	/proc/57	killall
File opened for reading	/proc/887/stat	killall
File opened for reading	/proc/313	killall
File opened for reading	/proc/10/stat	killall
File opened for reading	/proc/728/cmdline	killall
File opened for reading	/proc/56/stat	killall
File opened for reading	/proc/766/stat	killall
File opened for reading	/proc/4	killall
File opened for reading	/proc/51	killall
File opened for reading	/proc/24	killall
File opened for reading	/proc/338/stat	killall
File opened for reading	/proc/683/cmdline	armv6.elf
File opened for reading	/proc/7	killall
File opened for reading	/proc/193	killall
File opened for reading	/proc/10/stat	killall
File opened for reading	/proc/25	killall
File opened for reading	/proc/624	killall
File opened for reading	/proc/9/stat	killall
File opened for reading	/proc/14/stat	killall
File opened for reading	/proc/785	killall
File opened for reading	/proc/7/stat	killall
File opened for reading	/proc/12/stat	killall
File opened for reading	/proc/13/stat	killall

System Network Configuration Discovery 1 TTPs 10 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
913	killall
914	killall
992	killall
1017	killall
1018	killall
1082	service
912	killall
990	killall
991	killall
1016	killall

/tmp/armv6.elf
/tmp/armv6.elf
1⤵
- Changes its process name
- Reads runtime system information
PID:786
- /bin/killall
  killall -9 mirai
  2⤵
  PID:790
- /usr/bin/killall
  killall -9 mirai
  2⤵
  PID:798
- /sbin/killall
  killall -9 mirai
  2⤵
  PID:802
- /bin/killall
  killall -9 dvrHelper
  2⤵
  PID:803
- /usr/bin/killall
  killall -9 dvrHelper
  2⤵
  PID:804
- /sbin/killall
  killall -9 dvrHelper
  2⤵
  PID:805
- /bin/killall
  killall -9 Arcane
  2⤵
  - Reads runtime system information
  PID:806
- /usr/bin/killall
  killall -9 Arcane
  2⤵
  - Reads runtime system information
  PID:807
- /sbin/killall
  killall -9 Arcane
  2⤵
  PID:808
- /bin/killall
  killall -9 fantasy
  2⤵
  PID:809
- /usr/bin/killall
  killall -9 fantasy
  2⤵
  - Reads runtime system information
  PID:810
- /sbin/killall
  killall -9 fantasy
  2⤵
  PID:811
- /bin/killall
  killall -9 satori
  2⤵
  PID:812
- /usr/bin/killall
  killall -9 satori
  2⤵
  - Reads runtime system information
  PID:813
- /sbin/killall
  killall -9 satori
  2⤵
  PID:814
- /bin/killall
  killall -9 owari
  2⤵
  PID:815
- /usr/bin/killall
  killall -9 owari
  2⤵
  PID:816
- /sbin/killall
  killall -9 owari
  2⤵
  PID:817
- /bin/killall
  killall -9 masuta
  2⤵
  - Reads runtime system information
  PID:818
- /usr/bin/killall
  killall -9 masuta
  2⤵
  - Reads runtime system information
  PID:819
- /sbin/killall
  killall -9 masuta
  2⤵
  PID:820
- /bin/killall
  killall -9 lightaidra
  2⤵
  PID:821
- /usr/bin/killall
  killall -9 lightaidra
  2⤵
  PID:822
- /sbin/killall
  killall -9 lightaidra
  2⤵
  PID:823
- /bin/killall
  killall -9 okane
  2⤵
  PID:824
- /usr/bin/killall
  killall -9 okane
  2⤵
  PID:825
- /sbin/killall
  killall -9 okane
  2⤵
  PID:826
- /bin/killall
  killall -9 yakuza
  2⤵
  PID:827
- /usr/bin/killall
  killall -9 yakuza
  2⤵
  PID:828
- /sbin/killall
  killall -9 yakuza
  2⤵
  PID:829
- /bin/killall
  killall -9 tsunami
  2⤵
  - Reads runtime system information
  PID:830
- /usr/bin/killall
  killall -9 tsunami
  2⤵
  PID:831
- /sbin/killall
  killall -9 tsunami
  2⤵
  PID:832
- /bin/killall
  killall -9 kaiten
  2⤵
  - Reads runtime system information
  PID:833
- /usr/bin/killall
  killall -9 kaiten
  2⤵
  - Reads runtime system information
  PID:834
- /sbin/killall
  killall -9 kaiten
  2⤵
  PID:835
- /bin/killall
  killall -9 shad0w
  2⤵
  PID:836
- /usr/bin/killall
  killall -9 shad0w
  2⤵
  PID:837
- /sbin/killall
  killall -9 shad0w
  2⤵
  PID:838
- /bin/killall
  killall -9 qbot
  2⤵
  PID:839
- /usr/bin/killall
  killall -9 qbot
  2⤵
  PID:840
- /sbin/killall
  killall -9 qbot
  2⤵
  PID:841
- /bin/killall
  killall -9 conficker
  2⤵
  - Reads runtime system information
  PID:842
- /usr/bin/killall
  killall -9 conficker
  2⤵
  PID:843
- /sbin/killall
  killall -9 conficker
  2⤵
  PID:845
- /bin/killall
  killall -9 worm
  2⤵
  - Reads runtime system information
  PID:846
- /usr/bin/killall
  killall -9 worm
  2⤵
  - Reads runtime system information
  PID:847
- /sbin/killall
  killall -9 worm
  2⤵
  PID:848
- /bin/killall
  killall -9 botnet
  2⤵
  - Reads runtime system information
  PID:849
- /usr/bin/killall
  killall -9 botnet
  2⤵
  PID:850
- /sbin/killall
  killall -9 botnet
  2⤵
  PID:851
- /bin/killall
  killall -9 miner
  2⤵
  PID:852
- /usr/bin/killall
  killall -9 miner
  2⤵
  PID:853
- /sbin/killall
  killall -9 miner
  2⤵
  PID:854
- /bin/killall
  killall -9 cryptominer
  2⤵
  PID:855
- /usr/bin/killall
  killall -9 cryptominer
  2⤵
  PID:856
- /sbin/killall
  killall -9 cryptominer
  2⤵
  PID:857
- /bin/killall
  killall -9 xmrig
  2⤵
  PID:858
- /usr/bin/killall
  killall -9 xmrig
  2⤵
  PID:859
- /sbin/killall
  killall -9 xmrig
  2⤵
  PID:860
- /bin/killall
  killall -9 cpuminer
  2⤵
  PID:861
- /usr/bin/killall
  killall -9 cpuminer
  2⤵
  PID:862
- /sbin/killall
  killall -9 cpuminer
  2⤵
  PID:863
- /bin/killall
  killall -9 minerd
  2⤵
  PID:864
- /usr/bin/killall
  killall -9 minerd
  2⤵
  PID:865
- /sbin/killall
  killall -9 minerd
  2⤵
  PID:866
- /bin/killall
  killall -9 cgminer
  2⤵
  - Reads runtime system information
  PID:867
- /usr/bin/killall
  killall -9 cgminer
  2⤵
  PID:868
- /sbin/killall
  killall -9 cgminer
  2⤵
  PID:869
- /bin/killall
  killall -9 bfgminer
  2⤵
  PID:870
- /usr/bin/killall
  killall -9 bfgminer
  2⤵
  PID:871
- /sbin/killall
  killall -9 bfgminer
  2⤵
  PID:874
- /bin/killall
  killall -9 telnetd
  2⤵
  PID:875
- /usr/bin/killall
  killall -9 telnetd
  2⤵
  - Reads runtime system information
  PID:876
- /sbin/killall
  killall -9 telnetd
  2⤵
  PID:877
- /bin/killall
  killall -9 sshd
  2⤵
  PID:878
- /bin/killall
  killall -9 dropbear
  2⤵
  PID:879
- /usr/bin/killall
  killall -9 dropbear
  2⤵
  PID:880
- /sbin/killall
  killall -9 dropbear
  2⤵
  PID:881
- /bin/killall
  killall -9 busybox
  2⤵
  - Reads runtime system information
  PID:882
- /usr/bin/killall
  killall -9 busybox
  2⤵
  PID:883
- /sbin/killall
  killall -9 busybox
  2⤵
  PID:884
- /bin/killall
  killall -9 httpd
  2⤵
  - Reads runtime system information
  PID:885
- /usr/bin/killall
  killall -9 httpd
  2⤵
  - Reads runtime system information
  PID:888
- /sbin/killall
  killall -9 httpd
  2⤵
  PID:889
- /bin/killall
  killall -9 nginx
  2⤵
  PID:890
- /usr/bin/killall
  killall -9 nginx
  2⤵
  - Reads runtime system information
  PID:891
- /sbin/killall
  killall -9 nginx
  2⤵
  PID:892
- /bin/killall
  killall -9 apache
  2⤵
  PID:893
- /usr/bin/killall
  killall -9 apache
  2⤵
  PID:894
- /sbin/killall
  killall -9 apache
  2⤵
  PID:896
- /bin/killall
  killall -9 lighttpd
  2⤵
  PID:897
- /usr/bin/killall
  killall -9 lighttpd
  2⤵
  - Reads runtime system information
  PID:898
- /sbin/killall
  killall -9 lighttpd
  2⤵
  PID:899
- /bin/killall
  killall -9 uhttpd
  2⤵
  PID:900
- /usr/bin/killall
  killall -9 uhttpd
  2⤵
  - Reads runtime system information
  PID:901
- /sbin/killall
  killall -9 uhttpd
  2⤵
  PID:902
- /bin/killall
  killall -9 webs
  2⤵
  - Reads runtime system information
  PID:903
- /usr/bin/killall
  killall -9 webs
  2⤵
  - Reads runtime system information
  PID:904
- /sbin/killall
  killall -9 webs
  2⤵
  PID:905
- /bin/killall
  killall -9 webcam
  2⤵
  PID:906
- /usr/bin/killall
  killall -9 webcam
  2⤵
  PID:907
- /sbin/killall
  killall -9 webcam
  2⤵
  PID:908
- /bin/killall
  killall -9 cctv
  2⤵
  PID:909
- /usr/bin/killall
  killall -9 cctv
  2⤵
  PID:910
- /sbin/killall
  killall -9 cctv
  2⤵
  PID:911
- /bin/killall
  killall -9 ipcam
  2⤵
  - System Network Configuration Discovery
  PID:912
- /usr/bin/killall
  killall -9 ipcam
  2⤵
  - System Network Configuration Discovery
  PID:913
- /sbin/killall
  killall -9 ipcam
  2⤵
  - System Network Configuration Discovery
  PID:914
- /bin/killall
  killall -9 goahead
  2⤵
  PID:915
- /usr/bin/killall
  killall -9 goahead
  2⤵
  - Reads runtime system information
  PID:916
- /sbin/killall
  killall -9 goahead
  2⤵
  PID:917
- /bin/killall
  killall -9 realtek
  2⤵
  - Reads runtime system information
  PID:918
- /usr/bin/killall
  killall -9 realtek
  2⤵
  - Reads runtime system information
  PID:919
- /sbin/killall
  killall -9 realtek
  2⤵
  PID:920
- /bin/killall
  killall -9 hikvision
  2⤵
  PID:921
- /usr/bin/killall
  killall -9 hikvision
  2⤵
  PID:922
- /sbin/killall
  killall -9 hikvision
  2⤵
  PID:923
- /bin/killall
  killall -9 dahua
  2⤵
  - Reads runtime system information
  PID:924
- /usr/bin/killall
  killall -9 dahua
  2⤵
  PID:925
- /sbin/killall
  killall -9 dahua
  2⤵
  PID:926
- /bin/killall
  killall -9 tplink
  2⤵
  PID:927
- /usr/bin/killall
  killall -9 tplink
  2⤵
  PID:928
- /sbin/killall
  killall -9 tplink
  2⤵
  PID:929
- /bin/killall
  killall -9 netgear
  2⤵
  PID:930
- /usr/bin/killall
  killall -9 netgear
  2⤵
  PID:931
- /sbin/killall
  killall -9 netgear
  2⤵
  PID:932
- /bin/killall
  killall -9 dlink
  2⤵
  PID:933
- /usr/bin/killall
  killall -9 dlink
  2⤵
  - Reads runtime system information
  PID:934
- /sbin/killall
  killall -9 dlink
  2⤵
  PID:935
- /bin/killall
  killall -9 linksys
  2⤵
  PID:936
- /usr/bin/killall
  killall -9 linksys
  2⤵
  PID:937
- /sbin/killall
  killall -9 linksys
  2⤵
  PID:938
- /bin/killall
  killall -9 asus
  2⤵
  - Reads runtime system information
  PID:939
- /usr/bin/killall
  killall -9 asus
  2⤵
  PID:940
- /sbin/killall
  killall -9 asus
  2⤵
  PID:941
- /bin/killall
  killall -9 huawei
  2⤵
  - Reads runtime system information
  PID:942
- /usr/bin/killall
  killall -9 huawei
  2⤵
  - Reads runtime system information
  PID:943
- /sbin/killall
  killall -9 huawei
  2⤵
  PID:944
- /bin/killall
  killall -9 zte
  2⤵
  - Reads runtime system information
  PID:945
- /usr/bin/killall
  killall -9 zte
  2⤵
  PID:946
- /sbin/killall
  killall -9 zte
  2⤵
  PID:947
- /bin/killall
  killall -9 ubiquiti
  2⤵
  PID:948
- /usr/bin/killall
  killall -9 ubiquiti
  2⤵
  - Reads runtime system information
  PID:949
- /sbin/killall
  killall -9 ubiquiti
  2⤵
  PID:950
- /bin/killall
  killall -9 backdoor
  2⤵
  PID:951
- /usr/bin/killall
  killall -9 backdoor
  2⤵
  PID:952
- /sbin/killall
  killall -9 backdoor
  2⤵
  PID:953
- /bin/killall
  killall -9 trojan
  2⤵
  PID:954
- /usr/bin/killall
  killall -9 trojan
  2⤵
  - Reads runtime system information
  PID:955
- /sbin/killall
  killall -9 trojan
  2⤵
  PID:956
- /bin/killall
  killall -9 virus
  2⤵
  PID:957
- /usr/bin/killall
  killall -9 virus
  2⤵
  - Reads runtime system information
  PID:958
- /sbin/killall
  killall -9 virus
  2⤵
  PID:959
- /bin/killall
  killall -9 malware
  2⤵
  PID:960
- /usr/bin/killall
  killall -9 malware
  2⤵
  PID:961
- /sbin/killall
  killall -9 malware
  2⤵
  PID:962
- /bin/killall
  killall -9 exploit
  2⤵
  PID:963
- /usr/bin/killall
  killall -9 exploit
  2⤵
  - Reads runtime system information
  PID:964
- /sbin/killall
  killall -9 exploit
  2⤵
  PID:965
- /bin/killall
  killall -9 shell
  2⤵
  - Reads runtime system information
  PID:966
- /usr/bin/killall
  killall -9 shell
  2⤵
  PID:967
- /sbin/killall
  killall -9 shell
  2⤵
  PID:968
- /bin/killall
  killall -9 netcat
  2⤵
  - Reads runtime system information
  PID:969
- /usr/bin/killall
  killall -9 netcat
  2⤵
  PID:970
- /sbin/killall
  killall -9 netcat
  2⤵
  PID:971
- /bin/killall
  killall -9 nc
  2⤵
  - Reads runtime system information
  PID:972
- /usr/bin/killall
  killall -9 nc
  2⤵
  - Reads runtime system information
  PID:973
- /sbin/killall
  killall -9 nc
  2⤵
  PID:974
- /bin/killall
  killall -9 ncat
  2⤵
  PID:975
- /usr/bin/killall
  killall -9 ncat
  2⤵
  PID:976
- /sbin/killall
  killall -9 ncat
  2⤵
  PID:977
- /bin/killall
  killall -9 socat
  2⤵
  PID:978
- /usr/bin/killall
  killall -9 socat
  2⤵
  PID:979
- /sbin/killall
  killall -9 socat
  2⤵
  PID:980
- /bin/killall
  killall -9 wget
  2⤵
  PID:981
- /usr/bin/killall
  killall -9 wget
  2⤵
  PID:982
- /sbin/killall
  killall -9 wget
  2⤵
  PID:983
- /bin/killall
  killall -9 curl
  2⤵
  PID:984
- /usr/bin/killall
  killall -9 curl
  2⤵
  PID:985
- /sbin/killall
  killall -9 curl
  2⤵
  PID:986
- /bin/killall
  killall -9 tftp
  2⤵
  PID:987
- /usr/bin/killall
  killall -9 tftp
  2⤵
  - Reads runtime system information
  PID:988
- /sbin/killall
  killall -9 tftp
  2⤵
  PID:989
- /bin/killall
  killall -9 iptables
  2⤵
  - System Network Configuration Discovery
  PID:990
- /usr/bin/killall
  killall -9 iptables
  2⤵
  - System Network Configuration Discovery
  PID:991
- /sbin/killall
  killall -9 iptables
  2⤵
  - System Network Configuration Discovery
  PID:992
- /bin/killall
  killall -9 firewalld
  2⤵
  PID:993
- /usr/bin/killall
  killall -9 firewalld
  2⤵
  PID:994
- /sbin/killall
  killall -9 firewalld
  2⤵
  PID:995
- /bin/killall
  killall -9 ufw
  2⤵
  - Reads runtime system information
  PID:996
- /usr/bin/killall
  killall -9 ufw
  2⤵
  - Reads runtime system information
  PID:997
- /sbin/killall
  killall -9 ufw
  2⤵
  PID:998
- /bin/killall
  killall -9 fail2ban
  2⤵
  - Reads runtime system information
  PID:999
- /usr/bin/killall
  killall -9 fail2ban
  2⤵
  - Reads runtime system information
  PID:1002
- /sbin/killall
  killall -9 fail2ban
  2⤵
  PID:1003
- /bin/killall
  killall -9 clamav
  2⤵
  PID:1004
- /usr/bin/killall
  killall -9 clamav
  2⤵
  PID:1005
- /sbin/killall
  killall -9 clamav
  2⤵
  PID:1006
- /bin/killall
  killall -9 rkhunter
  2⤵
  PID:1007
- /usr/bin/killall
  killall -9 rkhunter
  2⤵
  PID:1008
- /sbin/killall
  killall -9 rkhunter
  2⤵
  PID:1009
- /bin/killall
  killall -9 chkrootkit
  2⤵
  PID:1010
- /usr/bin/killall
  killall -9 chkrootkit
  2⤵
  - Reads runtime system information
  PID:1011
- /sbin/killall
  killall -9 chkrootkit
  2⤵
  PID:1012
- /bin/killall
  killall -9 aide
  2⤵
  - Reads runtime system information
  PID:1013
- /usr/bin/killall
  killall -9 aide
  2⤵
  - Reads runtime system information
  PID:1014
- /sbin/killall
  killall -9 aide
  2⤵
  PID:1015
- /bin/killall
  killall -9 tripwire
  2⤵
  - System Network Configuration Discovery
  PID:1016
- /usr/bin/killall
  killall -9 tripwire
  2⤵
  - System Network Configuration Discovery
  PID:1017
- /sbin/killall
  killall -9 tripwire
  2⤵
  - System Network Configuration Discovery
  PID:1018
- /bin/killall
  killall -9 ossec
  2⤵
  PID:1019
- /usr/bin/killall
  killall -9 ossec
  2⤵
  - Reads runtime system information
  PID:1020
- /sbin/killall
  killall -9 ossec
  2⤵
  PID:1021
- /bin/killall
  killall -9 snort
  2⤵
  - Reads runtime system information
  PID:1022
- /usr/bin/killall
  killall -9 snort
  2⤵
  - Reads runtime system information
  PID:1023
- /sbin/killall
  killall -9 snort
  2⤵
  PID:1024
- /bin/killall
  killall -9 suricata
  2⤵
  PID:1025
- /usr/bin/killall
  killall -9 suricata
  2⤵
  PID:1026
- /sbin/killall
  killall -9 suricata
  2⤵
  PID:1027
- /bin/rm
  rm -rf /tmp/mirai
  2⤵
  PID:1028
- /bin/rm
  rm -rf /tmp/dvrHelper
  2⤵
  PID:1029
- /bin/rm
  rm -rf /tmp/Arcane
  2⤵
  PID:1030
- /bin/rm
  rm -rf /tmp/fantasy
  2⤵
  PID:1031
- /bin/rm
  rm -rf /tmp/satori
  2⤵
  PID:1032
- /bin/rm
  rm -rf /tmp/owari
  2⤵
  PID:1033
- /bin/rm
  rm -rf /tmp/masuta
  2⤵
  PID:1034
- /bin/rm
  rm -rf /tmp/lightaidra
  2⤵
  PID:1035
- /bin/rm
  rm -rf /tmp/okane
  2⤵
  PID:1036
- /bin/rm
  rm -rf /tmp/yakuza
  2⤵
  PID:1037
- /bin/rm
  rm -rf /tmp/tsunami
  2⤵
  PID:1038
- /bin/rm
  rm -rf /tmp/kaiten
  2⤵
  PID:1039
- /bin/rm
  rm -rf /tmp/shad0w
  2⤵
  PID:1040
- /bin/rm
  rm -rf /tmp/qbot
  2⤵
  PID:1041
- /bin/rm
  rm -rf /tmp/conficker
  2⤵
  PID:1042
- /bin/rm
  rm -rf /tmp/worm
  2⤵
  PID:1043
- /bin/rm
  rm -rf /tmp/botnet
  2⤵
  PID:1044
- /bin/rm
  rm -rf /tmp/miner
  2⤵
  PID:1045
- /bin/rm
  rm -rf /tmp/cryptominer
  2⤵
  PID:1046
- /bin/rm
  rm -rf /tmp/xmrig
  2⤵
  PID:1047
- /bin/rm
  rm -rf /tmp/cpuminer
  2⤵
  PID:1048
- /bin/rm
  rm -rf /tmp/minerd
  2⤵
  PID:1049
- /bin/rm
  rm -rf /tmp/cgminer
  2⤵
  PID:1050
- /bin/rm
  rm -rf /tmp/bfgminer
  2⤵
  PID:1051
- /bin/rm
  rm -rf "/var/tmp/*"
  2⤵
  PID:1053
- /bin/rm
  rm -rf "/dev/shm/*"
  2⤵
  PID:1054
- /bin/rm
  rm -rf "/tmp/*bot*"
  2⤵
  PID:1055
- /bin/rm
  rm -rf "/tmp/*miner*"
  2⤵
  PID:1056
- /bin/rm
  rm -rf /root/.bashrc
  2⤵
  PID:1057
- /bin/rm
  rm -rf /root/.profile
  2⤵
  PID:1058
- /bin/rm
  rm -rf /etc/rc.local
  2⤵
  PID:1059
- /bin/rm
  rm -rf /etc/crontab
  2⤵
  PID:1060
- /bin/rm
  rm -rf "/etc/cron.d/*"
  2⤵
  PID:1061
- /bin/rm
  rm -rf "/var/spool/cron/*"
  2⤵
  PID:1063
- /sbin/iptables
  iptables -F
  2⤵
  - Flushes firewall rules
  PID:1064
- /usr/sbin/iptables
  iptables -F
  2⤵
  - Flushes firewall rules
  PID:1065
- /sbin/iptables
  iptables -X
  2⤵
  - Flushes firewall rules
  PID:1066
- /usr/sbin/iptables
  iptables -X
  2⤵
  - Flushes firewall rules
  PID:1067
- /sbin/iptables
  iptables -t nat -F
  2⤵
  - Flushes firewall rules
  PID:1068
- /usr/sbin/iptables
  iptables -t nat -F
  2⤵
  - Flushes firewall rules
  PID:1069
- /sbin/iptables
  iptables -t nat -X
  2⤵
  - Flushes firewall rules
  PID:1070
- /usr/sbin/iptables
  iptables -t nat -X
  2⤵
  - Flushes firewall rules
  PID:1071
- /sbin/iptables
  iptables -t mangle -F
  2⤵
  - Flushes firewall rules
  PID:1072
- /usr/sbin/iptables
  iptables -t mangle -F
  2⤵
  - Flushes firewall rules
  PID:1073
- /sbin/iptables
  iptables -t mangle -X
  2⤵
  - Flushes firewall rules
  PID:1074
- /usr/sbin/iptables
  iptables -t mangle -X
  2⤵
  - Flushes firewall rules
  PID:1075
- /sbin/iptables
  iptables -P INPUT ACCEPT
  2⤵
  - Flushes firewall rules
  PID:1076
- /usr/sbin/iptables
  iptables -P INPUT ACCEPT
  2⤵
  - Flushes firewall rules
  PID:1077
- /sbin/iptables
  iptables -P FORWARD ACCEPT
  2⤵
  - Flushes firewall rules
  PID:1078
- /usr/sbin/iptables
  iptables -P FORWARD ACCEPT
  2⤵
  - Flushes firewall rules
  PID:1079
- /sbin/iptables
  iptables -P OUTPUT ACCEPT
  2⤵
  - Flushes firewall rules
  PID:1080
- /usr/sbin/iptables
  iptables -P OUTPUT ACCEPT
  2⤵
  - Flushes firewall rules
  PID:1081
- /tmp/service
  iptables stop
  2⤵
  - System Network Configuration Discovery
  PID:1082
- /tmp/systemctl
  stop firewalld
  2⤵
  PID:1083
- /tmp/systemctl
  stop ufw
  2⤵
  PID:1084
- /tmp/systemctl
  stop fail2ban
  2⤵
  PID:1085
- /etc/init.d/iptables
  stop
  2⤵
  - Flushes firewall rules
  PID:1086
- /etc/init.d/firewalld
  stop
  2⤵
  PID:1087
- /etc/init.d/ufw
  stop
  2⤵
  PID:1088
- /etc/init.d/fail2ban
  stop
  2⤵
  PID:1089
- /bin/cp
  cp /tmp/armv6.elf /dev/shm/.kworker
  2⤵
  PID:1090

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads