82eba36c8ac1613f451333eae4bff558e53cf814938d4b181790644371400eec

Analysis

max time kernel
20s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
22/07/2026, 11:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
.rsync/a/init01
Size 9KB
Sample260722-nc84aaeb43
SHA256 82eba36c8ac1613f451333eae4bff558e53cf814938d4b181790644371400eec
MD5 e8ffc6aac5c2784b10319c25d229a44e
SHA1 0bcdd833c497eebc1cbe003a091142a19f2cbf0c
SHA512 197104ba26107fa8f235e708901a74d9220701721fbff0cac13306b6f1bf50ae0e947846239ec6053ca835d6ee6b0bda1ede6f69ac26f36d8af47d0579bf52f1
SSDEEP 96:97gXuXmR7PofQH8h9GVQbxgeJwI2n2lznGWSKKFZ5W:97xmRbok8hAGbxPz900
TLSH
T1FB123A5F5577FCB9BB52D8A3D961672958E9D1898EF33998220EFB787080040F7340AE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Attempts to change immutable files 2 IoCs

Modifies inode attributes on the filesystem to allow changing of immutable files.

pid	Process
1093	chattr
1095	chattr

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 64 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	kill

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/23/status	pkill
File opened for reading	/proc/285/cmdline	pkill
File opened for reading	/proc/29/cmdline	pkill
File opened for reading	/proc/321/cmdline	ps
File opened for reading	/proc/41/status	pkill
File opened for reading	/proc/filesystems	pkill
File opened for reading	/proc/664/stat	ps
File opened for reading	/proc/28/cmdline	ps
File opened for reading	/proc/134/stat	ps
File opened for reading	/proc/23/stat	ps
File opened for reading	/proc/2/status	ps
File opened for reading	/proc/9/cmdline	pkill
File opened for reading	/proc/15/cmdline	pkill
File opened for reading	/proc/27/cmdline	pkill
File opened for reading	/proc/567/cmdline	pkill
File opened for reading	/proc/107/status	pkill
File opened for reading	/proc/662/status	pkill
File opened for reading	/proc/5/cmdline	pkill
File opened for reading	/proc/22/cmdline	pkill
File opened for reading	/proc/108/cmdline	killall
File opened for reading	/proc/662/cmdline	ps
File opened for reading	/proc/665/status	ps
File opened for reading	/proc/108/status	pkill
File opened for reading	/proc/8/cmdline	pkill
File opened for reading	/proc/637/cmdline	pkill
File opened for reading	/proc/25/cmdline	pkill
File opened for reading	/proc/21/cmdline	pkill
File opened for reading	/proc/9/stat	killall
File opened for reading	/proc/tty/drivers	ps
File opened for reading	/proc/19/status	ps
File opened for reading	/proc/986/status	ps
File opened for reading	/proc/321/cmdline	pkill
File opened for reading	/proc/41/status	pkill
File opened for reading	/proc/14/status	pkill
File opened for reading	/proc/26/cmdline	ps
File opened for reading	/proc/26/status	ps
File opened for reading	/proc/593/status	ps
File opened for reading	/proc/14/stat	ps
File opened for reading	/proc/16/stat	ps
File opened for reading	/proc/23/stat	ps
File opened for reading	/proc/7/status	pkill
File opened for reading	/proc/136/stat	ps
File opened for reading	/proc/582/cmdline	pkill
File opened for reading	/proc/41/status	ps
File opened for reading	/proc/136/stat	ps
File opened for reading	/proc/229/stat	ps
File opened for reading	/proc/287/status	ps
File opened for reading	/proc/42/status	pkill
File opened for reading	/proc/19/status	pkill
File opened for reading	/proc/19/cmdline	pkill
File opened for reading	/proc/679/cmdline	pkill
File opened for reading	/proc/107/cmdline	pkill
File opened for reading	/proc/326/status	pkill
File opened for reading	/proc/3/cmdline	pkill
File opened for reading	/proc/14/status	ps
File opened for reading	/proc/29/stat	ps
File opened for reading	/proc/297/cmdline	ps
File opened for reading	/proc/321/stat	ps
File opened for reading	/proc/815/cmdline	ps
File opened for reading	/proc/594/cmdline	pkill
File opened for reading	/proc/13/cmdline	pkill
File opened for reading	/proc/8/status	ps
File opened for reading	/proc/19/status	pkill
File opened for reading	/proc/3/status	pkill

Writes file to tmp directory 4 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/crondpid	init01
File opened for modification	/tmp/ssdpid	init01
File opened for modification	/tmp/syslogspid	init01
File opened for modification	/tmp/.rsync/a/.procs	init01

/tmp/.rsync/a/init01
/tmp/.rsync/a/init01
1⤵
- Writes file to tmp directory
PID:668
- /bin/rm
  rm /tmp/.cron
  2⤵
  PID:669
- /bin/rm
  rm "/tmp/Donald*"
  2⤵
  PID:671
- /bin/rm
  rm "/tmp/Macron*"
  2⤵
  PID:672
- /bin/rm
  rm /tmp/.main
  2⤵
  PID:673
- /bin/rm
  rm "/tmp/.yam*" -rf
  2⤵
  PID:674
- /bin/rm
  rm -f /tmp/irq
  2⤵
  PID:675
- /bin/rm
  rm -f /tmp/irq.sh
  2⤵
  PID:676
- /bin/rm
  rm -f /tmp/irqbalanc1
  2⤵
  PID:677
- /bin/rm
  rm -rf /boot/grub/deamon
  2⤵
  PID:678
- /bin/rm
  rm -rf /boot/grub/disk_genius
  2⤵
  PID:680
- /bin/rm
  rm -rf "/tmp/*httpd.conf"
  2⤵
  PID:684
- /bin/rm
  rm -rf "/tmp/*httpd.conf*"
  2⤵
  PID:685
- /bin/rm
  rm -rf "/tmp/*index_bak*"
  2⤵
  PID:686
- /bin/rm
  rm -rf "/tmp/.systemd-private-*"
  2⤵
  PID:687
- /bin/rm
  rm -rf "/tmp/.xm*"
  2⤵
  PID:688
- /bin/rm
  rm -rf /tmp/a7b104c270
  2⤵
  PID:689
- /bin/rm
  rm -rf /tmp/conn
  2⤵
  PID:690
- /bin/rm
  rm -rf /tmp/conns
  2⤵
  PID:691
- /bin/rm
  rm -rf /tmp/httpd.conf
  2⤵
  PID:692
- /bin/rm
  rm -rf "/tmp/java*"
  2⤵
  PID:693
- /bin/rm
  rm -rf /tmp/kworkerds /bin/kworkerds /bin/config.json /var/tmp/kworkerds /var/tmp/config.json /usr/local/lib/libjdk.so
  2⤵
  PID:694
- /bin/rm
  rm -rf /tmp/qW3xT.2 /tmp/ddgs.3013 /tmp/ddgs.3012 /tmp/wnTKYg /tmp/2t3ik
  2⤵
  PID:695
- /bin/rm
  rm -rf /tmp/root.sh /tmp/pools.txt /tmp/libapache /tmp/config.json /tmp/bashf /tmp/bashg /tmp/libapache
  2⤵
  PID:696
- /bin/rm
  rm -rf "/tmp/xm*"
  2⤵
  PID:697
- /bin/rm
  rm -rf "/var/tmp/java*"
  2⤵
  PID:698
- /bin/rm
  rm -rf "~/.redtail"
  2⤵
  PID:699
- /usr/bin/awk
  awk /34e2fg/
  2⤵
  PID:701
- /usr/bin/awk
  awk "!/awk/"
  2⤵
  PID:702
- /bin/ps
  ps auxw
  2⤵
  - Reads CPU attributes
  PID:700
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:703
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:704
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:716
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:716
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:716
- - /usr/bin/kill
    kill -9
    3⤵
    PID:716
- - /sbin/kill
    kill -9
    3⤵
    PID:716
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:716
- /usr/bin/killall
  killall -9 chron-34e2fg
  2⤵
  PID:706
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:710
- - /usr/local/sbin/kill
    kill -9 701 708
    3⤵
    PID:717
- - /usr/local/bin/kill
    kill -9 701 708
    3⤵
    PID:717
- - /usr/sbin/kill
    kill -9 701 708
    3⤵
    PID:717
- - /usr/bin/kill
    kill -9 701 708
    3⤵
    PID:717
- - /sbin/kill
    kill -9 701 708
    3⤵
    PID:717
- - /bin/kill
    kill -9 701 708
    3⤵
    PID:717
- /usr/bin/awk
  awk "/34e|r\\/v3|moy5|defunct/"
  2⤵
  PID:708
- /bin/ps
  ps axf -o "pid %cpu"
  2⤵
  - Reads runtime system information
  PID:712
- /bin/ps
  ps wx
  2⤵
  - Reads CPU attributes
  PID:707
- /usr/bin/awk
  awk "{if(\$2>=30.0) print \$1}"
  2⤵
  PID:713
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:709
- /usr/bin/killall
  killall .Historys
  2⤵
  PID:715
- /usr/bin/killall
  killall neptune
  2⤵
  PID:718
- /usr/bin/killall
  killall xm64
  2⤵
  - Reads runtime system information
  PID:719
- /usr/bin/killall
  killall xm32
  2⤵
  PID:720
- /usr/bin/killall
  killall ld-linux
  2⤵
  PID:721
- /usr/bin/killall
  killall xmrig
  2⤵
  PID:722
- /usr/bin/killall
  killall .xmrig
  2⤵
  PID:723
- /usr/bin/killall
  killall suppoieup
  2⤵
  - Reads runtime system information
  PID:724
- /usr/bin/killall
  killall xrx
  2⤵
  PID:725
- /usr/bin/pkill
  pkill -f sourplum
  2⤵
  - Reads CPU attributes
  PID:726
- /usr/bin/pkill
  pkill wnTKYg
  2⤵
  PID:727
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:731
- /bin/grep
  grep mine.moneropool.com
  2⤵
  PID:730
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  PID:728
- /bin/grep
  grep -v grep
  2⤵
  PID:729
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:732
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:733
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:733
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:733
- - /usr/bin/kill
    kill -9
    3⤵
    PID:733
- - /sbin/kill
    kill -9
    3⤵
    PID:733
- - /bin/kill
    kill -9
    3⤵
    PID:733
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:738
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:739
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:739
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:739
- - /usr/bin/kill
    kill -9
    3⤵
    PID:739
- - /sbin/kill
    kill -9
    3⤵
    PID:739
- - /bin/kill
    kill -9
    3⤵
    PID:739
- /bin/grep
  grep xmr.crypto-pool.fr:8080
  2⤵
  PID:736
- /bin/grep
  grep -v grep
  2⤵
  PID:735
- /bin/ps
  ps auxf
  2⤵
  PID:734
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:737
- /bin/grep
  grep xmr.crypto-pool.fr:8080
  2⤵
  PID:742
- /bin/grep
  grep -v grep
  2⤵
  PID:741
- /bin/ps
  ps auxf
  2⤵
  PID:740
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:743
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:744
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:747
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:747
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:747
- - /usr/bin/kill
    kill -9
    3⤵
    PID:747
- - /sbin/kill
    kill -9
    3⤵
    PID:747
- - /bin/kill
    kill -9
    3⤵
    PID:747
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:753
- /bin/grep
  grep 119.9.76.107:443
  2⤵
  PID:752
- /bin/grep
  grep -v grep
  2⤵
  PID:751
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  PID:750
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:754
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:759
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:759
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:759
- - /usr/bin/kill
    kill -9
    3⤵
    PID:759
- - /sbin/kill
    kill -9
    3⤵
    PID:759
- - /bin/kill
    kill -9
    3⤵
    PID:759
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:764
- /bin/grep
  grep monerohash.com
  2⤵
  PID:763
- /bin/ps
  ps auxf
  2⤵
  - Reads runtime system information
  PID:761
- /bin/grep
  grep -v grep
  2⤵
  PID:762
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:765
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:769
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:769
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:769
- - /usr/bin/kill
    kill -9
    3⤵
    PID:769
- - /sbin/kill
    kill -9
    3⤵
    PID:769
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:769
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:776
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:781
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:781
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:781
- - /usr/bin/kill
    kill -9
    3⤵
    PID:781
- - /sbin/kill
    kill -9
    3⤵
    PID:781
- - /bin/kill
    kill -9
    3⤵
    PID:781
- /bin/grep
  grep /tmp/a7b104c270
  2⤵
  PID:774
- /bin/grep
  grep -v grep
  2⤵
  PID:773
- /bin/ps
  ps auxf
  2⤵
  - Reads runtime system information
  PID:772
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:775
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:787
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:792
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:792
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:792
- - /usr/bin/kill
    kill -9
    3⤵
    PID:792
- - /sbin/kill
    kill -9
    3⤵
    PID:792
- - /bin/kill
    kill -9
    3⤵
    PID:792
- /bin/grep
  grep xmr.crypto-pool.fr:6666
  2⤵
  PID:785
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:786
- /bin/ps
  ps auxf
  2⤵
  - Reads runtime system information
  PID:783
- /bin/grep
  grep -v grep
  2⤵
  PID:784
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:798
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:803
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:803
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:803
- - /usr/bin/kill
    kill -9
    3⤵
    PID:803
- - /sbin/kill
    kill -9
    3⤵
    PID:803
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:803
- /bin/grep
  grep xmr.crypto-pool.fr:7777
  2⤵
  PID:796
- /bin/grep
  grep -v grep
  2⤵
  PID:795
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:797
- /bin/ps
  ps auxf
  2⤵
  - Reads runtime system information
  PID:794
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:808
- /bin/grep
  grep xmr.crypto-pool.fr:443
  2⤵
  PID:807
- /bin/grep
  grep -v grep
  2⤵
  PID:806
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:809
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:818
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:818
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:818
- - /usr/bin/kill
    kill -9
    3⤵
    PID:818
- - /sbin/kill
    kill -9
    3⤵
    PID:818
- - /bin/kill
    kill -9
    3⤵
    PID:818
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  PID:805
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:824
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:830
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:830
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:830
- - /usr/bin/kill
    kill -9
    3⤵
    PID:830
- - /sbin/kill
    kill -9
    3⤵
    PID:830
- - /bin/kill
    kill -9
    3⤵
    PID:830
- /bin/grep
  grep -v grep
  2⤵
  PID:821
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:820
- /bin/grep
  grep stratum.f2pool.com:8888
  2⤵
  PID:822
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:823
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:836
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:837
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:837
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:837
- - /usr/bin/kill
    kill -9
    3⤵
    PID:837
- - /sbin/kill
    kill -9
    3⤵
    PID:837
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:837
- /bin/grep
  grep xmrpool.eu
  2⤵
  PID:834
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:832
- /bin/grep
  grep -v grep
  2⤵
  PID:833
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:835
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:843
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:844
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:844
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:844
- - /usr/bin/kill
    kill -9
    3⤵
    PID:844
- - /sbin/kill
    kill -9
    3⤵
    PID:844
- - /bin/kill
    kill -9
    3⤵
    PID:844
- /bin/grep
  grep xmrig
  2⤵
  PID:841
- /bin/grep
  grep -v grep
  2⤵
  PID:840
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:842
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:839
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:849
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:850
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:850
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:850
- - /usr/bin/kill
    kill -9
    3⤵
    PID:850
- - /sbin/kill
    kill -9
    3⤵
    PID:850
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:850
- /bin/grep
  grep xmrigDaemon
  2⤵
  PID:847
- /bin/grep
  grep -v grep
  2⤵
  PID:846
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:845
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:848
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:855
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:856
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:856
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:856
- - /usr/bin/kill
    kill -9
    3⤵
    PID:856
- - /sbin/kill
    kill -9
    3⤵
    PID:856
- - /bin/kill
    kill -9
    3⤵
    PID:856
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:854
- /bin/grep
  grep xmrigMiner
  2⤵
  PID:853
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:851
- /bin/grep
  grep -v grep
  2⤵
  PID:852
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:861
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:862
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:862
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:862
- - /usr/bin/kill
    kill -9
    3⤵
    PID:862
- - /sbin/kill
    kill -9
    3⤵
    PID:862
- - /bin/kill
    kill -9
    3⤵
    PID:862
- /bin/grep
  grep /var/tmp/java
  2⤵
  PID:859
- /bin/grep
  grep -v grep
  2⤵
  PID:858
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:860
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  PID:857
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:868
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:870
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:870
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:870
- - /usr/bin/kill
    kill -9
    3⤵
    PID:870
- - /sbin/kill
    kill -9
    3⤵
    PID:870
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:870
- /bin/grep
  grep -v grep
  2⤵
  PID:865
- /bin/grep
  grep ddgs
  2⤵
  PID:866
- /bin/ps
  ps auxf
  2⤵
  PID:864
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:867
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:875
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:876
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:876
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:876
- - /usr/bin/kill
    kill -9
    3⤵
    PID:876
- - /sbin/kill
    kill -9
    3⤵
    PID:876
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:876
- /bin/grep
  grep qW3xT
  2⤵
  PID:873
- /bin/grep
  grep -v grep
  2⤵
  PID:872
- /bin/ps
  ps auxf
  2⤵
  - Reads runtime system information
  PID:871
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:874
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:881
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:882
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:882
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:882
- - /usr/bin/kill
    kill -9
    3⤵
    PID:882
- - /sbin/kill
    kill -9
    3⤵
    PID:882
- - /bin/kill
    kill -9
    3⤵
    PID:882
- /bin/grep
  grep t00ls.ru
  2⤵
  PID:879
- /bin/ps
  ps auxf
  2⤵
  - Reads runtime system information
  PID:877
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:880
- /bin/grep
  grep -v grep
  2⤵
  PID:878
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:887
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:888
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:888
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:888
- - /usr/bin/kill
    kill -9
    3⤵
    PID:888
- - /sbin/kill
    kill -9
    3⤵
    PID:888
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:888
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:886
- /bin/grep
  grep /var/tmp/sustes
  2⤵
  PID:885
- /bin/grep
  grep -v grep
  2⤵
  PID:884
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  PID:883
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:893
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:898
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:898
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:898
- - /usr/bin/kill
    kill -9
    3⤵
    PID:898
- - /sbin/kill
    kill -9
    3⤵
    PID:898
- - /bin/kill
    kill -9
    3⤵
    PID:898
- /bin/grep
  grep ld-linux
  2⤵
  PID:891
- /bin/grep
  grep -v grep
  2⤵
  PID:890
- /bin/ps
  ps auxf
  2⤵
  PID:889
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:892
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:903
- - /usr/local/sbin/kill
    kill -9 901
    3⤵
    PID:908
- - /usr/local/bin/kill
    kill -9 901
    3⤵
    PID:908
- - /usr/sbin/kill
    kill -9 901
    3⤵
    PID:908
- - /usr/bin/kill
    kill -9 901
    3⤵
    PID:908
- - /sbin/kill
    kill -9 901
    3⤵
    PID:908
- - /bin/kill
    kill -9 901
    3⤵
    PID:908
- /bin/grep
  grep xiaoyao
  2⤵
  PID:901
- /bin/ps
  ps auxf
  2⤵
  PID:900
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:902
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:913
- - /usr/local/sbin/kill
    kill -9 911
    3⤵
    PID:918
- - /usr/local/bin/kill
    kill -9 911
    3⤵
    PID:918
- - /usr/sbin/kill
    kill -9 911
    3⤵
    PID:918
- - /usr/bin/kill
    kill -9 911
    3⤵
    PID:918
- - /sbin/kill
    kill -9 911
    3⤵
    PID:918
- - /bin/kill
    kill -9 911
    3⤵
    PID:918
- /bin/grep
  grep Donald
  2⤵
  PID:911
- /bin/ps
  ps auxf
  2⤵
  - Reads runtime system information
  PID:910
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:912
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:923
- - /usr/local/sbin/kill
    kill -9 921
    3⤵
    PID:928
- - /usr/local/bin/kill
    kill -9 921
    3⤵
    PID:928
- - /usr/sbin/kill
    kill -9 921
    3⤵
    PID:928
- - /usr/bin/kill
    kill -9 921
    3⤵
    PID:928
- - /sbin/kill
    kill -9 921
    3⤵
    PID:928
- - /bin/kill
    kill -9 921
    3⤵
    - Reads CPU attributes
    PID:928
- /bin/grep
  grep Macron
  2⤵
  PID:921
- /bin/ps
  ps auxf
  2⤵
  - Reads runtime system information
  PID:920
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:922
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:933
- - /usr/local/sbin/kill
    kill -9 931
    3⤵
    PID:938
- - /usr/local/bin/kill
    kill -9 931
    3⤵
    PID:938
- - /usr/sbin/kill
    kill -9 931
    3⤵
    PID:938
- - /usr/bin/kill
    kill -9 931
    3⤵
    PID:938
- - /sbin/kill
    kill -9 931
    3⤵
    PID:938
- - /bin/kill
    kill -9 931
    3⤵
    - Reads CPU attributes
    PID:938
- /bin/grep
  grep ld-linux
  2⤵
  PID:931
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:932
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  PID:930
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:944
- - /usr/local/sbin/kill
    kill -9 942
    3⤵
    PID:948
- - /usr/local/bin/kill
    kill -9 942
    3⤵
    PID:948
- - /usr/sbin/kill
    kill -9 942
    3⤵
    PID:948
- - /usr/bin/kill
    kill -9 942
    3⤵
    PID:948
- - /sbin/kill
    kill -9 942
    3⤵
    PID:948
- - /bin/kill
    kill -9 942
    3⤵
    - Reads CPU attributes
    PID:948
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:943
- /bin/grep
  grep named
  2⤵
  PID:942
- /bin/ps
  ps auxf
  2⤵
  PID:941
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:952
- /bin/grep
  grep kernelcfg
  2⤵
  PID:951
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:953
- - /usr/local/sbin/kill
    kill -9 951
    3⤵
    PID:954
- - /usr/local/bin/kill
    kill -9 951
    3⤵
    PID:954
- - /usr/sbin/kill
    kill -9 951
    3⤵
    PID:954
- - /usr/bin/kill
    kill -9 951
    3⤵
    PID:954
- - /sbin/kill
    kill -9 951
    3⤵
    PID:954
- - /bin/kill
    kill -9 951
    3⤵
    PID:954
- /bin/ps
  ps auxf
  2⤵
  PID:950
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:958
- - /usr/local/sbin/kill
    kill -9 956
    3⤵
    PID:959
- - /usr/local/bin/kill
    kill -9 956
    3⤵
    PID:959
- - /usr/sbin/kill
    kill -9 956
    3⤵
    PID:959
- - /usr/bin/kill
    kill -9 956
    3⤵
    PID:959
- - /sbin/kill
    kill -9 956
    3⤵
    PID:959
- - /bin/kill
    kill -9 956
    3⤵
    PID:959
- /bin/grep
  grep xiaoxue
  2⤵
  PID:956
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:955
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:957
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:963
- - /usr/local/sbin/kill
    kill -9 961
    3⤵
    PID:964
- - /usr/local/bin/kill
    kill -9 961
    3⤵
    PID:964
- - /usr/sbin/kill
    kill -9 961
    3⤵
    PID:964
- - /usr/bin/kill
    kill -9 961
    3⤵
    PID:964
- - /sbin/kill
    kill -9 961
    3⤵
    PID:964
- - /bin/kill
    kill -9 961
    3⤵
    PID:964
- /bin/grep
  grep kernelupgrade
  2⤵
  PID:961
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:962
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  PID:960
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:968
- - /usr/local/sbin/kill
    kill -9 966
    3⤵
    PID:969
- - /usr/local/bin/kill
    kill -9 966
    3⤵
    PID:969
- - /usr/sbin/kill
    kill -9 966
    3⤵
    PID:969
- - /usr/bin/kill
    kill -9 966
    3⤵
    PID:969
- - /sbin/kill
    kill -9 966
    3⤵
    PID:969
- - /bin/kill
    kill -9 966
    3⤵
    PID:969
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:967
- /bin/grep
  grep kernelorg
  2⤵
  PID:966
- /bin/ps
  ps auxf
  2⤵
  PID:965
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:973
- - /usr/local/sbin/kill
    kill -9 971
    3⤵
    PID:974
- - /usr/local/bin/kill
    kill -9 971
    3⤵
    PID:974
- - /usr/sbin/kill
    kill -9 971
    3⤵
    PID:974
- - /usr/bin/kill
    kill -9 971
    3⤵
    PID:974
- - /sbin/kill
    kill -9 971
    3⤵
    PID:974
- - /bin/kill
    kill -9 971
    3⤵
    - Reads CPU attributes
    PID:974
- /bin/grep
  grep kernelupdates
  2⤵
  PID:971
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:972
- /bin/ps
  ps auxf
  2⤵
  - Reads runtime system information
  PID:970
- /bin/grep
  grep -v httpPort
  2⤵
  PID:979
- /bin/grep
  grep jenkins
  2⤵
  PID:978
- /bin/grep
  grep lib
  2⤵
  PID:977
- /bin/grep
  grep "\\-c"
  2⤵
  PID:981
- /bin/grep
  grep var
  2⤵
  PID:976
- /bin/ps
  ps ax
  2⤵
  PID:975
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:982
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:983
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:983
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:983
- - /usr/bin/kill
    kill -9
    3⤵
    PID:983
- - /sbin/kill
    kill -9
    3⤵
    PID:983
- - /bin/kill
    kill -9
    3⤵
    PID:983
- /bin/grep
  grep -v headless
  2⤵
  PID:980
- /bin/grep
  grep -o "./[0-9]* -c"
  2⤵
  PID:985
- /bin/ps
  ps ax
  2⤵
  - Reads runtime system information
  PID:984
- /usr/bin/xargs
  xargs pkill -f
  2⤵
  PID:986
- - /usr/local/sbin/pkill
    pkill -f
    3⤵
    PID:987
- - /usr/local/bin/pkill
    pkill -f
    3⤵
    PID:987
- - /usr/sbin/pkill
    pkill -f
    3⤵
    PID:987
- - /usr/bin/pkill
    pkill -f
    3⤵
    - Reads CPU attributes
    PID:987
- /usr/bin/pkill
  pkill -f /usr/bin/.sshd
  2⤵
  PID:988
- /usr/bin/pkill
  pkill -f acpid
  2⤵
  PID:989
- /usr/bin/pkill
  pkill -f Donald
  2⤵
  PID:990
- /usr/bin/pkill
  pkill -f Macron
  2⤵
  - Reads runtime system information
  PID:991
- /usr/bin/pkill
  pkill -f AnXqV.yam
  2⤵
  PID:992
- /usr/bin/pkill
  pkill -f apaceha
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:993
- /usr/bin/pkill
  pkill -f askdljlqw
  2⤵
  PID:994
- /usr/bin/pkill
  pkill -f bashe
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:995
- /usr/bin/pkill
  pkill -f bashf
  2⤵
  - Reads CPU attributes
  PID:996
- /usr/bin/pkill
  pkill -f bashg
  2⤵
  - Reads runtime system information
  PID:997
- /usr/bin/pkill
  pkill -f bashh
  2⤵
  - Reads CPU attributes
  PID:998
- /usr/bin/pkill
  pkill -f bashx
  2⤵
  - Reads CPU attributes
  PID:999
- /usr/bin/pkill
  pkill -f BI5zj
  2⤵
  - Reads runtime system information
  PID:1000
- /usr/bin/pkill
  pkill -f biosetjenkins
  2⤵
  PID:1001
- /usr/bin/pkill
  pkill -f bonn.sh
  2⤵
  - Reads runtime system information
  PID:1002
- /usr/bin/pkill
  pkill -f bonns
  2⤵
  - Reads runtime system information
  PID:1003
- /usr/bin/pkill
  pkill -f conn.sh
  2⤵
  - Reads CPU attributes
  PID:1004
- /usr/bin/pkill
  pkill -f conns
  2⤵
  PID:1005
- /usr/bin/pkill
  pkill -f cryptonight
  2⤵
  PID:1006
- /usr/bin/pkill
  pkill -f crypto-pool
  2⤵
  PID:1007
- /usr/bin/pkill
  pkill -f ddg.2011
  2⤵
  - Reads CPU attributes
  PID:1008
- /usr/bin/pkill
  pkill -f deamon
  2⤵
  - Reads runtime system information
  PID:1009
- /usr/bin/pkill
  pkill -f disk_genius
  2⤵
  - Reads runtime system information
  PID:1010
- /usr/bin/pkill
  pkill -f donns
  2⤵
  PID:1011
- /usr/bin/pkill
  pkill -f Duck.sh
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1012
- /usr/bin/pkill
  pkill -f gddr
  2⤵
  - Reads runtime system information
  PID:1013
- /usr/bin/pkill
  pkill -f Guard.sh
  2⤵
  - Reads CPU attributes
  PID:1014
- /usr/bin/pkill
  pkill -f i586
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1015
- /usr/bin/pkill
  pkill -f icb5o
  2⤵
  - Reads runtime system information
  PID:1016
- /usr/bin/pkill
  pkill -f ir29xc1
  2⤵
  - Reads CPU attributes
  PID:1017
- /usr/bin/pkill
  pkill -f irqba2anc1
  2⤵
  PID:1018
- /usr/bin/pkill
  pkill -f irqba5xnc1
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1019
- /usr/bin/pkill
  pkill -f irqbalanc1
  2⤵
  - Reads runtime system information
  PID:1020
- /usr/bin/pkill
  pkill -f irqbalance
  2⤵
  - Reads CPU attributes
  PID:1021
- /usr/bin/pkill
  pkill -f irqbnc1
  2⤵
  - Reads CPU attributes
  PID:1022
- /usr/bin/pkill
  pkill -f JnKihGjn
  2⤵
  PID:1023
- /usr/bin/pkill
  pkill -f jweri
  2⤵
  - Reads runtime system information
  PID:1024
- /usr/bin/pkill
  pkill -f kw.sh
  2⤵
  - Reads CPU attributes
  PID:1025
- /usr/bin/pkill
  pkill -f kworker34
  2⤵
  - Reads runtime system information
  PID:1026
- /usr/bin/pkill
  pkill -f kxjd
  2⤵
  PID:1027
- /usr/bin/pkill
  pkill -f libapache
  2⤵
  PID:1028
- /usr/bin/pkill
  pkill -f Loopback
  2⤵
  - Reads runtime system information
  PID:1029
- /usr/bin/pkill
  pkill -f lx26
  2⤵
  - Reads runtime system information
  PID:1030
- /usr/bin/pkill
  pkill -f mgwsl
  2⤵
  - Reads runtime system information
  PID:1031
- /usr/bin/pkill
  pkill -f minerd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1032
- /usr/bin/pkill
  pkill -f minergate
  2⤵
  PID:1033
- /usr/bin/pkill
  pkill -f minexmr
  2⤵
  PID:1034
- /usr/bin/pkill
  pkill -f mixnerdx
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1035
- /usr/bin/pkill
  pkill -f mstxmr
  2⤵
  PID:1036
- /usr/bin/pkill
  pkill -f nanoWatch
  2⤵
  - Reads runtime system information
  PID:1037
- /usr/bin/pkill
  pkill -f nopxi
  2⤵
  - Reads CPU attributes
  PID:1038
- /usr/bin/pkill
  pkill -f NXLAi
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1039
- /usr/bin/pkill
  pkill -f performedl
  2⤵
  PID:1040
- /usr/bin/pkill
  pkill -f polkitd
  2⤵
  - Reads runtime system information
  PID:1041
- /usr/bin/pkill
  pkill -f pro.sh
  2⤵
  - Reads runtime system information
  PID:1042
- /usr/bin/pkill
  pkill -f pythno
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1043
- /usr/bin/pkill
  pkill -f qW3xT.2
  2⤵
  - Reads CPU attributes
  PID:1044
- /usr/bin/pkill
  pkill -f sourplum
  2⤵
  PID:1045
- /usr/bin/pkill
  pkill -f stratum
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1046
- /usr/bin/pkill
  pkill -f sustes
  2⤵
  PID:1047
- /usr/bin/pkill
  pkill -f wnTKYg
  2⤵
  - Reads CPU attributes
  PID:1048
- /usr/bin/pkill
  pkill -f XbashY
  2⤵
  - Reads runtime system information
  PID:1049
- /usr/bin/pkill
  pkill -f XJnRj
  2⤵
  PID:1050
- /usr/bin/pkill
  pkill -f xmrig
  2⤵
  - Reads CPU attributes
  PID:1051
- /usr/bin/pkill
  pkill -f xmrigDaemon
  2⤵
  PID:1052
- /usr/bin/pkill
  pkill -f xmrigMiner
  2⤵
  PID:1053
- /usr/bin/pkill
  pkill -f ysaydh
  2⤵
  PID:1054
- /usr/bin/pkill
  pkill -f zigw
  2⤵
  - Reads CPU attributes
  PID:1055
- /usr/bin/pkill
  pkill -f ld-linux
  2⤵
  PID:1056
- /usr/bin/pkill
  pkill -f xrx
  2⤵
  - Reads runtime system information
  PID:1057
- /bin/grep
  grep -v grep
  2⤵
  PID:1060
- /bin/grep
  grep crond
  2⤵
  PID:1059
- /bin/ps
  ps ax
  2⤵
  - Reads runtime system information
  PID:1058
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1061
- /bin/rm
  rm /tmp/crondpid -f
  2⤵
  PID:1062
- /bin/grep
  grep -v grep
  2⤵
  PID:1065
- /bin/grep
  grep sshd
  2⤵
  PID:1064
- /bin/ps
  ps ax
  2⤵
  - Reads runtime system information
  PID:1063
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1066
- /bin/sed
  sed -e "s/\\.[0-9]*//g"
  2⤵
  PID:1069
- /bin/ps
  ps -p 315 -o "%cpu"
  2⤵
  PID:1071
- /bin/grep
  grep -v "%CPU"
  2⤵
  PID:1072
- /bin/rm
  rm -f /tmp/ssdpid
  2⤵
  PID:1073
- /bin/grep
  grep syslogs
  2⤵
  PID:1075
- /bin/ps
  ps ax
  2⤵
  - Reads runtime system information
  PID:1074
- /bin/grep
  grep -v grep
  2⤵
  PID:1076
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1077
- /bin/rm
  rm /tmp/syslogspid -f
  2⤵
  PID:1078
- /bin/grep
  grep "b 22"
  2⤵
  PID:1080
- /bin/ps
  ps x
  2⤵
  - Reads runtime system information
  PID:1079
- /usr/bin/awk
  awk "{print \$1,\$5}"
  2⤵
  PID:1081
- /bin/cat
  cat .procs
  2⤵
  PID:1082
- /usr/bin/awk
  awk "{print \$1;}"
  2⤵
  PID:1086
- /usr/bin/awk
  awk "{print \$2;}"
  2⤵
  PID:1089
- /usr/bin/wc
  wc -c
  2⤵
  PID:1092
- /usr/bin/chattr
  chattr -iaR /var/tmp/.xrx
  2⤵
  - Attempts to change immutable files
  PID:1093
- /bin/rm
  rm -rf /var/tmp/.xrx
  2⤵
  PID:1094
- /usr/bin/chattr
  chattr -iaR "~/.redtail"
  2⤵
  - Attempts to change immutable files
  PID:1095
- /bin/rm
  rm -rf "~/.redtail"
  2⤵
  PID:1096
- /bin/grep
  grep "d 22"
  2⤵
  PID:1098
- /usr/bin/awk
  awk "{print \$1,\$5}"
  2⤵
  PID:1099
- /bin/ps
  ps x
  2⤵
  - Reads CPU attributes
  PID:1097
- /bin/cat
  cat .procs
  2⤵
  PID:1100
- /usr/bin/awk
  awk "{print \$1;}"
  2⤵
  PID:1104
- /usr/bin/awk
  awk "{print \$2;}"
  2⤵
  PID:1107
- /usr/bin/wc
  wc -c
  2⤵
  PID:1110
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1115
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1116
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1116
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1116
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1116
- - /sbin/kill
    kill -9
    3⤵
    PID:1116
- - /bin/kill
    kill -9
    3⤵
    PID:1116
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1113
- /bin/grep
  grep 69.28.55.86:443
  2⤵
  PID:1112
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1114
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1120
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1121
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1122
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1122
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1122
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1122
- - /sbin/kill
    kill -9
    3⤵
    PID:1122
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:1122
- /bin/grep
  grep 185.71.65.238
  2⤵
  PID:1118
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1119
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1127
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1128
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1128
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1128
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1128
- - /sbin/kill
    kill -9
    3⤵
    PID:1128
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:1128
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1125
- /bin/grep
  grep 140.82.52.87
  2⤵
  PID:1124
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1126
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1133
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1134
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1134
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1134
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1134
- - /sbin/kill
    kill -9
    3⤵
    PID:1134
- - /bin/kill
    kill -9
    3⤵
    PID:1134
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1132
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1131
- /bin/grep
  grep 119.9.76.107
  2⤵
  PID:1130
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1138
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1137
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1139
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1140
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1140
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1140
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1140
- - /sbin/kill
    kill -9
    3⤵
    PID:1140
- - /bin/kill
    kill -9
    3⤵
    PID:1140
- /bin/grep
  grep :143
  2⤵
  PID:1136
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1144
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1143
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1145
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1146
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1146
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1146
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1146
- - /sbin/kill
    kill -9
    3⤵
    PID:1146
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:1146
- /bin/grep
  grep :2222
  2⤵
  PID:1142
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1151
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1152
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1152
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1152
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1152
- - /sbin/kill
    kill -9
    3⤵
    PID:1152
- - /bin/kill
    kill -9
    3⤵
    PID:1152
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1150
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1149
- /bin/grep
  grep :3333
  2⤵
  PID:1148
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1157
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1158
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1158
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1158
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1158
- - /sbin/kill
    kill -9
    3⤵
    PID:1158
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:1158
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1156
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1155
- /bin/grep
  grep :3389
  2⤵
  PID:1154
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1163
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1164
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1164
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1164
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1164
- - /sbin/kill
    kill -9
    3⤵
    PID:1164
- - /bin/kill
    kill -9
    3⤵
    PID:1164
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1161
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1162
- /bin/grep
  grep :4444
  2⤵
  PID:1160
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1168
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1167
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1169
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1170
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1170
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1170
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1170
- - /sbin/kill
    kill -9
    3⤵
    PID:1170
- - /bin/kill
    kill -9
    3⤵
    PID:1170
- /bin/grep
  grep :5555
  2⤵
  PID:1166
- /bin/grep
  grep :6666
  2⤵
  PID:1172
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1174
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1175
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1176
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1176
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1176
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1176
- - /sbin/kill
    kill -9
    3⤵
    PID:1176
- - /bin/kill
    kill -9
    3⤵
    PID:1176
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1173
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1180
- /bin/grep
  grep :6665
  2⤵
  PID:1178
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1179
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1181
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1182
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1182
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1182
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1182
- - /sbin/kill
    kill -9
    3⤵
    PID:1182
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:1182
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1186
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1185
- /bin/grep
  grep :6667
  2⤵
  PID:1184
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1187
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1188
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1188
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1188
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1188
- - /sbin/kill
    kill -9
    3⤵
    PID:1188
- - /bin/kill
    kill -9
    3⤵
    PID:1188
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1191
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1192
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1193
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1194
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1194
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1194
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1194
- - /sbin/kill
    kill -9
    3⤵
    PID:1194
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:1194
- /bin/grep
  grep :7777
  2⤵
  PID:1190
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1198
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1197
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1199
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1200
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1200
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1200
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1200
- - /sbin/kill
    kill -9
    3⤵
    PID:1200
- - /bin/kill
    kill -9
    3⤵
    PID:1200
- /bin/grep
  grep :8444
  2⤵
  PID:1196
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1204
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1203
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1205
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1206
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1206
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1206
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1206
- - /sbin/kill
    kill -9
    3⤵
    PID:1206
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:1206
- /bin/grep
  grep :3347
  2⤵
  PID:1202
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1211
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1212
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1212
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1212
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1212
- - /sbin/kill
    kill -9
    3⤵
    PID:1212
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:1212
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1210
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1209
- /bin/grep
  grep :14444
  2⤵
  PID:1208
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1217
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1218
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1218
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1218
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1218
- - /sbin/kill
    kill -9
    3⤵
    PID:1218
- - /bin/kill
    kill -9
    3⤵
    PID:1218
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1216
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1215
- /bin/grep
  grep :14433
  2⤵
  PID:1214
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1223
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1224
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1224
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1224
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1224
- - /sbin/kill
    kill -9
    3⤵
    PID:1224
- - /bin/kill
    kill -9
    3⤵
    PID:1224
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1222
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1221
- /bin/grep
  grep :13531
  2⤵
  PID:1220
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1228
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1227
- /bin/grep
  grep 138.199.40.233:9137
  2⤵
  PID:1226
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1229
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1230
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1230
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1230
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1230
- - /sbin/kill
    kill -9
    3⤵
    PID:1230
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:1230
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1235
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1236
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1236
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1236
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1236
- - /sbin/kill
    kill -9
    3⤵
    PID:1236
- - /bin/kill
    kill -9
    3⤵
    PID:1236
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1234
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1233
- /bin/grep
  grep 185.150.117.29
  2⤵
  PID:1232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.procs

Path /tmp/.rsync/a/.procs
Size 10B
SHA256 dd680f584de857d55f227ecf1b240e9e5ebad28415090b8eb7678c56fe2cfe76
MD5 ba1d85e9400e3c8e821abfb4d3fc2c55
SHA1 59d947e80b3dd3b0964fb02c5fecae2bfbfd5167
SHA512 210c77033a709aea73798aaf8d8a891823ab2c7d80ec14c7179f45edfcb74ffee54a686fab375d2f1838fe6344f1de86ecd9e82e5ea62f0bdc65e767de9df01e
MD5 SHA1 SHA512

Submit Download

.procs

Path /tmp/.rsync/a/.procs
Size 10B
SHA256 d6a7df4bc64b073c2b10a8212f9b6d573f0fd99efdf9cb2dd9d8a82cd7f50d75
MD5 988e8cdc1a7ed18ad86a0191be3410b7
SHA1 60e466ceeb0a9c9e6912e5253c3d4b561d2655b6
SHA512 3f61b77e724a372e336c94f7913e813ff7756d67b708fa13f94ef4ba0d3850a0e3c3513ea32e581004830f35dce1ac14ba48150c068be26391d475a6f3a3142f
MD5 SHA1 SHA512

Submit Download

ssdpid

Path /tmp/ssdpid
Size 4B
SHA256 2f7b41c34cd42b7beb8865fca85ef9d67d5993725d8a8e94579a45e40eaa911d
MD5 0d96f49fdbbfecd236f36b3df4608c69
SHA1 7c49dcae84babae3cf6390783cc6d902395afeb0
SHA512 fa02c247650e33d4006b966214beb2323d31d2502ba303ae80b80f6b61072dbeac97bf7d0eebe1737ba1ca4b7bfdb263cd5bdd8650b2e3defc5bf864c089e74f
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads