82eba36c8ac1613f451333eae4bff558e53cf814938d4b181790644371400eec

Analysis

max time kernel
2s
max time network
130s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
22/07/2026, 11:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
.rsync/a/init01
Size 9KB
Sample260722-nc84aaeb43
SHA256 82eba36c8ac1613f451333eae4bff558e53cf814938d4b181790644371400eec
MD5 e8ffc6aac5c2784b10319c25d229a44e
SHA1 0bcdd833c497eebc1cbe003a091142a19f2cbf0c
SHA512 197104ba26107fa8f235e708901a74d9220701721fbff0cac13306b6f1bf50ae0e947846239ec6053ca835d6ee6b0bda1ede6f69ac26f36d8af47d0579bf52f1
SSDEEP 96:97gXuXmR7PofQH8h9GVQbxgeJwI2n2lznGWSKKFZ5W:97xmRbok8hAGbxPz900
TLSH
T1FB123A5F5577FCB9BB52D8A3D961672958E9D1898EF33998220EFB787080040F7340AE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Attempts to change immutable files 2 IoCs

Modifies inode attributes on the filesystem to allow changing of immutable files.

pid	Process
1823	chattr
1825	chattr

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 64 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	kill

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/22/status	ps
File opened for reading	/proc/716/stat	killall
File opened for reading	/proc/312/stat	ps
File opened for reading	/proc/1742/cmdline	pkill
File opened for reading	/proc/137/stat	killall
File opened for reading	/proc/403/status	ps
File opened for reading	/proc/960/status	ps
File opened for reading	/proc/8/status	ps
File opened for reading	/proc/202/stat	killall
File opened for reading	/proc/171/status	ps
File opened for reading	/proc/497/stat	ps
File opened for reading	/proc/312/status	ps
File opened for reading	/proc/30/status	ps
File opened for reading	/proc/98/cmdline	ps
File opened for reading	/proc/1027/status	pkill
File opened for reading	/proc/653/status	pkill
File opened for reading	/proc/1648/cmdline	ps
File opened for reading	/proc/244/stat	ps
File opened for reading	/proc/1076/status	ps
File opened for reading	/proc/137/cmdline	ps
File opened for reading	/proc/919/cmdline	pkill
File opened for reading	/proc/sys/kernel/osrelease	pkill
File opened for reading	/proc/892/cmdline	pkill
File opened for reading	/proc/716/cmdline	killall
File opened for reading	/proc/956/status	ps
File opened for reading	/proc/312/cmdline	pkill
File opened for reading	/proc/22/cmdline	pkill
File opened for reading	/proc/471/cmdline	pkill
File opened for reading	/proc/89/status	pkill
File opened for reading	/proc/525/cmdline	pkill
File opened for reading	/proc/82/cmdline	pkill
File opened for reading	/proc/sys/kernel/pid_max	ps
File opened for reading	/proc/1609/status	ps
File opened for reading	/proc/647/status	pkill
File opened for reading	/proc/716/stat	ps
File opened for reading	/proc/9/cmdline	ps
File opened for reading	/proc/167/cmdline	pkill
File opened for reading	/proc/1749/cmdline	pkill
File opened for reading	/proc/32/status	pkill
File opened for reading	/proc/1058/cmdline	pkill
File opened for reading	/proc/693/status	pkill
File opened for reading	/proc/549/stat	killall
File opened for reading	/proc/1027/stat	killall
File opened for reading	/proc/1015/cmdline	pkill
File opened for reading	/proc/3/status	pkill
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/448/stat	killall
File opened for reading	/proc/705/cmdline	ps
File opened for reading	/proc/481/cmdline	pkill
File opened for reading	/proc/1239/status	pkill
File opened for reading	/proc/19/status	pkill
File opened for reading	/proc/406/status	pkill
File opened for reading	/proc/1239/cmdline	pkill
File opened for reading	/proc/958/cmdline	pkill
File opened for reading	/proc/900/status	ps
File opened for reading	/proc/78/stat	ps
File opened for reading	/proc/1081/cmdline	pkill
File opened for reading	/proc/203/status	pkill
File opened for reading	/proc/914/cmdline	pkill
File opened for reading	/proc/137/status	pkill
File opened for reading	/proc/163/cmdline	pkill
File opened for reading	/proc/167/cmdline	ps
File opened for reading	/proc/173/stat	ps
File opened for reading	/proc/975/status	pkill

Writes file to tmp directory 4 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/crondpid	init01
File opened for modification	/tmp/ssdpid	init01
File opened for modification	/tmp/syslogspid	init01
File opened for modification	/tmp/.rsync/a/.procs	init01

/tmp/.rsync/a/init01
/tmp/.rsync/a/init01
1⤵
- Writes file to tmp directory
PID:1474
- /bin/rm
  rm /tmp/.cron
  2⤵
  PID:1475
- /bin/rm
  rm "/tmp/Donald*"
  2⤵
  PID:1477
- /bin/rm
  rm "/tmp/Macron*"
  2⤵
  PID:1478
- /bin/rm
  rm /tmp/.main
  2⤵
  PID:1479
- /bin/rm
  rm "/tmp/.yam*" -rf
  2⤵
  PID:1480
- /bin/rm
  rm -f /tmp/irq
  2⤵
  PID:1481
- /bin/rm
  rm -f /tmp/irq.sh
  2⤵
  PID:1482
- /bin/rm
  rm -f /tmp/irqbalanc1
  2⤵
  PID:1483
- /bin/rm
  rm -rf /boot/grub/deamon
  2⤵
  PID:1484
- /bin/rm
  rm -rf /boot/grub/disk_genius
  2⤵
  PID:1486
- /bin/rm
  rm -rf "/tmp/*httpd.conf"
  2⤵
  PID:1487
- /bin/rm
  rm -rf "/tmp/*httpd.conf*"
  2⤵
  PID:1488
- /bin/rm
  rm -rf "/tmp/*index_bak*"
  2⤵
  PID:1489
- /bin/rm
  rm -rf "/tmp/.systemd-private-*"
  2⤵
  PID:1490
- /bin/rm
  rm -rf "/tmp/.xm*"
  2⤵
  PID:1491
- /bin/rm
  rm -rf /tmp/a7b104c270
  2⤵
  PID:1492
- /bin/rm
  rm -rf /tmp/conn
  2⤵
  PID:1493
- /bin/rm
  rm -rf /tmp/conns
  2⤵
  PID:1494
- /bin/rm
  rm -rf /tmp/httpd.conf
  2⤵
  PID:1495
- /bin/rm
  rm -rf "/tmp/java*"
  2⤵
  PID:1496
- /bin/rm
  rm -rf /tmp/kworkerds /bin/kworkerds /bin/config.json /var/tmp/kworkerds /var/tmp/config.json /usr/local/lib/libjdk.so
  2⤵
  PID:1497
- /bin/rm
  rm -rf /tmp/qW3xT.2 /tmp/ddgs.3013 /tmp/ddgs.3012 /tmp/wnTKYg /tmp/2t3ik
  2⤵
  PID:1498
- /bin/rm
  rm -rf /tmp/root.sh /tmp/pools.txt /tmp/libapache /tmp/config.json /tmp/bashf /tmp/bashg /tmp/libapache
  2⤵
  PID:1499
- /bin/rm
  rm -rf "/tmp/xm*"
  2⤵
  PID:1500
- /bin/rm
  rm -rf "/var/tmp/java*"
  2⤵
  PID:1501
- /bin/rm
  rm -rf "~/.redtail"
  2⤵
  PID:1502
- /usr/bin/killall
  killall -9 chron-34e2fg
  2⤵
  PID:1509
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1507
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1518
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1518
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1518
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1518
- - /sbin/kill
    kill -9
    3⤵
    PID:1518
- - /bin/kill
    kill -9
    3⤵
    PID:1518
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1506
- /usr/bin/awk
  awk /34e2fg/
  2⤵
  PID:1504
- /usr/bin/awk
  awk "!/awk/"
  2⤵
  PID:1505
- /bin/ps
  ps auxw
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1503
- /bin/ps
  ps axf -o "pid %cpu"
  2⤵
  PID:1515
- /usr/bin/awk
  awk "{if(\$2>=30.0) print \$1}"
  2⤵
  PID:1516
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1513
- - /usr/local/sbin/kill
    kill -9 1511
    3⤵
    PID:1520
- - /usr/local/bin/kill
    kill -9 1511
    3⤵
    PID:1520
- - /usr/sbin/kill
    kill -9 1511
    3⤵
    PID:1520
- - /usr/bin/kill
    kill -9 1511
    3⤵
    PID:1520
- - /sbin/kill
    kill -9 1511
    3⤵
    PID:1520
- - /bin/kill
    kill -9 1511
    3⤵
    - Reads CPU attributes
    PID:1520
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1512
- /usr/bin/awk
  awk "/34e|r\\/v3|moy5|defunct/"
  2⤵
  - Reads runtime system information
  PID:1511
- /bin/ps
  ps wx
  2⤵
  - Reads CPU attributes
  PID:1510
- /usr/bin/killall
  killall .Historys
  2⤵
  PID:1519
- /usr/bin/killall
  killall neptune
  2⤵
  - Reads runtime system information
  PID:1521
- /usr/bin/killall
  killall xm64
  2⤵
  - Reads runtime system information
  PID:1522
- /usr/bin/killall
  killall xm32
  2⤵
  - Reads runtime system information
  PID:1523
- /usr/bin/killall
  killall ld-linux
  2⤵
  PID:1527
- /usr/bin/killall
  killall xmrig
  2⤵
  - Reads runtime system information
  PID:1528
- /usr/bin/killall
  killall .xmrig
  2⤵
  PID:1529
- /usr/bin/killall
  killall suppoieup
  2⤵
  PID:1530
- /usr/bin/killall
  killall xrx
  2⤵
  PID:1531
- /usr/bin/pkill
  pkill -f sourplum
  2⤵
  - Reads runtime system information
  PID:1532
- /usr/bin/pkill
  pkill wnTKYg
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1533
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1538
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1539
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1539
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1539
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1539
- - /sbin/kill
    kill -9
    3⤵
    PID:1539
- - /bin/kill
    kill -9
    3⤵
    PID:1539
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1537
- /bin/grep
  grep mine.moneropool.com
  2⤵
  PID:1536
- /bin/grep
  grep -v grep
  2⤵
  PID:1535
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  PID:1534
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1544
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1545
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1545
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1545
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1545
- - /sbin/kill
    kill -9
    3⤵
    PID:1545
- - /bin/kill
    kill -9
    3⤵
    PID:1545
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1543
- /bin/grep
  grep xmr.crypto-pool.fr:8080
  2⤵
  PID:1542
- /bin/grep
  grep -v grep
  2⤵
  PID:1541
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1540
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1550
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1551
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1551
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1551
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1551
- - /sbin/kill
    kill -9
    3⤵
    PID:1551
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:1551
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1549
- /bin/grep
  grep xmr.crypto-pool.fr:8080
  2⤵
  PID:1548
- /bin/grep
  grep -v grep
  2⤵
  PID:1547
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1546
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1555
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1556
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1557
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1557
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1557
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1557
- - /sbin/kill
    kill -9
    3⤵
    PID:1557
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:1557
- /bin/grep
  grep 119.9.76.107:443
  2⤵
  PID:1554
- /bin/grep
  grep -v grep
  2⤵
  PID:1553
- /bin/ps
  ps auxf
  2⤵
  - Reads runtime system information
  PID:1552
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1562
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1563
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1563
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1563
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1563
- - /sbin/kill
    kill -9
    3⤵
    PID:1563
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:1563
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1561
- /bin/grep
  grep monerohash.com
  2⤵
  PID:1560
- /bin/grep
  grep -v grep
  2⤵
  PID:1559
- /bin/ps
  ps auxf
  2⤵
  - Reads runtime system information
  PID:1558
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1568
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1569
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1569
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1569
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1569
- - /sbin/kill
    kill -9
    3⤵
    PID:1569
- - /bin/kill
    kill -9
    3⤵
    PID:1569
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1567
- /bin/grep
  grep /tmp/a7b104c270
  2⤵
  PID:1566
- /bin/grep
  grep -v grep
  2⤵
  PID:1565
- /bin/ps
  ps auxf
  2⤵
  PID:1564
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1574
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1575
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1575
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1575
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1575
- - /sbin/kill
    kill -9
    3⤵
    PID:1575
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:1575
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1573
- /bin/grep
  grep xmr.crypto-pool.fr:6666
  2⤵
  PID:1572
- /bin/grep
  grep -v grep
  2⤵
  PID:1571
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  PID:1570
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1580
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1581
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1581
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1581
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1581
- - /sbin/kill
    kill -9
    3⤵
    PID:1581
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:1581
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1579
- /bin/grep
  grep xmr.crypto-pool.fr:7777
  2⤵
  PID:1578
- /bin/grep
  grep -v grep
  2⤵
  PID:1577
- /bin/ps
  ps auxf
  2⤵
  PID:1576
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1585
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1586
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1587
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1587
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1587
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1587
- - /sbin/kill
    kill -9
    3⤵
    PID:1587
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:1587
- /bin/grep
  grep xmr.crypto-pool.fr:443
  2⤵
  PID:1584
- /bin/grep
  grep -v grep
  2⤵
  PID:1583
- /bin/ps
  ps auxf
  2⤵
  - Reads runtime system information
  PID:1582
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1592
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1593
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1593
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1593
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1593
- - /sbin/kill
    kill -9
    3⤵
    PID:1593
- - /bin/kill
    kill -9
    3⤵
    PID:1593
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1591
- /bin/grep
  grep stratum.f2pool.com:8888
  2⤵
  PID:1590
- /bin/grep
  grep -v grep
  2⤵
  PID:1589
- /bin/ps
  ps auxf
  2⤵
  PID:1588
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1598
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1599
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1599
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1599
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1599
- - /sbin/kill
    kill -9
    3⤵
    PID:1599
- - /bin/kill
    kill -9
    3⤵
    PID:1599
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1597
- /bin/grep
  grep xmrpool.eu
  2⤵
  PID:1596
- /bin/grep
  grep -v grep
  2⤵
  PID:1595
- /bin/ps
  ps auxf
  2⤵
  - Reads runtime system information
  PID:1594
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1604
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1605
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1605
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1605
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1605
- - /sbin/kill
    kill -9
    3⤵
    PID:1605
- - /bin/kill
    kill -9
    3⤵
    PID:1605
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1603
- /bin/grep
  grep xmrig
  2⤵
  PID:1602
- /bin/grep
  grep -v grep
  2⤵
  PID:1601
- /bin/ps
  ps auxf
  2⤵
  PID:1600
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1610
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1611
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1611
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1611
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1611
- - /sbin/kill
    kill -9
    3⤵
    PID:1611
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:1611
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1609
- /bin/grep
  grep xmrigDaemon
  2⤵
  PID:1608
- /bin/grep
  grep -v grep
  2⤵
  PID:1607
- /bin/ps
  ps auxf
  2⤵
  - Reads runtime system information
  PID:1606
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1616
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1617
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1617
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1617
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1617
- - /sbin/kill
    kill -9
    3⤵
    PID:1617
- - /bin/kill
    kill -9
    3⤵
    PID:1617
- /bin/grep
  grep xmrigMiner
  2⤵
  PID:1614
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1615
- /bin/grep
  grep -v grep
  2⤵
  PID:1613
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  PID:1612
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1622
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1623
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1623
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1623
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1623
- - /sbin/kill
    kill -9
    3⤵
    PID:1623
- - /bin/kill
    kill -9
    3⤵
    PID:1623
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1621
- /bin/grep
  grep /var/tmp/java
  2⤵
  PID:1620
- /bin/grep
  grep -v grep
  2⤵
  PID:1619
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1618
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1628
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1629
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1629
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1629
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1629
- - /sbin/kill
    kill -9
    3⤵
    PID:1629
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:1629
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1627
- /bin/grep
  grep ddgs
  2⤵
  PID:1626
- /bin/grep
  grep -v grep
  2⤵
  PID:1625
- /bin/ps
  ps auxf
  2⤵
  - Reads runtime system information
  PID:1624
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1634
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1635
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1635
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1635
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1635
- - /sbin/kill
    kill -9
    3⤵
    PID:1635
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:1635
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1633
- /bin/grep
  grep qW3xT
  2⤵
  PID:1632
- /bin/grep
  grep -v grep
  2⤵
  PID:1631
- /bin/ps
  ps auxf
  2⤵
  PID:1630
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1640
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1641
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1641
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1641
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1641
- - /sbin/kill
    kill -9
    3⤵
    PID:1641
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:1641
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1639
- /bin/grep
  grep t00ls.ru
  2⤵
  PID:1638
- /bin/grep
  grep -v grep
  2⤵
  PID:1637
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  PID:1636
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1646
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1647
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1647
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1647
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1647
- - /sbin/kill
    kill -9
    3⤵
    PID:1647
- - /bin/kill
    kill -9
    3⤵
    PID:1647
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1645
- /bin/grep
  grep /var/tmp/sustes
  2⤵
  PID:1644
- /bin/grep
  grep -v grep
  2⤵
  PID:1643
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1642
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1652
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1653
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1653
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1653
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1653
- - /sbin/kill
    kill -9
    3⤵
    PID:1653
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:1653
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1651
- /bin/grep
  grep ld-linux
  2⤵
  PID:1650
- /bin/grep
  grep -v grep
  2⤵
  PID:1649
- /bin/ps
  ps auxf
  2⤵
  - Reads runtime system information
  PID:1648
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1657
- - /usr/local/sbin/kill
    kill -9 1655
    3⤵
    PID:1658
- - /usr/local/bin/kill
    kill -9 1655
    3⤵
    PID:1658
- - /usr/sbin/kill
    kill -9 1655
    3⤵
    PID:1658
- - /usr/bin/kill
    kill -9 1655
    3⤵
    PID:1658
- - /sbin/kill
    kill -9 1655
    3⤵
    PID:1658
- - /bin/kill
    kill -9 1655
    3⤵
    - Reads CPU attributes
    PID:1658
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1656
- /bin/grep
  grep xiaoyao
  2⤵
  PID:1655
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1654
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1662
- - /usr/local/sbin/kill
    kill -9 1660
    3⤵
    PID:1663
- - /usr/local/bin/kill
    kill -9 1660
    3⤵
    PID:1663
- - /usr/sbin/kill
    kill -9 1660
    3⤵
    PID:1663
- - /usr/bin/kill
    kill -9 1660
    3⤵
    PID:1663
- - /sbin/kill
    kill -9 1660
    3⤵
    PID:1663
- - /bin/kill
    kill -9 1660
    3⤵
    - Reads CPU attributes
    PID:1663
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1661
- /bin/grep
  grep Donald
  2⤵
  PID:1660
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1659
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1667
- - /usr/local/sbin/kill
    kill -9 1665
    3⤵
    PID:1668
- - /usr/local/bin/kill
    kill -9 1665
    3⤵
    PID:1668
- - /usr/sbin/kill
    kill -9 1665
    3⤵
    PID:1668
- - /usr/bin/kill
    kill -9 1665
    3⤵
    PID:1668
- - /sbin/kill
    kill -9 1665
    3⤵
    PID:1668
- - /bin/kill
    kill -9 1665
    3⤵
    - Reads CPU attributes
    PID:1668
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1666
- /bin/grep
  grep Macron
  2⤵
  PID:1665
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  PID:1664
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1672
- - /usr/local/sbin/kill
    kill -9 1670
    3⤵
    PID:1674
- - /usr/local/bin/kill
    kill -9 1670
    3⤵
    PID:1674
- - /usr/sbin/kill
    kill -9 1670
    3⤵
    PID:1674
- - /usr/bin/kill
    kill -9 1670
    3⤵
    PID:1674
- - /sbin/kill
    kill -9 1670
    3⤵
    PID:1674
- - /bin/kill
    kill -9 1670
    3⤵
    - Reads CPU attributes
    PID:1674
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1671
- /bin/grep
  grep ld-linux
  2⤵
  PID:1670
- /bin/ps
  ps auxf
  2⤵
  - Reads runtime system information
  PID:1669
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1678
- - /usr/local/sbin/kill
    kill -9 1676
    3⤵
    PID:1679
- - /usr/local/bin/kill
    kill -9 1676
    3⤵
    PID:1679
- - /usr/sbin/kill
    kill -9 1676
    3⤵
    PID:1679
- - /usr/bin/kill
    kill -9 1676
    3⤵
    PID:1679
- - /sbin/kill
    kill -9 1676
    3⤵
    PID:1679
- - /bin/kill
    kill -9 1676
    3⤵
    PID:1679
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1677
- /bin/grep
  grep named
  2⤵
  PID:1676
- /bin/ps
  ps auxf
  2⤵
  PID:1675
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1683
- - /usr/local/sbin/kill
    kill -9 1681
    3⤵
    PID:1684
- - /usr/local/bin/kill
    kill -9 1681
    3⤵
    PID:1684
- - /usr/sbin/kill
    kill -9 1681
    3⤵
    PID:1684
- - /usr/bin/kill
    kill -9 1681
    3⤵
    PID:1684
- - /sbin/kill
    kill -9 1681
    3⤵
    PID:1684
- - /bin/kill
    kill -9 1681
    3⤵
    PID:1684
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1682
- /bin/grep
  grep kernelcfg
  2⤵
  PID:1681
- /bin/ps
  ps auxf
  2⤵
  PID:1680
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1688
- - /usr/local/sbin/kill
    kill -9 1686
    3⤵
    PID:1689
- - /usr/local/bin/kill
    kill -9 1686
    3⤵
    PID:1689
- - /usr/sbin/kill
    kill -9 1686
    3⤵
    PID:1689
- - /usr/bin/kill
    kill -9 1686
    3⤵
    PID:1689
- - /sbin/kill
    kill -9 1686
    3⤵
    PID:1689
- - /bin/kill
    kill -9 1686
    3⤵
    - Reads CPU attributes
    PID:1689
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1687
- /bin/grep
  grep xiaoxue
  2⤵
  PID:1686
- /bin/ps
  ps auxf
  2⤵
  PID:1685
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1693
- - /usr/local/sbin/kill
    kill -9 1691
    3⤵
    PID:1694
- - /usr/local/bin/kill
    kill -9 1691
    3⤵
    PID:1694
- - /usr/sbin/kill
    kill -9 1691
    3⤵
    PID:1694
- - /usr/bin/kill
    kill -9 1691
    3⤵
    PID:1694
- - /sbin/kill
    kill -9 1691
    3⤵
    PID:1694
- - /bin/kill
    kill -9 1691
    3⤵
    PID:1694
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1692
- /bin/grep
  grep kernelupgrade
  2⤵
  PID:1691
- /bin/ps
  ps auxf
  2⤵
  - Reads runtime system information
  PID:1690
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1698
- - /usr/local/sbin/kill
    kill -9 1696
    3⤵
    PID:1699
- - /usr/local/bin/kill
    kill -9 1696
    3⤵
    PID:1699
- - /usr/sbin/kill
    kill -9 1696
    3⤵
    PID:1699
- - /usr/bin/kill
    kill -9 1696
    3⤵
    PID:1699
- - /sbin/kill
    kill -9 1696
    3⤵
    PID:1699
- - /bin/kill
    kill -9 1696
    3⤵
    PID:1699
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1697
- /bin/grep
  grep kernelorg
  2⤵
  PID:1696
- /bin/ps
  ps auxf
  2⤵
  - Reads runtime system information
  PID:1695
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1703
- - /usr/local/sbin/kill
    kill -9 1701
    3⤵
    PID:1704
- - /usr/local/bin/kill
    kill -9 1701
    3⤵
    PID:1704
- - /usr/sbin/kill
    kill -9 1701
    3⤵
    PID:1704
- - /usr/bin/kill
    kill -9 1701
    3⤵
    PID:1704
- - /sbin/kill
    kill -9 1701
    3⤵
    PID:1704
- - /bin/kill
    kill -9 1701
    3⤵
    PID:1704
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1702
- /bin/grep
  grep kernelupdates
  2⤵
  PID:1701
- /bin/ps
  ps auxf
  2⤵
  PID:1700
- /bin/grep
  grep "\\-c"
  2⤵
  PID:1711
- /bin/grep
  grep -v headless
  2⤵
  PID:1710
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1712
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1713
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1713
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1713
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1713
- - /sbin/kill
    kill -9
    3⤵
    PID:1713
- - /bin/kill
    kill -9
    3⤵
    PID:1713
- /bin/grep
  grep -v httpPort
  2⤵
  PID:1709
- /bin/grep
  grep jenkins
  2⤵
  PID:1708
- /bin/grep
  grep lib
  2⤵
  PID:1707
- /bin/grep
  grep var
  2⤵
  PID:1706
- /bin/ps
  ps ax
  2⤵
  PID:1705
- /usr/bin/xargs
  xargs pkill -f
  2⤵
  PID:1716
- - /usr/local/sbin/pkill
    pkill -f
    3⤵
    PID:1717
- - /usr/local/bin/pkill
    pkill -f
    3⤵
    PID:1717
- - /usr/sbin/pkill
    pkill -f
    3⤵
    PID:1717
- - /usr/bin/pkill
    pkill -f
    3⤵
    PID:1717
- /bin/grep
  grep -o "./[0-9]* -c"
  2⤵
  PID:1715
- /bin/ps
  ps ax
  2⤵
  - Reads runtime system information
  PID:1714
- /usr/bin/pkill
  pkill -f /usr/bin/.sshd
  2⤵
  - Reads CPU attributes
  PID:1718
- /usr/bin/pkill
  pkill -f acpid
  2⤵
  - Reads runtime system information
  PID:1719
- /usr/bin/pkill
  pkill -f Donald
  2⤵
  - Reads runtime system information
  PID:1720
- /usr/bin/pkill
  pkill -f Macron
  2⤵
  - Reads runtime system information
  PID:1721
- /usr/bin/pkill
  pkill -f AnXqV.yam
  2⤵
  - Reads CPU attributes
  PID:1722
- /usr/bin/pkill
  pkill -f apaceha
  2⤵
  PID:1723
- /usr/bin/pkill
  pkill -f askdljlqw
  2⤵
  PID:1724
- /usr/bin/pkill
  pkill -f bashe
  2⤵
  PID:1725
- /usr/bin/pkill
  pkill -f bashf
  2⤵
  - Reads runtime system information
  PID:1726
- /usr/bin/pkill
  pkill -f bashg
  2⤵
  - Reads CPU attributes
  PID:1727
- /usr/bin/pkill
  pkill -f bashh
  2⤵
  PID:1728
- /usr/bin/pkill
  pkill -f bashx
  2⤵
  PID:1729
- /usr/bin/pkill
  pkill -f BI5zj
  2⤵
  - Reads runtime system information
  PID:1730
- /usr/bin/pkill
  pkill -f biosetjenkins
  2⤵
  PID:1731
- /usr/bin/pkill
  pkill -f bonn.sh
  2⤵
  - Reads runtime system information
  PID:1732
- /usr/bin/pkill
  pkill -f bonns
  2⤵
  PID:1733
- /usr/bin/pkill
  pkill -f conn.sh
  2⤵
  - Reads CPU attributes
  PID:1734
- /usr/bin/pkill
  pkill -f conns
  2⤵
  - Reads runtime system information
  PID:1735
- /usr/bin/pkill
  pkill -f cryptonight
  2⤵
  - Reads CPU attributes
  PID:1736
- /usr/bin/pkill
  pkill -f crypto-pool
  2⤵
  - Reads CPU attributes
  PID:1737
- /usr/bin/pkill
  pkill -f ddg.2011
  2⤵
  - Reads runtime system information
  PID:1738
- /usr/bin/pkill
  pkill -f deamon
  2⤵
  - Reads runtime system information
  PID:1739
- /usr/bin/pkill
  pkill -f disk_genius
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1740
- /usr/bin/pkill
  pkill -f donns
  2⤵
  PID:1741
- /usr/bin/pkill
  pkill -f Duck.sh
  2⤵
  - Reads runtime system information
  PID:1742
- /usr/bin/pkill
  pkill -f gddr
  2⤵
  PID:1743
- /usr/bin/pkill
  pkill -f Guard.sh
  2⤵
  PID:1744
- /usr/bin/pkill
  pkill -f i586
  2⤵
  - Reads runtime system information
  PID:1745
- /usr/bin/pkill
  pkill -f icb5o
  2⤵
  PID:1746
- /usr/bin/pkill
  pkill -f ir29xc1
  2⤵
  - Reads runtime system information
  PID:1747
- /usr/bin/pkill
  pkill -f irqba2anc1
  2⤵
  PID:1748
- /usr/bin/pkill
  pkill -f irqba5xnc1
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1749
- /usr/bin/pkill
  pkill -f irqbalanc1
  2⤵
  PID:1750
- /usr/bin/pkill
  pkill -f irqbalance
  2⤵
  - Reads runtime system information
  PID:1751
- /usr/bin/pkill
  pkill -f irqbnc1
  2⤵
  - Reads runtime system information
  PID:1752
- /usr/bin/pkill
  pkill -f JnKihGjn
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1753
- /usr/bin/pkill
  pkill -f jweri
  2⤵
  - Reads CPU attributes
  PID:1754
- /usr/bin/pkill
  pkill -f kw.sh
  2⤵
  - Reads CPU attributes
  PID:1755
- /usr/bin/pkill
  pkill -f kworker34
  2⤵
  PID:1756
- /usr/bin/pkill
  pkill -f kxjd
  2⤵
  - Reads CPU attributes
  PID:1757
- /usr/bin/pkill
  pkill -f libapache
  2⤵
  PID:1758
- /usr/bin/pkill
  pkill -f Loopback
  2⤵
  - Reads runtime system information
  PID:1759
- /usr/bin/pkill
  pkill -f lx26
  2⤵
  - Reads runtime system information
  PID:1760
- /usr/bin/pkill
  pkill -f mgwsl
  2⤵
  - Reads CPU attributes
  PID:1761
- /usr/bin/pkill
  pkill -f minerd
  2⤵
  - Reads runtime system information
  PID:1762
- /usr/bin/pkill
  pkill -f minergate
  2⤵
  - Reads CPU attributes
  PID:1763
- /usr/bin/pkill
  pkill -f minexmr
  2⤵
  PID:1764
- /usr/bin/pkill
  pkill -f mixnerdx
  2⤵
  - Reads CPU attributes
  PID:1765
- /usr/bin/pkill
  pkill -f mstxmr
  2⤵
  - Reads CPU attributes
  PID:1766
- /usr/bin/pkill
  pkill -f nanoWatch
  2⤵
  PID:1767
- /usr/bin/pkill
  pkill -f nopxi
  2⤵
  PID:1768
- /usr/bin/pkill
  pkill -f NXLAi
  2⤵
  - Reads runtime system information
  PID:1769
- /usr/bin/pkill
  pkill -f performedl
  2⤵
  - Reads CPU attributes
  PID:1770
- /usr/bin/pkill
  pkill -f polkitd
  2⤵
  - Reads CPU attributes
  PID:1771
- /usr/bin/pkill
  pkill -f pro.sh
  2⤵
  PID:1772
- /usr/bin/pkill
  pkill -f pythno
  2⤵
  PID:1773
- /usr/bin/pkill
  pkill -f qW3xT.2
  2⤵
  - Reads runtime system information
  PID:1774
- /usr/bin/pkill
  pkill -f sourplum
  2⤵
  PID:1775
- /usr/bin/pkill
  pkill -f stratum
  2⤵
  PID:1776
- /usr/bin/pkill
  pkill -f sustes
  2⤵
  - Reads CPU attributes
  PID:1777
- /usr/bin/pkill
  pkill -f wnTKYg
  2⤵
  PID:1778
- /usr/bin/pkill
  pkill -f XbashY
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1779
- /usr/bin/pkill
  pkill -f XJnRj
  2⤵
  PID:1780
- /usr/bin/pkill
  pkill -f xmrig
  2⤵
  - Reads CPU attributes
  PID:1781
- /usr/bin/pkill
  pkill -f xmrigDaemon
  2⤵
  PID:1782
- /usr/bin/pkill
  pkill -f xmrigMiner
  2⤵
  PID:1783
- /usr/bin/pkill
  pkill -f ysaydh
  2⤵
  - Reads CPU attributes
  PID:1784
- /usr/bin/pkill
  pkill -f zigw
  2⤵
  PID:1785
- /usr/bin/pkill
  pkill -f ld-linux
  2⤵
  - Reads CPU attributes
  PID:1786
- /usr/bin/pkill
  pkill -f xrx
  2⤵
  - Reads runtime system information
  PID:1787
- /bin/grep
  grep -v grep
  2⤵
  PID:1790
- /bin/grep
  grep crond
  2⤵
  PID:1789
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1791
- /bin/ps
  ps ax
  2⤵
  PID:1788
- /bin/rm
  rm /tmp/crondpid -f
  2⤵
  PID:1792
- /bin/grep
  grep -v grep
  2⤵
  PID:1795
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1796
- /bin/grep
  grep sshd
  2⤵
  PID:1794
- /bin/ps
  ps ax
  2⤵
  PID:1793
- /bin/grep
  grep -v "%CPU"
  2⤵
  PID:1802
- /bin/sed
  sed -e "s/\\.[0-9]*//g"
  2⤵
  PID:1799
- /bin/ps
  ps -p 556 -o "%cpu"
  2⤵
  PID:1801
- /bin/rm
  rm -f /tmp/ssdpid
  2⤵
  PID:1803
- /bin/grep
  grep -v grep
  2⤵
  PID:1806
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1807
- /bin/grep
  grep syslogs
  2⤵
  PID:1805
- /bin/ps
  ps ax
  2⤵
  PID:1804
- /bin/rm
  rm /tmp/syslogspid -f
  2⤵
  PID:1808
- /bin/grep
  grep "b 22"
  2⤵
  PID:1810
- /usr/bin/awk
  awk "{print \$1,\$5}"
  2⤵
  PID:1811
- /bin/ps
  ps x
  2⤵
  PID:1809
- /bin/cat
  cat .procs
  2⤵
  PID:1812
- /usr/bin/awk
  awk "{print \$1;}"
  2⤵
  PID:1816
- /usr/bin/awk
  awk "{print \$2;}"
  2⤵
  PID:1819
- /usr/bin/wc
  wc -c
  2⤵
  PID:1822
- /usr/bin/chattr
  chattr -iaR /var/tmp/.xrx
  2⤵
  - Attempts to change immutable files
  PID:1823
- /bin/rm
  rm -rf /var/tmp/.xrx
  2⤵
  PID:1824
- /usr/bin/chattr
  chattr -iaR "~/.redtail"
  2⤵
  - Attempts to change immutable files
  PID:1825
- /bin/rm
  rm -rf "~/.redtail"
  2⤵
  PID:1826
- /usr/bin/awk
  awk "{print \$1,\$5}"
  2⤵
  PID:1829
- /bin/grep
  grep "d 22"
  2⤵
  PID:1828
- /bin/ps
  ps x
  2⤵
  PID:1827
- /bin/cat
  cat .procs
  2⤵
  PID:1830
- /usr/bin/awk
  awk "{print \$1;}"
  2⤵
  PID:1834
- /usr/bin/awk
  awk "{print \$2;}"
  2⤵
  PID:1837
- /usr/bin/wc
  wc -c
  2⤵
  PID:1840
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1845
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1846
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1846
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1846
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1846
- - /sbin/kill
    kill -9
    3⤵
    PID:1846
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:1846
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1844
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1843
- /bin/grep
  grep 69.28.55.86:443
  2⤵
  PID:1842
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1851
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1852
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1852
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1852
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1852
- - /sbin/kill
    kill -9
    3⤵
    PID:1852
- - /bin/kill
    kill -9
    3⤵
    PID:1852
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1850
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1849
- /bin/grep
  grep 185.71.65.238
  2⤵
  PID:1848
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1857
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1858
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1858
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1858
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1858
- - /sbin/kill
    kill -9
    3⤵
    PID:1858
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:1858
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1856
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1855
- /bin/grep
  grep 140.82.52.87
  2⤵
  PID:1854
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1863
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1864
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1864
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1864
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1864
- - /sbin/kill
    kill -9
    3⤵
    PID:1864
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:1864
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1862
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1861
- /bin/grep
  grep 119.9.76.107
  2⤵
  PID:1860
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1869
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1870
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1870
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1870
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1870
- - /sbin/kill
    kill -9
    3⤵
    PID:1870
- - /bin/kill
    kill -9
    3⤵
    PID:1870
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1868
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1867
- /bin/grep
  grep :143
  2⤵
  PID:1866
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1875
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1876
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1876
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1876
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1876
- - /sbin/kill
    kill -9
    3⤵
    PID:1876
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:1876
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1874
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1873
- /bin/grep
  grep :2222
  2⤵
  PID:1872
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1881
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1882
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1882
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1882
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1882
- - /sbin/kill
    kill -9
    3⤵
    PID:1882
- - /bin/kill
    kill -9
    3⤵
    PID:1882
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1880
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1879
- /bin/grep
  grep :3333
  2⤵
  PID:1878
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1887
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1888
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1888
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1888
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1888
- - /sbin/kill
    kill -9
    3⤵
    PID:1888
- - /bin/kill
    kill -9
    3⤵
    PID:1888
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1886
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1885
- /bin/grep
  grep :3389
  2⤵
  PID:1884
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1893
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1894
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1894
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1894
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1894
- - /sbin/kill
    kill -9
    3⤵
    PID:1894
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:1894
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1892
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1891
- /bin/grep
  grep :4444
  2⤵
  PID:1890
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1899
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1900
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1900
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1900
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1900
- - /sbin/kill
    kill -9
    3⤵
    PID:1900
- - /bin/kill
    kill -9
    3⤵
    PID:1900
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1898
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1897
- /bin/grep
  grep :5555
  2⤵
  PID:1896
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1905
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1906
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1906
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1906
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1906
- - /sbin/kill
    kill -9
    3⤵
    PID:1906
- - /bin/kill
    kill -9
    3⤵
    PID:1906
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1904
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1903
- /bin/grep
  grep :6666
  2⤵
  PID:1902
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1911
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1912
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1912
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1912
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1912
- - /sbin/kill
    kill -9
    3⤵
    PID:1912
- - /bin/kill
    kill -9
    3⤵
    PID:1912
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1910
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1909
- /bin/grep
  grep :6665
  2⤵
  PID:1908
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1917
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1918
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1918
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1918
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1918
- - /sbin/kill
    kill -9
    3⤵
    PID:1918
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:1918
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1916
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1915
- /bin/grep
  grep :6667
  2⤵
  PID:1914
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1923
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1924
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1924
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1924
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1924
- - /sbin/kill
    kill -9
    3⤵
    PID:1924
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:1924
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1922
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1921
- /bin/grep
  grep :7777
  2⤵
  PID:1920
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1929
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1930
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1930
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1930
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1930
- - /sbin/kill
    kill -9
    3⤵
    PID:1930
- - /bin/kill
    kill -9
    3⤵
    PID:1930
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1928
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1927
- /bin/grep
  grep :8444
  2⤵
  PID:1926
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1935
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1936
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1936
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1936
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1936
- - /sbin/kill
    kill -9
    3⤵
    PID:1936
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:1936
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1934
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1933
- /bin/grep
  grep :3347
  2⤵
  PID:1932
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1941
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1942
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1942
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1942
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1942
- - /sbin/kill
    kill -9
    3⤵
    PID:1942
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:1942
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1940
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1939
- /bin/grep
  grep :14444
  2⤵
  PID:1938
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1947
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1948
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1948
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1948
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1948
- - /sbin/kill
    kill -9
    3⤵
    PID:1948
- - /bin/kill
    kill -9
    3⤵
    PID:1948
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1946
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1945
- /bin/grep
  grep :14433
  2⤵
  PID:1944
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1953
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1954
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1954
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1954
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1954
- - /sbin/kill
    kill -9
    3⤵
    PID:1954
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:1954
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1952
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1951
- /bin/grep
  grep :13531
  2⤵
  PID:1950
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1959
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1960
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1960
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1960
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1960
- - /sbin/kill
    kill -9
    3⤵
    PID:1960
- - /bin/kill
    kill -9
    3⤵
    PID:1960
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1958
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1957
- /bin/grep
  grep 138.199.40.233:9137
  2⤵
  PID:1956
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1965
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1966
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1966
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1966
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1966
- - /sbin/kill
    kill -9
    3⤵
    PID:1966
- - /bin/kill
    kill -9
    3⤵
    PID:1966
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1964
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1963
- /bin/grep
  grep 185.150.117.29
  2⤵
  PID:1962

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.procs

Path /tmp/.rsync/a/.procs
Size 10B
SHA256 9eaa2baf28dab84bb1c218a836ff8c7a179eb8255093021887d9c93c411bba28
MD5 4aca02196c6320232c854058c3222f95
SHA1 1ee9b0771250a54df60014050f7ba16aaa76dac6
SHA512 83066b93b6e65cc9f160a64f2c855433dbd23b257bc4db553b0c786706bb6d63cee380e23ea0710d6fdea4911013fce1fd3787e82607cfaed8f4b81111100e48
MD5 SHA1 SHA512

Submit Download

.procs

Path /tmp/.rsync/a/.procs
Size 10B
SHA256 380b1deb0768d443c89d810425d2a9a83e0a0bb7a680341da2af4844abd46d52
MD5 58759e33592c916a8e440ebd19ceac82
SHA1 4986c1fbc389b221f9a78fc991d42aafbfffd8e2
SHA512 df537aad9e25cd6005f252a78a13745db694c0041430123b4d26633ff8c11dfbc7e7da7593c30c5e20f5a0a2f31fd5db9b0f1cdb5b268be55357c8a57973c133
MD5 SHA1 SHA512

Submit Download

ssdpid

Path /tmp/ssdpid
Size 4B
SHA256 2fbfe464fac08a6c55d7a68a1006c3eb6b113d76bc494647d387a33de306e899
MD5 7bd169bce6fdf4e9ecf4693d920d5c65
SHA1 b0472fbc05aac34e9d5ba26da9b905a81997946e
SHA512 1bd64512ad4663e20b70b83ede6580f88055d6c0dff71476d0da366a86fd1b4092063a2a20602a3c0530392f34c6f2d2df9e1e3c7803c077d3e07739ab7e8d77
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads