647b468259bfe966445ccd0275a64dbc5a78908fe231331193bffb020e3719f6

Analysis

max time kernel
149s
max time network
146s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
21/07/2026, 12:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
eclipse.x86_64.elf
Size 1.1MB
Sample260721-p14ddawdpf
SHA256 647b468259bfe966445ccd0275a64dbc5a78908fe231331193bffb020e3719f6
MD5 c0bf6af926c2fe4e7371318fc377b33d
SHA1 c2b36aed08c93b773e57c8547c2bcfbe80629038
SHA512 096bf05a93d55d1600ee6df005af74bed4cfc10d75a6e750a486f47e766768288fc01caa88c77413f90ec4e3940aeb03eae7b4efc49e574444d8417babd76adb
SSDEEP 24576:AbKFkD/1EHPPxRkUNWZOETDQ9MX++TYQ:uLD/1EvPxmUNWZOETDQ2O
TLSH
T1E9457C5AB2F370FCD067C030439BDB62A835F46911222E7B65C4DA352D66EB01B29F67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 2 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1519	sh
1520	chmod

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.arPMsF	crontab

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	eclipse.x86_64.elf

Enumerates running processes
Discovers information about currently running processes on the system

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/.eclipse.service	sh

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	eclipse.x86_64.elf

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/80/fd	eclipse.x86_64.elf
File opened for reading	/proc/83/fd	eclipse.x86_64.elf
File opened for reading	/proc/89/fd	eclipse.x86_64.elf
File opened for reading	/proc/183/fd	eclipse.x86_64.elf
File opened for reading	/proc/985/fd	eclipse.x86_64.elf
File opened for reading	/proc/1068/fd	eclipse.x86_64.elf
File opened for reading	/proc/1325/fd	eclipse.x86_64.elf
File opened for reading	/proc/34/fd	eclipse.x86_64.elf
File opened for reading	/proc/424/fd	eclipse.x86_64.elf
File opened for reading	/proc/460/fd	eclipse.x86_64.elf
File opened for reading	/proc/571/fd	eclipse.x86_64.elf
File opened for reading	/proc/680/fd	eclipse.x86_64.elf
File opened for reading	/proc/1114/fd	eclipse.x86_64.elf
File opened for reading	/proc/1204/fd	eclipse.x86_64.elf
File opened for reading	/proc/1352/fd	eclipse.x86_64.elf
File opened for reading	/proc/942/fd	eclipse.x86_64.elf
File opened for reading	/proc/9/fd	eclipse.x86_64.elf
File opened for reading	/proc/115/fd	eclipse.x86_64.elf
File opened for reading	/proc/181/fd	eclipse.x86_64.elf
File opened for reading	/proc/324/fd	eclipse.x86_64.elf
File opened for reading	/proc/496/fd	eclipse.x86_64.elf
File opened for reading	/proc/656/fd	eclipse.x86_64.elf
File opened for reading	/proc/5/fd	eclipse.x86_64.elf
File opened for reading	/proc/27/fd	eclipse.x86_64.elf
File opened for reading	/proc/1109/fd	eclipse.x86_64.elf
File opened for reading	/proc/1168/fd	eclipse.x86_64.elf
File opened for reading	/proc/1497/fd	eclipse.x86_64.elf
File opened for reading	/proc/947/fd	eclipse.x86_64.elf
File opened for reading	/proc/30/fd	eclipse.x86_64.elf
File opened for reading	/proc/36/fd	eclipse.x86_64.elf
File opened for reading	/proc/173/fd	eclipse.x86_64.elf
File opened for reading	/proc/178/fd	eclipse.x86_64.elf
File opened for reading	/proc/179/fd	eclipse.x86_64.elf
File opened for reading	/proc/618/fd	eclipse.x86_64.elf
File opened for reading	/proc/1206/fd	eclipse.x86_64.elf
File opened for reading	/proc/3/fd	eclipse.x86_64.elf
File opened for reading	/proc/19/fd	eclipse.x86_64.elf
File opened for reading	/proc/81/fd	eclipse.x86_64.elf
File opened for reading	/proc/213/fd	eclipse.x86_64.elf
File opened for reading	/proc/540/fd	eclipse.x86_64.elf
File opened for reading	/proc/581/fd	eclipse.x86_64.elf
File opened for reading	/proc/1049/fd	eclipse.x86_64.elf
File opened for reading	/proc/1487/fd	eclipse.x86_64.elf
File opened for reading	/proc/98/fd	eclipse.x86_64.elf
File opened for reading	/proc/170/fd	eclipse.x86_64.elf
File opened for reading	/proc/990/fd	eclipse.x86_64.elf
File opened for reading	/proc/1095/fd	eclipse.x86_64.elf
File opened for reading	/proc/1170/fd	eclipse.x86_64.elf
File opened for reading	/proc/2/fd	eclipse.x86_64.elf
File opened for reading	/proc/11/fd	eclipse.x86_64.elf
File opened for reading	/proc/171/fd	eclipse.x86_64.elf
File opened for reading	/proc/456/fd	eclipse.x86_64.elf
File opened for reading	/proc/137/fd	eclipse.x86_64.elf
File opened for reading	/proc/1018/fd	eclipse.x86_64.elf
File opened for reading	/proc/1074/fd	eclipse.x86_64.elf
File opened for reading	/proc/1310/fd	eclipse.x86_64.elf
File opened for reading	/proc/187/fd	eclipse.x86_64.elf
File opened for reading	/proc/472/fd	eclipse.x86_64.elf
File opened for reading	/proc/481/fd	eclipse.x86_64.elf
File opened for reading	/proc/502/fd	eclipse.x86_64.elf
File opened for reading	/proc/619/fd	eclipse.x86_64.elf
File opened for reading	/proc/1041/fd	eclipse.x86_64.elf
File opened for reading	/proc/1498/fd	eclipse.x86_64.elf
File opened for reading	/proc/17/fd	eclipse.x86_64.elf

System Network Configuration Discovery 1 TTPs 42 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1516	cp
1521	sh
1530	sh
1600	rm
1754	rm
1674	rm
1682	rm
1518	cp
1525	grep
1528	sed
1608	rm
1626	rm
1730	rm
1529	sh
1666	rm
1714	rm
1722	rm
1746	rm
1778	rm
1580	rm
1523	sh
1650	rm
1698	rm
1706	rm
1762	rm
1794	rm
1501	eclipse.x86_64.elf
1517	sh
1584	rm
1618	rm
1634	rm
1658	rm
1515	sh
1527	sh
1576	rm
1690	rm
1770	rm
1522	chattr
1592	rm
1642	rm
1738	rm
1786	rm

/tmp/eclipse.x86_64.elf
/tmp/eclipse.x86_64.elf
1⤵
- Enumerates active TCP sockets
- Reads system network configuration
- Reads runtime system information
- System Network Configuration Discovery
PID:1501
- /bin/sh
  sh -c "echo '0' > /proc/sys/kernel/pid_max 2>/dev/null"
  2⤵
  PID:1513
- /bin/sh
  sh -c "ulimit -u 50 2>/dev/null"
  2⤵
  PID:1514
- /bin/sh
  sh -c "cp /tmp/eclipse.x86_64.elf /var/tmp/.eclipse 2>/dev/null"
  2⤵
  - System Network Configuration Discovery
  PID:1515
- - /bin/cp
    cp /tmp/eclipse.x86_64.elf /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1516
- /bin/sh
  sh -c "cp /tmp/eclipse.x86_64.elf /usr/lib/.eclipse 2>/dev/null"
  2⤵
  - System Network Configuration Discovery
  PID:1517
- - /bin/cp
    cp /tmp/eclipse.x86_64.elf /usr/lib/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1518
- /bin/sh
  sh -c "chmod +x /var/tmp/.eclipse /usr/lib/.eclipse 2>/dev/null"
  2⤵
  - File and Directory Permissions Modification
  PID:1519
- - /bin/chmod
    chmod +x /var/tmp/.eclipse /usr/lib/.eclipse
    3⤵
    - File and Directory Permissions Modification
    PID:1520
- /bin/sh
  sh -c "chattr +i /var/tmp/.eclipse 2>/dev/null"
  2⤵
  - System Network Configuration Discovery
  PID:1521
- - /usr/bin/chattr
    chattr +i /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1522
- /bin/sh
  sh -c "crontab -l 2>/dev/null | grep -v '.eclipse' | crontab - 2>/dev/null"
  2⤵
  - System Network Configuration Discovery
  PID:1523
- - /usr/bin/crontab
    crontab -
    3⤵
    - Creates/modifies Cron job
    PID:1526
- - /bin/grep
    grep -v .eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1525
- - /usr/bin/crontab
    crontab -l
    3⤵
    PID:1524
- /bin/sh
  sh -c "sed -i '/.eclipse/d' /etc/rc.local 2>/dev/null"
  2⤵
  - System Network Configuration Discovery
  PID:1527
- - /bin/sed
    sed -i /.eclipse/d /etc/rc.local
    3⤵
    - System Network Configuration Discovery
    PID:1528
- /bin/sh
  sh -c "echo '[Unit] Description=System Service After=network.target [Service] Type=simple ExecStart=/var/tmp/.eclipse Restart=on-failure RestartSec=30 [Install] WantedBy=multi-user.target' > /etc/systemd/system/.eclipse.service 2>/dev/null"
  2⤵
  - Modifies systemd
  - System Network Configuration Discovery
  PID:1529
- /bin/sh
  sh -c "systemctl daemon-reload 2>/dev/null; systemctl enable .eclipse 2>/dev/null"
  2⤵
  - System Network Configuration Discovery
  PID:1530
- - /bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:1531
- - /bin/systemctl
    systemctl enable .eclipse
    3⤵
    PID:1552
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1573
- - /bin/rm
    rm -rf /tmp/. /tmp/.. /tmp/.ICE-unix /tmp/.Test-unix /tmp/.X11-unix /tmp/.XIM-unix /tmp/.font-unix
    3⤵
    PID:1574
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1575
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1576
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1577
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1578
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1579
- - /bin/rm
    rm -rf /run/. /run/.. /run/.eclipse.lock
    3⤵
    - System Network Configuration Discovery
    PID:1580
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1581
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1582
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1583
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1584
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1585
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1586
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1587
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1588
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1589
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1590
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1591
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1592
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1593
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1594
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1595
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1596
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1597
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1598
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1599
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1600
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1601
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1602
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1603
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1604
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1605
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1606
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1607
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1608
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1609
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1610
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1611
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1612
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1615
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1616
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1617
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1618
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1619
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1620
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1621
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1622
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1623
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1624
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1625
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1626
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1627
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1628
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1629
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1630
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1631
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1632
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1633
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1634
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1635
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1636
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1637
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1638
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1639
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1640
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1641
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1642
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1643
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1644
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1645
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1646
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1647
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1648
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1649
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1650
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1651
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1652
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1653
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1654
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1655
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1656
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1657
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1658
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1659
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1660
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1661
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1662
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1663
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1664
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1665
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1666
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1667
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1668
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1669
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1670
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1671
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1672
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1673
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1674
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1675
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1676
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1677
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1678
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1679
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1680
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1681
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1682
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1683
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1684
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1685
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1686
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1687
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1688
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1689
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1690
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1691
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1692
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1693
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1694
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1695
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1696
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1697
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1698
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1699
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1700
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1701
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1702
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1703
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1704
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1705
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1706
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1707
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1708
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1709
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1710
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1711
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1712
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1713
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1714
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1715
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1716
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1717
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1718
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1719
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1720
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1721
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1722
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1723
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1724
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1725
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1726
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1727
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1728
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1729
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1730
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1731
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1732
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1733
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1734
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1735
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1736
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1737
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1738
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1739
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1740
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1741
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1742
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1743
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1744
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1745
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1746
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1747
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1748
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1749
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1750
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1751
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1752
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1753
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1754
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1755
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1756
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1757
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1758
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1759
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1760
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1761
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1762
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1763
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1764
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1765
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1766
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1767
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1768
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1769
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1770
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1771
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1772
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1773
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1774
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1775
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1776
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1777
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1778
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1779
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1780
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1781
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1782
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1783
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1784
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1785
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1786
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1787
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1788
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1789
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1790
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1791
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1792
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1793
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1794
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1795
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1796
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1797
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1798

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.eclipse.service

Path /etc/systemd/system/.eclipse.service
Size 175B
SHA256 4f14b722591577aac6a2f7c7181d780cf468d13aae57e629b434b54fa8e54a51
MD5 ce8d2cd64f9c282d532a26c2e37f74f0
SHA1 fc34fe022e716204b46e274e3a4fc1c6993019d0
SHA512 7f5331b0a0534ac756b5ba0e2d5b7931e4d8db9af14a50ad2ccca2bc879ccb69ebab759c3fc4f965f37135265e958c2d0a9935bbd7329641600818779e36c94e
TLSH
T1AFC0C033270120E1CC4F35F19F637B000C100140018EF0300BD0102848F36429032DB9
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.arPMsF

Path /var/spool/cron/crontabs/tmp.arPMsF
Size 175B
SHA256 91269725b83ca504d2dc42fb05e6bef10b6768ca3420aef4e8268fd374579eef
MD5 dae0bb0964a9c3deef8649c6396fff70
SHA1 f38b1d876fa446fe9e26cec65767ad8dbd25e6a4
SHA512 0bd47714f41358758379ca0f4474d7161d70fd548720e8971e7bebd45e389d060814fe5574b018a160274fbfa5e9fb8a4cdf27f380335483b0898e34ff6e0ebf
TLSH
T10DC0C00D7F00293419400B04505A01186881903DC00DEF12D0CC00040206A4C2B60472
MD5 SHA1 SHA512 TLSH

Submit Download

.eclipse

Path /var/tmp/.eclipse
Size 1.1MB
SHA256 647b468259bfe966445ccd0275a64dbc5a78908fe231331193bffb020e3719f6
MD5 c0bf6af926c2fe4e7371318fc377b33d
SHA1 c2b36aed08c93b773e57c8547c2bcfbe80629038
SHA512 096bf05a93d55d1600ee6df005af74bed4cfc10d75a6e750a486f47e766768288fc01caa88c77413f90ec4e3940aeb03eae7b4efc49e574444d8417babd76adb
SSDEEP 24576:AbKFkD/1EHPPxRkUNWZOETDQ9MX++TYQ:uLD/1EvPxmUNWZOETDQ2O
TLSH
T1E9457C5AB2F370FCD067C030439BDB62A835F46911222E7B65C4DA352D66EB01B29F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads