Analysis
- max time kernel
1s - max time network
132s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
- submitted
20/06/2026, 22:49
General
- Target resources/app.asar.unpacked/node_modules/systeminformation/lib/cli.js
- Size 4KB
- Sample260620-2rwcmaas2q
- SHA256 ef3e4ce0c16c7396aec9eeaaf07f21c90355c6c68924eb01f5dd181ee4470d54
Score
6/10
Malware Config
Signatures
- Checks hardware identifiers (DMI) 1 TTPs 4 IoCs
Checks DMI information which indicate if the system is a virtual machine.
- Checks system information (zLinux) 1 TTPs 3 IoCs
Check system information on IBM zSystems which indicate if the system is a virtual machine.
- Reads MAC address of network interface 2 TTPs 2 IoCs
Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.
- Reads hardware information 1 TTPs 16 IoCs
Accesses system info like serial numbers, manufacturer names etc.
- Reads network interface configuration 2 TTPs 42 IoCs
Fetches information about one or more active network interfaces.
- Reads network transmission queue length 2 TTPs 2 IoCs
Fetches the value of the tranmission queue length of the network interface (relevant for DDoS attacks).
- Changes its process name 17 IoCs
- Checks CPU configuration 1 TTPs 4 IoCs
Checks CPU information which indicate if the system is a virtual machine.
- Reads CPU attributes 1 TTPs 64 IoCs
- Reads system network configuration 1 TTPs 4 IoCs
Uses contents of /proc filesystem to enumerate network settings.
- Command and Scripting Interpreter: JavaScript 1 TTPs 4 IoCs
Execution via JavaScript.
- Command and Scripting Interpreter: Unix Shell 1 TTPs 64 IoCs
Execute scripts via Unix Shell.
- Enumerates kernel/hardware configuration 1 TTPs 64 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
- Reads runtime system information 20 IoCs
Reads data from /proc virtual filesystem.
- System Network Configuration Discovery 1 TTPs 10 IoCs
Adversaries may gather information about the network configuration of a system.
Processes
-
/tmp/resources/app.asar.unpacked/node_modules/systeminformation/lib/cli.js/tmp/resources/app.asar.unpacked/node_modules/systeminformation/lib/cli.js1⤵
-
/usr/local/sbin/nodenode /tmp/resources/app.asar.unpacked/node_modules/systeminformation/lib/cli.js1⤵
- Command and Scripting Interpreter: JavaScript
-
/usr/local/bin/nodenode /tmp/resources/app.asar.unpacked/node_modules/systeminformation/lib/cli.js1⤵
- Command and Scripting Interpreter: JavaScript
-
/usr/sbin/nodenode /tmp/resources/app.asar.unpacked/node_modules/systeminformation/lib/cli.js1⤵
- Command and Scripting Interpreter: JavaScript
-
/usr/bin/nodenode /tmp/resources/app.asar.unpacked/node_modules/systeminformation/lib/cli.js1⤵
- Checks CPU configuration
- Command and Scripting Interpreter: JavaScript
- Reads runtime system information
-
/bin/sh/bin/sh -c "export LC_ALL=C; dmidecode -t system 2>/dev/null; unset LC_ALL"2⤵
- Command and Scripting Interpreter: Unix Shell
-
/usr/sbin/dmidecodedmidecode -t system3⤵
-
-
-
/bin/sh/bin/sh -c "export LC_ALL=C; dmidecode -t bios 2>/dev/null; unset LC_ALL"2⤵
- Command and Scripting Interpreter: Unix Shell
-
/usr/sbin/dmidecodedmidecode -t bios3⤵
-
-
-
/bin/sh/bin/sh -c "echo -n \"chassis_asset_tag: \"; cat /sys/devices/virtual/dmi/id/chassis_asset_tag 2>/dev/null; echo; echo -n \"chassis_serial: \"; cat /sys/devices/virtual/dmi/id/chassis_serial 2>/dev/null; echo; echo -n \"chassis_type: \"; cat /sys/devices/virtual/dmi/id/chassis_type 2>/dev/null; echo; echo -n \"chassis_vendor: \"; cat /sys/devices/virtual/dmi/id/chassis_vendor 2>/dev/null; echo; echo -n \"chassis_version: \"; cat /sys/devices/virtual/dmi/id/chassis_version 2>/dev/null; echo;"2⤵
- Command and Scripting Interpreter: Unix Shell
-
/bin/catcat /sys/devices/virtual/dmi/id/chassis_asset_tag3⤵
- Reads hardware information
-
-
/bin/catcat /sys/devices/virtual/dmi/id/chassis_serial3⤵
- Reads hardware information
-
-
/bin/catcat /sys/devices/virtual/dmi/id/chassis_type3⤵
- Reads hardware information
-
-
/bin/catcat /sys/devices/virtual/dmi/id/chassis_vendor3⤵
- Reads hardware information
-
-
/bin/catcat /sys/devices/virtual/dmi/id/chassis_version3⤵
- Reads hardware information
-
-
-
/bin/sh/bin/sh -c "hostname -f 2>/dev/null"2⤵
-
/bin/hostnamehostname -f3⤵
-
-
-
/bin/sh/bin/sh -c "cat /etc/*-release; cat /usr/lib/os-release; cat /etc/openwrt_release"2⤵
- Command and Scripting Interpreter: Unix Shell
-
/bin/catcat /etc/lsb-release /etc/os-release3⤵
-
-
/bin/catcat /usr/lib/os-release3⤵
-
-
/bin/catcat /etc/openwrt_release3⤵
-
-
-
/bin/sh/bin/sh -c "echo -n \"os: \"; cat /var/lib/dbus/machine-id 2> /dev/null || cat /etc/machine-id 2> /dev/null; echo; echo -n \"hardware: \"; cat /sys/class/dmi/id/product_uuid 2> /dev/null; echo;"2⤵
- Command and Scripting Interpreter: Unix Shell
-
/bin/catcat /var/lib/dbus/machine-id3⤵
-
-
/bin/catcat /sys/class/dmi/id/product_uuid3⤵
- Reads hardware information
-
-
-
/bin/sh/bin/sh -c "openssl version"2⤵
- Command and Scripting Interpreter: Unix Shell
-
/usr/bin/opensslopenssl version3⤵
-
-
-
/bin/sh/bin/sh -c "npm -v"2⤵
- Command and Scripting Interpreter: Unix Shell
-
/usr/bin/npmnpm -v3⤵
-
-
/usr/local/sbin/nodenode /usr/bin/npm -v3⤵
-
-
/usr/local/bin/nodenode /usr/bin/npm -v3⤵
-
-
/usr/sbin/nodenode /usr/bin/npm -v3⤵
-
-
/usr/bin/nodenode /usr/bin/npm -v3⤵
- Changes its process name
- Reads runtime system information
-
-
-
/bin/sh/bin/sh -c "pm2 -v"2⤵
- Command and Scripting Interpreter: Unix Shell
-
-
/bin/sh/bin/sh -c "yarn --version"2⤵
-
-
/bin/sh/bin/sh -c "gulp --version"2⤵
- Command and Scripting Interpreter: Unix Shell
-
-
/bin/sh/bin/sh -c "brew --version"2⤵
-
-
/bin/sh/bin/sh -c "tsc --version"2⤵
- Command and Scripting Interpreter: Unix Shell
-
-
/bin/sh/bin/sh -c "grunt --version"2⤵
- Command and Scripting Interpreter: Unix Shell
-
-
/bin/sh/bin/sh -c "git --version"2⤵
- Command and Scripting Interpreter: Unix Shell
-
-
/bin/sh/bin/sh -c "apachectl -v 2>&1"2⤵
- Command and Scripting Interpreter: Unix Shell
-
-
/bin/sh/bin/sh -c "nginx -v 2>&1"2⤵
- Command and Scripting Interpreter: Unix Shell
-
-
/bin/sh/bin/sh -c "mysql -V"2⤵
- Command and Scripting Interpreter: Unix Shell
-
-
/bin/sh/bin/sh -c "php -v"2⤵
- Command and Scripting Interpreter: Unix Shell
-
-
/bin/sh/bin/sh -c "redis-server --version"2⤵
-
-
/bin/sh/bin/sh -c "docker --version"2⤵
-
-
/bin/sh/bin/sh -c "postconf -d | grep mail_version"2⤵
-
/bin/grepgrep mail_version3⤵
-
-
-
/bin/sh/bin/sh -c "mongod --version"2⤵
- Command and Scripting Interpreter: Unix Shell
-
-
/bin/sh/bin/sh -c "locate bin/postgres"2⤵
- Command and Scripting Interpreter: Unix Shell
-
/usr/bin/locatelocate bin/postgres3⤵
-
-
-
/bin/sh/bin/sh -c "perl -v"2⤵
-
/usr/bin/perlperl -v3⤵
-
-
-
/bin/sh/bin/sh -c "python -V 2>&1"2⤵
- Command and Scripting Interpreter: Unix Shell
-
/usr/bin/pythonpython -V3⤵
-
-
-
/bin/sh/bin/sh -c "python3 -V 2>&1"2⤵
- Command and Scripting Interpreter: Unix Shell
-
/usr/bin/python3python3 -V3⤵
-
-
-
/bin/sh/bin/sh -c "pip -V 2>&1"2⤵
- Command and Scripting Interpreter: Unix Shell
- System Network Configuration Discovery
-
-
/bin/sh/bin/sh -c "pip3 -V 2>&1"2⤵
- Command and Scripting Interpreter: Unix Shell
- System Network Configuration Discovery
-
-
/bin/sh/bin/sh -c "java -version 2>&1"2⤵
- Command and Scripting Interpreter: Unix Shell
-
-
/bin/sh/bin/sh -c "gcc -dumpversion"2⤵
-
/usr/bin/gccgcc -dumpversion3⤵
-
-
-
/bin/sh/bin/sh -c "vboxmanage -v 2>&1"2⤵
- Command and Scripting Interpreter: Unix Shell
-
-
/bin/sh/bin/sh -c "bash --version"2⤵
- Command and Scripting Interpreter: Unix Shell
-
/bin/bashbash --version3⤵
-
-
-
/bin/sh/bin/sh -c "zsh --version"2⤵
- Command and Scripting Interpreter: Unix Shell
-
-
/bin/sh/bin/sh -c "fish --version"2⤵
- Command and Scripting Interpreter: Unix Shell
-
-
/bin/sh/bin/sh -c "bun -v"2⤵
- Command and Scripting Interpreter: Unix Shell
-
-
/bin/sh/bin/sh -c "deno -v"2⤵
- Command and Scripting Interpreter: Unix Shell
-
-
/bin/sh/bin/sh -c "node -v"2⤵
- Command and Scripting Interpreter: Unix Shell
-
/usr/bin/nodenode -v3⤵
-
-
-
/bin/sh/bin/sh -c "export LC_ALL=C; lscpu; unset LC_ALL"2⤵
- Command and Scripting Interpreter: Unix Shell
-
/usr/bin/lscpulscpu3⤵
- Checks system information (zLinux)
- Checks CPU configuration
- Reads CPU attributes
- Reads runtime system information
-
-
-
/bin/sh/bin/sh -c "lspci -vvv 2>/dev/null"2⤵
- Command and Scripting Interpreter: Unix Shell
-
/usr/bin/lspcilspci -vvv3⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
-
/bin/sh/bin/sh -c "ip a 2> /dev/null"2⤵
- Command and Scripting Interpreter: Unix Shell
- System Network Configuration Discovery
-
/sbin/ipip a3⤵
- System Network Configuration Discovery
-
-
-
/bin/sh/bin/sh -c "cat /etc/network/interfaces 2> /dev/null | grep 'iface\\|source'"2⤵
- Command and Scripting Interpreter: Unix Shell
-
/bin/grepgrep "iface\\|source"3⤵
-
-
/bin/catcat /etc/network/interfaces3⤵
-
-
-
/bin/sh/bin/sh -c "ip route 2> /dev/null | grep default"2⤵
- Command and Scripting Interpreter: Unix Shell
- System Network Configuration Discovery
-
/bin/grepgrep default3⤵
-
-
/sbin/ipip route3⤵
- System Network Configuration Discovery
-
-
-
/bin/sh/bin/sh -c "echo -n \"addr_assign_type: \"; cat /sys/class/net/lo/addr_assign_type 2>/dev/null; echo; echo -n \"address: \"; cat /sys/class/net/lo/address 2>/dev/null; echo; echo -n \"addr_len: \"; cat /sys/class/net/lo/addr_len 2>/dev/null; echo; echo -n \"broadcast: \"; cat /sys/class/net/lo/broadcast 2>/dev/null; echo; echo -n \"carrier: \"; cat /sys/class/net/lo/carrier 2>/dev/null; echo; echo -n \"carrier_changes: \"; cat /sys/class/net/lo/carrier_changes 2>/dev/null; echo; echo -n \"dev_id: \"; cat /sys/class/net/lo/dev_id 2>/dev/null; echo; echo -n \"dev_port: \"; cat /sys/class/net/lo/dev_port 2>/dev/null; echo; echo -n \"dormant: \"; cat /sys/class/net/lo/dormant 2>/dev/null; echo; echo -n \"duplex: \"; cat /sys/class/net/lo/duplex 2>/dev/null; echo; echo -n \"flags: \"; cat /sys/class/net/lo/flags 2>/dev/null; echo; echo -n \"gro_flush_timeout: \"; cat /sys/class/net/lo/gro_flush_timeout 2>/dev/null; echo; echo -n \"ifalias: \"; cat /sys/class/net/lo/ifalias 2>/dev/null; echo; echo -n \"ifindex: \"; cat /sys/class/net/lo/ifindex 2>/dev/null; echo; echo -n \"iflink: \"; cat /sys/class/net/lo/iflink 2>/dev/null; echo; echo -n \"link_mode: \"; cat /sys/class/net/lo/link_mode 2>/dev/null; echo; echo -n \"mtu: \"; cat /sys/class/net/lo/mtu 2>/dev/null; echo; echo -n \"netdev_group: \"; cat /sys/class/net/lo/netdev_group 2>/dev/null; echo; echo -n \"operstate: \"; cat /sys/class/net/lo/operstate 2>/dev/null; echo; echo -n \"proto_down: \"; cat /sys/class/net/lo/proto_down 2>/dev/null; echo; echo -n \"speed: \"; cat /sys/class/net/lo/speed 2>/dev/null; echo; echo -n \"tx_queue_len: \"; cat /sys/class/net/lo/tx_queue_len 2>/dev/null; echo; echo -n \"type: \"; cat /sys/class/net/lo/type 2>/dev/null; echo; echo -n \"wireless: \"; cat /proc/net/wireless 2>/dev/null | grep lo; echo; echo -n \"wirelessspeed: \"; iw dev lo link 2>&1 | grep bitrate; echo;"2⤵
- Command and Scripting Interpreter: Unix Shell
-
/bin/catcat /sys/class/net/lo/addr_assign_type3⤵
- Reads network interface configuration
-
-
/bin/catcat /sys/class/net/lo/address3⤵
- Reads MAC address of network interface
-
-
/bin/catcat /sys/class/net/lo/addr_len3⤵
- Reads network interface configuration
-
-
/bin/catcat /sys/class/net/lo/broadcast3⤵
- Reads network interface configuration
-
-
/bin/catcat /sys/class/net/lo/carrier3⤵
- Reads network interface configuration
-
-
/bin/catcat /sys/class/net/lo/carrier_changes3⤵
- Reads network interface configuration
-
-
/bin/catcat /sys/class/net/lo/dev_id3⤵
- Reads network interface configuration
-
-
/bin/catcat /sys/class/net/lo/dev_port3⤵
- Reads network interface configuration
-
-
/bin/catcat /sys/class/net/lo/dormant3⤵
- Reads network interface configuration
-
-
/bin/catcat /sys/class/net/lo/duplex3⤵
- Reads network interface configuration
-
-
/bin/catcat /sys/class/net/lo/flags3⤵
- Reads network interface configuration
-
-
/bin/catcat /sys/class/net/lo/gro_flush_timeout3⤵
- Reads network interface configuration
-
-
/bin/catcat /sys/class/net/lo/ifalias3⤵
- Reads network interface configuration
-
-
/bin/catcat /sys/class/net/lo/ifindex3⤵
- Reads network interface configuration
-
-
/bin/catcat /sys/class/net/lo/iflink3⤵
- Reads network interface configuration
-
-
/bin/catcat /sys/class/net/lo/link_mode3⤵
- Reads network interface configuration
-
-
/bin/catcat /sys/class/net/lo/mtu3⤵
- Reads network interface configuration
-
-
/bin/catcat /sys/class/net/lo/netdev_group3⤵
- Reads network interface configuration
-
-
/bin/catcat /sys/class/net/lo/operstate3⤵
- Reads network interface configuration
-
-
/bin/catcat /sys/class/net/lo/proto_down3⤵
- Reads network interface configuration
-
-
/bin/catcat /sys/class/net/lo/speed3⤵
- Reads network interface configuration
-
-
/bin/catcat /sys/class/net/lo/tx_queue_len3⤵
- Reads network transmission queue length
-
-
/bin/catcat /sys/class/net/lo/type3⤵
- Reads network interface configuration
-
-
/bin/grepgrep lo3⤵
-
-
/bin/catcat /proc/net/wireless3⤵
- Reads system network configuration
-
-
/bin/grepgrep bitrate3⤵
-
-
/sbin/iwiw dev lo link3⤵
- Reads system network configuration
-
-
-
/bin/sh/bin/sh -c "nmcli device status 2>/dev/null | grep lo"2⤵
- Command and Scripting Interpreter: Unix Shell
-
/bin/grepgrep lo3⤵
-
-
/usr/bin/nmclinmcli device status3⤵
- Changes its process name
- Reads runtime system information
-
-
-
/bin/sh/bin/sh -c "echo -n \"addr_assign_type: \"; cat /sys/class/net/ens3/addr_assign_type 2>/dev/null; echo; echo -n \"address: \"; cat /sys/class/net/ens3/address 2>/dev/null; echo; echo -n \"addr_len: \"; cat /sys/class/net/ens3/addr_len 2>/dev/null; echo; echo -n \"broadcast: \"; cat /sys/class/net/ens3/broadcast 2>/dev/null; echo; echo -n \"carrier: \"; cat /sys/class/net/ens3/carrier 2>/dev/null; echo; echo -n \"carrier_changes: \"; cat /sys/class/net/ens3/carrier_changes 2>/dev/null; echo; echo -n \"dev_id: \"; cat /sys/class/net/ens3/dev_id 2>/dev/null; echo; echo -n \"dev_port: \"; cat /sys/class/net/ens3/dev_port 2>/dev/null; echo; echo -n \"dormant: \"; cat /sys/class/net/ens3/dormant 2>/dev/null; echo; echo -n \"duplex: \"; cat /sys/class/net/ens3/duplex 2>/dev/null; echo; echo -n \"flags: \"; cat /sys/class/net/ens3/flags 2>/dev/null; echo; echo -n \"gro_flush_timeout: \"; cat /sys/class/net/ens3/gro_flush_timeout 2>/dev/null; echo; echo -n \"ifalias: \"; cat /sys/class/net/ens3/ifalias 2>/dev/null; echo; echo -n \"ifindex: \"; cat /sys/class/net/ens3/ifindex 2>/dev/null; echo; echo -n \"iflink: \"; cat /sys/class/net/ens3/iflink 2>/dev/null; echo; echo -n \"link_mode: \"; cat /sys/class/net/ens3/link_mode 2>/dev/null; echo; echo -n \"mtu: \"; cat /sys/class/net/ens3/mtu 2>/dev/null; echo; echo -n \"netdev_group: \"; cat /sys/class/net/ens3/netdev_group 2>/dev/null; echo; echo -n \"operstate: \"; cat /sys/class/net/ens3/operstate 2>/dev/null; echo; echo -n \"proto_down: \"; cat /sys/class/net/ens3/proto_down 2>/dev/null; echo; echo -n \"speed: \"; cat /sys/class/net/ens3/speed 2>/dev/null; echo; echo -n \"tx_queue_len: \"; cat /sys/class/net/ens3/tx_queue_len 2>/dev/null; echo; echo -n \"type: \"; cat /sys/class/net/ens3/type 2>/dev/null; echo; echo -n \"wireless: \"; cat /proc/net/wireless 2>/dev/null | grep ens3; echo; echo -n \"wirelessspeed: \"; iw dev ens3 link 2>&1 | grep bitrate; echo;"2⤵
- Command and Scripting Interpreter: Unix Shell
-
/bin/catcat /sys/class/net/ens3/addr_assign_type3⤵
- Reads network interface configuration
-
-
/bin/catcat /sys/class/net/ens3/address3⤵
- Reads MAC address of network interface
-
-
/bin/catcat /sys/class/net/ens3/addr_len3⤵
- Reads network interface configuration
-
-
/bin/catcat /sys/class/net/ens3/broadcast3⤵
- Reads network interface configuration
-
-
/bin/catcat /sys/class/net/ens3/carrier3⤵
- Reads network interface configuration
-
-
/bin/catcat /sys/class/net/ens3/carrier_changes3⤵
- Reads network interface configuration
-
-
/bin/catcat /sys/class/net/ens3/dev_id3⤵
- Reads network interface configuration
-
-
/bin/catcat /sys/class/net/ens3/dev_port3⤵
- Reads network interface configuration
-
-
/bin/catcat /sys/class/net/ens3/dormant3⤵
- Reads network interface configuration
-
-
/bin/catcat /sys/class/net/ens3/duplex3⤵
- Reads network interface configuration
-
-
/bin/catcat /sys/class/net/ens3/flags3⤵
- Reads network interface configuration
-
-
/bin/catcat /sys/class/net/ens3/gro_flush_timeout3⤵
- Reads network interface configuration
-
-
/bin/catcat /sys/class/net/ens3/ifalias3⤵
- Reads network interface configuration
-
-
/bin/catcat /sys/class/net/ens3/ifindex3⤵
- Reads network interface configuration
-
-
/bin/catcat /sys/class/net/ens3/iflink3⤵
- Reads network interface configuration
-
-
/bin/catcat /sys/class/net/ens3/link_mode3⤵
- Reads network interface configuration
-
-
/bin/catcat /sys/class/net/ens3/mtu3⤵
- Reads network interface configuration
-
-
/bin/catcat /sys/class/net/ens3/netdev_group3⤵
- Reads network interface configuration
-
-
/bin/catcat /sys/class/net/ens3/operstate3⤵
- Reads network interface configuration
-
-
/bin/catcat /sys/class/net/ens3/proto_down3⤵
- Reads network interface configuration
-
-
/bin/catcat /sys/class/net/ens3/speed3⤵
- Reads network interface configuration
-
-
/bin/catcat /sys/class/net/ens3/tx_queue_len3⤵
- Reads network transmission queue length
-
-
/bin/catcat /sys/class/net/ens3/type3⤵
- Reads network interface configuration
-
-
/bin/grepgrep ens33⤵
-
-
/bin/catcat /proc/net/wireless3⤵
- Reads system network configuration
-
-
/bin/grepgrep bitrate3⤵
-
-
/sbin/iwiw dev ens3 link3⤵
- Reads system network configuration
-
-
-
/bin/sh/bin/sh -c "nmcli device status 2>/dev/null | grep ens3"2⤵
- Command and Scripting Interpreter: Unix Shell
-
/bin/grepgrep ens33⤵
-
-
/usr/bin/nmclinmcli device status3⤵
- Changes its process name
- Reads runtime system information
-
-
-
/bin/sh/bin/sh -c "nmcli connection show \"netplan-ens3\" 2>/dev/null | grep ipv4.method;"2⤵
- Command and Scripting Interpreter: Unix Shell
- System Network Configuration Discovery
-
/bin/grepgrep ipv4.method3⤵
- System Network Configuration Discovery
-
-
/usr/bin/nmclinmcli connection show netplan-ens33⤵
- Changes its process name
- Reads runtime system information
-
-
-
/bin/sh/bin/sh -c "nmcli connection show \"netplan-ens3\" 2>/dev/null | grep ipv4.dns-search;"2⤵
- Command and Scripting Interpreter: Unix Shell
- System Network Configuration Discovery
-
/bin/grepgrep ipv4.dns-search3⤵
- System Network Configuration Discovery
-
-
/usr/bin/nmclinmcli connection show netplan-ens33⤵
- Changes its process name
- Reads runtime system information
-
-
-
/bin/sh/bin/sh -c "nmcli connection show \"netplan-ens3\" 2>/dev/null | grep 802-1x.eap;"2⤵
- Command and Scripting Interpreter: Unix Shell
-
/bin/grepgrep 802-1x.eap3⤵
-
-
/usr/bin/nmclinmcli connection show netplan-ens33⤵
- Changes its process name
- Reads runtime system information
-
-
-
/bin/sh/bin/sh -c "export LC_ALL=C; dmidecode -t memory 2>/dev/null | grep -iE \"Size:|Type|Speed|Manufacturer|Form Factor|Locator|Memory Device|Serial Number|Voltage|Part Number\"; unset LC_ALL"2⤵
- Command and Scripting Interpreter: Unix Shell
-
/bin/grepgrep -iE "Size:|Type|Speed|Manufacturer|Form Factor|Locator|Memory Device|Serial Number|Voltage|Part Number"3⤵
-
-
/usr/sbin/dmidecodedmidecode -t memory3⤵
-
-
-
/bin/sh/bin/sh -c "export LC_ALL=C; lsblk -ablJO 2>/dev/null; unset LC_ALL"2⤵
-
/bin/lsblklsblk -ablJO3⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
-
/bin/sh/bin/sh -c "lspci -vmm 2>/dev/null"2⤵
- Command and Scripting Interpreter: Unix Shell
-
/usr/bin/lspcilspci -vmm3⤵
- Enumerates kernel/hardware configuration
-
-
-
/bin/sh/bin/sh -c "hcitool con"2⤵
- Command and Scripting Interpreter: Unix Shell
-
/usr/bin/hcitoolhcitool con3⤵
-
-
-
/bin/sh/bin/sh -c "export LC_ALL=C; lsusb -v 2>/dev/null; unset LC_ALL"2⤵
- Command and Scripting Interpreter: Unix Shell
-
/usr/bin/lsusblsusb -v3⤵
- Enumerates kernel/hardware configuration
-
-
-
/bin/sh/bin/sh -c "cat /etc/cups/printers.conf 2>/dev/null"2⤵
-
/bin/catcat /etc/cups/printers.conf3⤵
-
-
-
/bin/sh/bin/sh -c "export LC_ALL=C; lscpu; unset LC_ALL"2⤵
-
/usr/bin/lscpulscpu3⤵
- Checks system information (zLinux)
- Checks CPU configuration
- Reads CPU attributes
- Reads runtime system information
-
-
-
/bin/sh/bin/sh -c "echo -n \"board_asset_tag: \"; cat /sys/devices/virtual/dmi/id/board_asset_tag 2>/dev/null; echo; echo -n \"board_name: \"; cat /sys/devices/virtual/dmi/id/board_name 2>/dev/null; echo; echo -n \"board_serial: \"; cat /sys/devices/virtual/dmi/id/board_serial 2>/dev/null; echo; echo -n \"board_vendor: \"; cat /sys/devices/virtual/dmi/id/board_vendor 2>/dev/null; echo; echo -n \"board_version: \"; cat /sys/devices/virtual/dmi/id/board_version 2>/dev/null; echo;"2⤵
- Command and Scripting Interpreter: Unix Shell
-
/bin/catcat /sys/devices/virtual/dmi/id/board_asset_tag3⤵
- Reads hardware information
-
-
/bin/catcat /sys/devices/virtual/dmi/id/board_name3⤵
- Reads hardware information
-
-
/bin/catcat /sys/devices/virtual/dmi/id/board_serial3⤵
- Reads hardware information
-
-
/bin/catcat /sys/devices/virtual/dmi/id/board_vendor3⤵
- Checks hardware identifiers (DMI)
-
-
/bin/catcat /sys/devices/virtual/dmi/id/board_version3⤵
- Reads hardware information
-
-
-
/bin/sh/bin/sh -c "export LC_ALL=C; lscpu; echo -n \"Governor: \"; cat /sys/devices/system/cpu/cpu0/cpufreq/scaling_governor 2>/dev/null; echo; unset LC_ALL"2⤵
- Command and Scripting Interpreter: Unix Shell
-
/usr/bin/lscpulscpu3⤵
- Checks system information (zLinux)
- Checks CPU configuration
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/catcat /sys/devices/system/cpu/cpu0/cpufreq/scaling_governor3⤵
-
-
-
/bin/sh/bin/sh -c "export LC_ALL=C; lpstat -lp 2>/dev/null; unset LC_ALL"2⤵
- Command and Scripting Interpreter: Unix Shell
-
/usr/bin/lpstatlpstat -lp3⤵
-
-
-
/bin/sh/bin/sh -c "lspci -v 2>/dev/null"2⤵
- Command and Scripting Interpreter: Unix Shell
-
/usr/bin/lspcilspci -v3⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
-
/bin/sh/bin/sh -c "export LC_ALL=C; dmidecode -t 9 2>/dev/null; unset LC_ALL | grep \"Bus Address: \""2⤵
- Command and Scripting Interpreter: Unix Shell
-
/usr/sbin/dmidecodedmidecode -t 93⤵
-
-
/bin/grepgrep "Bus Address: "3⤵
-
-
-
/bin/sh/bin/sh -c "\"nvidia-smi\" --query-gpu=driver_version,pci.sub_device_id,name,pci.bus_id,fan.speed,memory.total,memory.used,memory.free,utilization.gpu,utilization.memory,temperature.gpu,temperature.memory,power.draw,power.limit,clocks.gr,clocks.mem --format=csv,noheader,nounits 2>/dev/null"2⤵
- Command and Scripting Interpreter: Unix Shell
-
-
/bin/sh/bin/sh -c "clinfo --raw"2⤵
- Command and Scripting Interpreter: Unix Shell
-
-
/bin/sh/bin/sh -c "gcc --version"2⤵
- Command and Scripting Interpreter: Unix Shell
-
/usr/bin/gccgcc --version3⤵
-
-
-
/bin/sh/bin/sh -c "psql -V"2⤵
- Command and Scripting Interpreter: Unix Shell
-
-
/bin/sh/bin/sh -c "echo \$LANG"2⤵
- Command and Scripting Interpreter: Unix Shell
-
-
/bin/sh/bin/sh -c "echo -n \"bios_date: \"; cat /sys/devices/virtual/dmi/id/bios_date 2>/dev/null; echo; echo -n \"bios_vendor: \"; cat /sys/devices/virtual/dmi/id/bios_vendor 2>/dev/null; echo; echo -n \"bios_version: \"; cat /sys/devices/virtual/dmi/id/bios_version 2>/dev/null; echo;"2⤵
- Command and Scripting Interpreter: Unix Shell
-
/bin/catcat /sys/devices/virtual/dmi/id/bios_date3⤵
- Reads hardware information
-
-
/bin/catcat /sys/devices/virtual/dmi/id/bios_vendor3⤵
- Checks hardware identifiers (DMI)
-
-
/bin/catcat /sys/devices/virtual/dmi/id/bios_version3⤵
- Reads hardware information
-
-
-
/bin/sh/bin/sh -c "echo -n \"product_name: \"; cat /sys/devices/virtual/dmi/id/product_name 2>/dev/null; echo; echo -n \"product_serial: \"; cat /sys/devices/virtual/dmi/id/product_serial 2>/dev/null; echo; echo -n \"product_uuid: \"; cat /sys/devices/virtual/dmi/id/product_uuid 2>/dev/null; echo; echo -n \"product_version: \"; cat /sys/devices/virtual/dmi/id/product_version 2>/dev/null; echo; echo -n \"sys_vendor: \"; cat /sys/devices/virtual/dmi/id/sys_vendor 2>/dev/null; echo;"2⤵
- Command and Scripting Interpreter: Unix Shell
-
/bin/catcat /sys/devices/virtual/dmi/id/product_name3⤵
- Checks hardware identifiers (DMI)
-
-
/bin/catcat /sys/devices/virtual/dmi/id/product_serial3⤵
- Reads hardware information
-
-
/bin/catcat /sys/devices/virtual/dmi/id/product_uuid3⤵
- Reads hardware information
-
-
/bin/catcat /sys/devices/virtual/dmi/id/product_version3⤵
- Reads hardware information
-
-
/bin/catcat /sys/devices/virtual/dmi/id/sys_vendor3⤵
- Checks hardware identifiers (DMI)
-
-
-
/bin/sh/bin/sh -c "ls -1 /dev/disk/by-id/ 2>/dev/null; pciconf -lv 2>/dev/null"2⤵
- Command and Scripting Interpreter: Unix Shell
-
/bin/lsls -1 /dev/disk/by-id/3⤵
- Reads runtime system information
-
-
-
/bin/sh/bin/sh -c "dmesg 2>/dev/null | grep -iE \"virtual|hypervisor\" | grep -iE \"vmware|qemu|kvm|xen\" | grep -viE \"Nested Virtualization|/virtual/\""2⤵
- Command and Scripting Interpreter: Unix Shell
-
/bin/grepgrep -viE "Nested Virtualization|/virtual/"3⤵
-
-
/bin/grepgrep -iE "vmware|qemu|kvm|xen"3⤵
-
-
/bin/grepgrep -iE "virtual|hypervisor"3⤵
-
-
/bin/dmesgdmesg3⤵
-
-
-
/bin/sh/bin/sh -c "dmesg | grep -E \"EFI v\""2⤵
- Command and Scripting Interpreter: Unix Shell
-
/bin/grepgrep -E "EFI v"3⤵
-
-
/bin/dmesgdmesg3⤵
-
-
-
/bin/sh/bin/sh -c "xdpyinfo 2>/dev/null | grep 'depth of root window' | awk '{ print \$5 }'"2⤵
- Command and Scripting Interpreter: Unix Shell
-
/bin/grepgrep "depth of root window"3⤵
-
-
/usr/bin/awkawk "{ print \$5 }"3⤵
- Reads runtime system information
-
-
/usr/bin/xdpyinfoxdpyinfo3⤵
-
-
-
/bin/sh/bin/sh -c "export LC_ALL=C; dmidecode –t 4 2>/dev/null | grep \"Upgrade: Socket\"; unset LC_ALL"2⤵
-
/usr/sbin/dmidecodedmidecode "–t" 43⤵
-
-
/bin/grepgrep "Upgrade: Socket"3⤵
-
-
-
/bin/sh/bin/sh -c "echo -n \"os: \"; cat /var/lib/dbus/machine-id 2> /dev/null || cat /etc/machine-id 2> /dev/null; echo; echo -n \"hardware: \"; cat /sys/class/dmi/id/product_uuid 2> /dev/null; echo;"2⤵
- Command and Scripting Interpreter: Unix Shell
-
/bin/catcat /var/lib/dbus/machine-id3⤵
-
-
/bin/catcat /sys/class/dmi/id/product_uuid3⤵
- Reads hardware information
-
-
-
/bin/sh/bin/sh -c "xrandr --verbose 2>/dev/null"2⤵
- Command and Scripting Interpreter: Unix Shell
-
/usr/bin/xrandrxrandr --verbose3⤵
-
-
-
/bin/sh/bin/sh -c "date +%Z && date +%z && ls -l /etc/localtime 2>/dev/null"2⤵
-
/bin/datedate "+%Z"3⤵
-
-
/bin/datedate "+%z"3⤵
-
-
/bin/lsls -l /etc/localtime3⤵
- Reads runtime system information
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
2026-06-20T20_53_29_747Z-debug-0.log