292ac9eec4431164f96e0b58f37065ceb4785745c6339bf2bfa0ae722cef3a0d

Analysis

max time kernel
14s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
03/08/2026, 14:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
292ac9eec4431164f96e0b58f37065ceb4785745c6339bf2bfa0ae722cef3a0d_from_65.49.27.190_pgcopy.bin.sh
Size 4KB
Sample260803-razzdastd1
SHA256 292ac9eec4431164f96e0b58f37065ceb4785745c6339bf2bfa0ae722cef3a0d
MD5 8c548fc736fb23bcae42baf73f0f7c2a
SHA1 4aa9b81a99828882bf566a499096a61ac41a3f4a
SHA512 d5e1443dd29e73b39b431346bc06c0cc336cd31b35d05f8ec16140220dcddd3141f749f4db7430792900d8dcfed9c20d9ffb6636cebc6578874397b94081ed6c
SSDEEP 96:eSaLaZaZagaLfoi8THN6Zx8YjiRa9aAaTMajka6MfPcyZPsqtstCgrA:eS8OSPefo1hc8MiYMrTPr67qtstCgrA
TLSH
T19381318D9062FC793CA5C85AD8817248644FF18781F33FA8B9127E3C2FE4145F6695AE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.gHqjo4	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Discovers running processes 1 TTPs 6 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
672	ps
687	ps
696	ps
702	ps
707	ps
712	ps

Reads CPU attributes 1 TTPs 38 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	ps

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/10/status	ps
File opened for reading	/proc/14/status	ps
File opened for reading	/proc/108/status	pkill
File opened for reading	/proc/20/cmdline	pkill
File opened for reading	/proc/600/stat	ps
File opened for reading	/proc/29/cmdline	pkill
File opened for reading	/proc/578/cmdline	pkill
File opened for reading	/proc/107/cmdline	pkill
File opened for reading	/proc/342/stat	ps
File opened for reading	/proc/22/cmdline	ps
File opened for reading	/proc/25/stat	ps
File opened for reading	/proc/43/cmdline	ps
File opened for reading	/proc/687/status	ps
File opened for reading	/proc/42/cmdline	pkill
File opened for reading	/proc/138/cmdline	pkill
File opened for reading	/proc/28/cmdline	pkill
File opened for reading	/proc/107/exe	grep
File opened for reading	/proc/292/stat	ps
File opened for reading	/proc/9/status	pkill
File opened for reading	/proc/25/cmdline	pkill
File opened for reading	/proc/689/cmdline	ps
File opened for reading	/proc/306/cmdline	ps
File opened for reading	/proc/107/status	pkill
File opened for reading	/proc/19/status	pkill
File opened for reading	/proc/28/status	pkill
File opened for reading	/proc/599/status	pgrep
File opened for reading	/proc/342/stat	ps
File opened for reading	/proc/648/status	ps
File opened for reading	/proc/1/cmdline	pkill
File opened for reading	/proc/645/cmdline	pkill
File opened for reading	/proc/5/cmdline	ps
File opened for reading	/proc/876/status	pkill
File opened for reading	/proc/9/status	pkill
File opened for reading	/proc/14/status	pkill
File opened for reading	/proc/17/cmdline	pkill
File opened for reading	/proc/645/status	pkill
File opened for reading	/proc/656/stat	ps
File opened for reading	/proc/591/status	ps
File opened for reading	/proc/147/cmdline	ps
File opened for reading	/proc/17/status	pkill
File opened for reading	/proc/24/cmdline	pkill
File opened for reading	/proc/645/status	pkill
File opened for reading	/proc/17/cmdline	pkill
File opened for reading	/proc/28/cmdline	ps
File opened for reading	/proc/19/cmdline	ps
File opened for reading	/proc/107/cmdline	pkill
File opened for reading	/proc/168/cmdline	pkill
File opened for reading	/proc/599/status	pkill
File opened for reading	/proc/157/status	pgrep
File opened for reading	/proc/16/cmdline	pkill
File opened for reading	/proc/4/cmdline	ps
File opened for reading	/proc/600/cmdline	pkill
File opened for reading	/proc/578/status	pkill
File opened for reading	/proc/859/cmdline	pkill
File opened for reading	/proc/652/stat	ps
File opened for reading	/proc/645/stat	ps
File opened for reading	/proc/76/status	pkill
File opened for reading	/proc/98/status	pkill
File opened for reading	/proc/11/status	pkill
File opened for reading	/proc/107/status	pkill
File opened for reading	/proc/314/cmdline	pkill
File opened for reading	/proc/292/status	ps
File opened for reading	/proc/600/status	pkill
File opened for reading	/proc/653/status	ps

Writes file to tmp directory 4 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/~/.bashrc	292ac9eec4431164f96e0b58f37065ceb4785745c6339bf2bfa0ae722cef3a0d_from_65.49.27.190_pgcopy.bin.sh
File opened for modification	/tmp/~/.bash_profile	292ac9eec4431164f96e0b58f37065ceb4785745c6339bf2bfa0ae722cef3a0d_from_65.49.27.190_pgcopy.bin.sh
File opened for modification	/tmp/~/.profile	292ac9eec4431164f96e0b58f37065ceb4785745c6339bf2bfa0ae722cef3a0d_from_65.49.27.190_pgcopy.bin.sh
File opened for modification	/tmp/~/.ssh/authorized_keys	292ac9eec4431164f96e0b58f37065ceb4785745c6339bf2bfa0ae722cef3a0d_from_65.49.27.190_pgcopy.bin.sh

/tmp/292ac9eec4431164f96e0b58f37065ceb4785745c6339bf2bfa0ae722cef3a0d_from_65.49.27.190_pgcopy.bin.sh
/tmp/292ac9eec4431164f96e0b58f37065ceb4785745c6339bf2bfa0ae722cef3a0d_from_65.49.27.190_pgcopy.bin.sh
1⤵
- Writes file to tmp directory
PID:656
- /bin/rm
  rm -f /tmp/. /tmp/.. /tmp/.ICE-unix /tmp/.Test-unix /tmp/.X11-unix /tmp/.XIM-unix /tmp/.font-unix
  2⤵
  PID:657
- /bin/rm
  rm -f /tmp/292ac9eec4431164f96e0b58f37065ceb4785745c6339bf2bfa0ae722cef3a0d_from_65.49.27.190_pgcopy.bin.sh /tmp/systemd-private-e894c3e5ca7843bbaee6098a8ffda9e6-systemd-timedated.service-13TT4F
  2⤵
  PID:661
- /bin/rm
  rm -rf xmrig-6.24.0
  2⤵
  PID:663
- /bin/rm
  rm -rf "/app/web/xmrig*"
  2⤵
  PID:666
- /bin/rm
  rm -f /app/web/.log
  2⤵
  PID:669
- /bin/grep
  grep ldr.sh
  2⤵
  PID:674
- /bin/grep
  grep -v grep
  2⤵
  PID:673
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:672
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:675
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:677
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:690
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:691
- /bin/grep
  grep -v grep
  2⤵
  PID:688
- /bin/grep
  grep "xmrig\\|kworker_ds"
  2⤵
  PID:689
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:687
- /bin/grep
  grep /app/web/guard.js
  2⤵
  PID:698
- /bin/grep
  grep -v grep
  2⤵
  PID:697
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:699
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:696
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:700
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:706
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:705
- /bin/grep
  grep "kdevtmpfsi\\|auto.c3pool"
  2⤵
  PID:704
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:702
- /bin/grep
  grep -v grep
  2⤵
  PID:703
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:710
- /bin/grep
  grep "sh -s kthreaddo"
  2⤵
  PID:709
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:711
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:707
- /bin/grep
  grep -v grep
  2⤵
  PID:708
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:715
- /bin/grep
  grep -v grep
  2⤵
  PID:713
- /bin/grep
  grep "node /var/tmp/\\|node /tmp/"
  2⤵
  PID:714
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:712
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:716
- /bin/rm
  rm -rf "~/moneroocean"
  2⤵
  PID:717
- /bin/readlink
  readlink -f /proc/10/exe
  2⤵
  PID:718
- /bin/readlink
  readlink -f /proc/105/exe
  2⤵
  PID:719
- /bin/readlink
  readlink -f /proc/107/exe
  2⤵
  PID:720
- /bin/readlink
  readlink -f /proc/108/exe
  2⤵
  PID:721
- /bin/readlink
  readlink -f /proc/11/exe
  2⤵
  PID:722
- /bin/readlink
  readlink -f /proc/12/exe
  2⤵
  PID:723
- /bin/readlink
  readlink -f /proc/13/exe
  2⤵
  PID:724
- /bin/readlink
  readlink -f /proc/137/exe
  2⤵
  PID:725
- /bin/readlink
  readlink -f /proc/138/exe
  2⤵
  PID:726
- /bin/readlink
  readlink -f /proc/14/exe
  2⤵
  PID:727
- /bin/readlink
  readlink -f /proc/147/exe
  2⤵
  PID:728
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:730
- /bin/readlink
  readlink -f /proc/15/exe
  2⤵
  PID:731
- /bin/readlink
  readlink -f /proc/157/exe
  2⤵
  PID:732
- /bin/readlink
  readlink -f /proc/159/exe
  2⤵
  PID:733
- /bin/readlink
  readlink -f /proc/16/exe
  2⤵
  PID:734
- /bin/readlink
  readlink -f /proc/168/exe
  2⤵
  PID:735
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:737
- /bin/readlink
  readlink -f /proc/17/exe
  2⤵
  PID:738
- /bin/readlink
  readlink -f /proc/18/exe
  2⤵
  PID:739
- /bin/readlink
  readlink -f /proc/19/exe
  2⤵
  PID:740
- /bin/readlink
  readlink -f /proc/2/exe
  2⤵
  PID:741
- /bin/readlink
  readlink -f /proc/20/exe
  2⤵
  PID:742
- /bin/readlink
  readlink -f /proc/21/exe
  2⤵
  PID:743
- /bin/readlink
  readlink -f /proc/22/exe
  2⤵
  PID:744
- /bin/readlink
  readlink -f /proc/23/exe
  2⤵
  PID:745
- /bin/readlink
  readlink -f /proc/233/exe
  2⤵
  PID:746
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:748
- /bin/readlink
  readlink -f /proc/24/exe
  2⤵
  PID:749
- /bin/readlink
  readlink -f /proc/25/exe
  2⤵
  PID:750
- /bin/readlink
  readlink -f /proc/26/exe
  2⤵
  PID:751
- /bin/readlink
  readlink -f /proc/27/exe
  2⤵
  PID:752
- /bin/readlink
  readlink -f /proc/28/exe
  2⤵
  PID:753
- /bin/readlink
  readlink -f /proc/29/exe
  2⤵
  PID:754
- /bin/readlink
  readlink -f /proc/292/exe
  2⤵
  PID:755
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:757
- /bin/readlink
  readlink -f /proc/3/exe
  2⤵
  PID:758
- /bin/readlink
  readlink -f /proc/301/exe
  2⤵
  PID:759
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:761
- /bin/readlink
  readlink -f /proc/306/exe
  2⤵
  PID:762
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:764
- /bin/readlink
  readlink -f /proc/312/exe
  2⤵
  PID:765
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:767
- /bin/readlink
  readlink -f /proc/314/exe
  2⤵
  PID:768
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:770
- /bin/readlink
  readlink -f /proc/316/exe
  2⤵
  PID:771
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:773
- /bin/readlink
  readlink -f /proc/332/exe
  2⤵
  PID:776
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:778
- /bin/readlink
  readlink -f /proc/334/exe
  2⤵
  PID:780
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:783
- /bin/readlink
  readlink -f /proc/342/exe
  2⤵
  PID:784
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:787
- /bin/readlink
  readlink -f /proc/4/exe
  2⤵
  PID:789
- /bin/readlink
  readlink -f /proc/41/exe
  2⤵
  PID:791
- /bin/readlink
  readlink -f /proc/42/exe
  2⤵
  PID:792
- /bin/readlink
  readlink -f /proc/43/exe
  2⤵
  PID:794
- /bin/readlink
  readlink -f /proc/5/exe
  2⤵
  PID:795
- /bin/readlink
  readlink -f /proc/578/exe
  2⤵
  PID:797
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:800
- /bin/readlink
  readlink -f /proc/591/exe
  2⤵
  PID:801
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:804
- /bin/readlink
  readlink -f /proc/593/exe
  2⤵
  PID:806
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:809
- /bin/readlink
  readlink -f /proc/599/exe
  2⤵
  PID:811
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:813
- /bin/readlink
  readlink -f /proc/6/exe
  2⤵
  PID:815
- /bin/readlink
  readlink -f /proc/600/exe
  2⤵
  PID:817
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:819
- /bin/readlink
  readlink -f /proc/644/exe
  2⤵
  PID:821
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:824
- /bin/readlink
  readlink -f /proc/645/exe
  2⤵
  PID:825
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:828
- /bin/readlink
  readlink -f /proc/648/exe
  2⤵
  PID:830
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:833
- /bin/readlink
  readlink -f /proc/652/exe
  2⤵
  PID:835
- /bin/readlink
  readlink -f /proc/653/exe
  2⤵
  PID:836
- /bin/readlink
  readlink -f /proc/654/exe
  2⤵
  PID:837
- /bin/readlink
  readlink -f /proc/656/exe
  2⤵
  PID:839
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:842
- /bin/readlink
  readlink -f /proc/659/exe
  2⤵
  PID:843
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:846
- /bin/readlink
  readlink -f /proc/671/exe
  2⤵
  PID:848
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:851
- /bin/readlink
  readlink -f /proc/694/exe
  2⤵
  PID:853
- /bin/readlink
  readlink -f /proc/7/exe
  2⤵
  PID:854
- /bin/readlink
  readlink -f /proc/76/exe
  2⤵
  PID:855
- /bin/readlink
  readlink -f /proc/8/exe
  2⤵
  PID:857
- /bin/readlink
  readlink -f /proc/9/exe
  2⤵
  PID:861
- /bin/readlink
  readlink -f /proc/98/exe
  2⤵
  PID:862
- /usr/bin/pkill
  pkill JavaUpdate
  2⤵
  - Reads CPU attributes
  PID:864
- /usr/bin/pkill
  pkill SSHD2
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:870
- /usr/bin/pkill
  pkill -f /var/tmp/.bin
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:873
- /bin/chmod
  chmod +w /var/tmp/.bin
  2⤵
  PID:877
- /usr/bin/touch
  touch /var/tmp/.bin
  2⤵
  PID:879
- /usr/bin/pkill
  pkill mysqlserver
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:880
- /usr/bin/pkill
  pkill gitlab-redis
  2⤵
  - Reads CPU attributes
  PID:881
- /usr/bin/pkill
  pkill ksoftriqd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:883
- /bin/rm
  rm -f /dev/shm/duet/app
  2⤵
  PID:884
- /bin/mkdir
  mkdir /dev/shm/duet/app
  2⤵
  PID:885
- /bin/rm
  rm -rf /home/opc/.acme.sh
  2⤵
  PID:886
- /bin/mkdir
  mkdir /home/opc/.acme.sh
  2⤵
  PID:887
- /usr/bin/pkill
  pkill -9 masscan
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:888
- /usr/bin/pkill
  pkill -9 kthreaddi
  2⤵
  - Reads CPU attributes
  PID:889
- /usr/bin/pkill
  pkill -9 sysguard
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:890
- /usr/bin/pkill
  pkill -9 kthreaddk
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:891
- /usr/bin/pkill
  pkill -9 kdevtmpfsi
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:892
- /usr/bin/pkill
  pkill -9 networkservice
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:893
- /usr/bin/pkill
  pkill -9 sysupdate
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:894
- /usr/bin/pkill
  pkill -9 phpguard
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:895
- /usr/bin/pkill
  pkill -9 phpupdate
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:896
- /usr/bin/pkill
  pkill -9 networkmanager
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:897
- /usr/bin/pkill
  pkill -9 knthread
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:898
- /usr/bin/pkill
  pkill -9 mysqlserver
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:899
- /usr/bin/pkill
  pkill -9 watchbog
  2⤵
  - Reads CPU attributes
  PID:900
- /usr/bin/pkill
  pkill -9 xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:901
- /usr/bin/pkill
  pkill -9 -f /dev/shm
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:902
- /usr/bin/pkill
  pkill -9 bashirc
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:905
- /bin/chmod
  chmod -w "~/.bash_history"
  2⤵
  PID:908
- /usr/bin/chattr
  chattr +i "~/.bash_history"
  2⤵
  PID:909
- /bin/mkdir
  mkdir "~/.ssh"
  2⤵
  PID:912
- /bin/chmod
  chmod -w "~/.ssh/authorized_keys"
  2⤵
  PID:913
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:916
- /usr/bin/pgrep
  pgrep pbotbyjanhotzu
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:915
- /bin/grep
  grep :10032
  2⤵
  PID:921
- /bin/sed
  sed -e "s/\\/.*//g"
  2⤵
  PID:923
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:922
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:924
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:925
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:925
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:925
- - /usr/bin/kill
    kill -9
    3⤵
    PID:925
- - /sbin/kill
    kill -9
    3⤵
    PID:925
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:925
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:932
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:934
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:934
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:934
- - /usr/bin/kill
    kill -9
    3⤵
    PID:934
- - /sbin/kill
    kill -9
    3⤵
    PID:934
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:934
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:930
- /bin/grep
  grep :5555
  2⤵
  PID:929
- /bin/sed
  sed -e "s/\\/.*//g"
  2⤵
  PID:931
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:940
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:942
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:942
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:942
- - /usr/bin/kill
    kill -9
    3⤵
    PID:942
- - /sbin/kill
    kill -9
    3⤵
    PID:942
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:942
- /bin/sed
  sed -e "s/\\/.*//g"
  2⤵
  PID:939
- /bin/grep
  grep :33331
  2⤵
  PID:937
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:938
- /bin/sed
  sed -e "s/\\/.*//g"
  2⤵
  PID:947
- /bin/grep
  grep :13333
  2⤵
  PID:945
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:949
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:951
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:951
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:951
- - /usr/bin/kill
    kill -9
    3⤵
    PID:951
- - /sbin/kill
    kill -9
    3⤵
    PID:951
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:951
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:946
- /bin/grep
  grep :17777
  2⤵
  PID:954
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:957
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:960
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:960
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:960
- - /usr/bin/kill
    kill -9
    3⤵
    PID:960
- - /sbin/kill
    kill -9
    3⤵
    PID:960
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:960
- /bin/sed
  sed -e "s/\\/.*//g"
  2⤵
  PID:956
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:955
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:967
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:969
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:969
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:969
- - /usr/bin/kill
    kill -9
    3⤵
    PID:969
- - /sbin/kill
    kill -9
    3⤵
    PID:969
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:969
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:965
- /bin/grep
  grep :3333
  2⤵
  PID:964
- /bin/sed
  sed -e "s/\\/.*//g"
  2⤵
  PID:966
- /usr/bin/pkill
  pkill kinsing
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:972
- /usr/bin/pkill
  pkill -9 zgrab
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:975
- /bin/grep
  grep -q https://pastebin.com/raw/xseN2LwV
  2⤵
  PID:980
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:979
- /usr/bin/crontab
  crontab -r
  2⤵
  PID:982
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:984
- /bin/grep
  grep rediserver
  2⤵
  PID:986
- /bin/grep
  grep -v "grep\\|\\["
  2⤵
  PID:987
- /bin/ps
  ps -fe
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:985
- /bin/rm
  rm -rf /tmp/. /tmp/.. /tmp/.ICE-unix /tmp/.Test-unix /tmp/.X11-unix /tmp/.XIM-unix /tmp/.font-unix
  2⤵
  PID:988
- /bin/rm
  rm -rf /tmp/systemd-private-e894c3e5ca7843bbaee6098a8ffda9e6-systemd-timedated.service-13TT4F
  2⤵
  PID:989
- /bin/rm
  rm -rf /var/tmp/systemd-private-e894c3e5ca7843bbaee6098a8ffda9e6-systemd-timedated.service-a6XY48
  2⤵
  PID:990
- /bin/ls
  ls /proc
  2⤵
  PID:992
- /bin/grep
  grep "[0-9]"
  2⤵
  PID:993
- /bin/grep
  grep rediserver
  2⤵
  PID:995
- /bin/ls
  ls -al /proc/1
  2⤵
  PID:994
- /bin/grep
  grep -a donate-level /proc/1/exe
  2⤵
  PID:996
- /bin/grep
  grep exe
  2⤵
  PID:998
- /bin/grep
  grep "/var/lib/postgresql|/var/tmp\\|/tmp\\|/dev/shm\\|deleted"
  2⤵
  PID:999
- /bin/ls
  ls -al /proc/1
  2⤵
  PID:997
- /bin/grep
  grep rediserver
  2⤵
  PID:1001
- /bin/ls
  ls -al /proc/10
  2⤵
  PID:1000
- /bin/grep
  grep -a donate-level /proc/10/exe
  2⤵
  PID:1002
- /bin/grep
  grep exe
  2⤵
  PID:1004
- /bin/grep
  grep "/var/lib/postgresql|/var/tmp\\|/tmp\\|/dev/shm\\|deleted"
  2⤵
  PID:1005
- /bin/ls
  ls -al /proc/10
  2⤵
  PID:1003
- /bin/ls
  ls -al /proc/105
  2⤵
  PID:1006
- /bin/grep
  grep rediserver
  2⤵
  PID:1007
- /bin/grep
  grep -a donate-level /proc/105/exe
  2⤵
  PID:1008
- /bin/grep
  grep "/var/lib/postgresql|/var/tmp\\|/tmp\\|/dev/shm\\|deleted"
  2⤵
  PID:1011
- /bin/grep
  grep exe
  2⤵
  PID:1010
- /bin/ls
  ls -al /proc/105
  2⤵
  PID:1009
- /bin/grep
  grep rediserver
  2⤵
  PID:1013
- /bin/ls
  ls -al /proc/107
  2⤵
  PID:1012
- /bin/grep
  grep -a donate-level /proc/107/exe
  2⤵
  - Reads runtime system information
  PID:1014
- /bin/grep
  grep "/var/lib/postgresql|/var/tmp\\|/tmp\\|/dev/shm\\|deleted"
  2⤵
  PID:1017
- /bin/ls
  ls -al /proc/107
  2⤵
  PID:1015
- /bin/grep
  grep exe
  2⤵
  PID:1016
- /bin/grep
  grep rediserver
  2⤵
  PID:1019
- /bin/ls
  ls -al /proc/108
  2⤵
  PID:1018
- /bin/grep
  grep -a donate-level /proc/108/exe
  2⤵
  PID:1020
- /bin/grep
  grep exe
  2⤵
  PID:1022
- /bin/ls
  ls -al /proc/108
  2⤵
  PID:1021
- /bin/grep
  grep "/var/lib/postgresql|/var/tmp\\|/tmp\\|/dev/shm\\|deleted"
  2⤵
  PID:1023
- /bin/grep
  grep rediserver
  2⤵
  PID:1025
- /bin/ls
  ls -al /proc/11
  2⤵
  PID:1024
- /bin/grep
  grep -a donate-level /proc/11/exe
  2⤵
  PID:1026
- /bin/grep
  grep exe
  2⤵
  PID:1028
- /bin/ls
  ls -al /proc/11
  2⤵
  PID:1027
- /bin/grep
  grep "/var/lib/postgresql|/var/tmp\\|/tmp\\|/dev/shm\\|deleted"
  2⤵
  PID:1029
- /bin/ls
  ls -al /proc/12
  2⤵
  PID:1030
- /bin/grep
  grep rediserver
  2⤵
  PID:1031
- /bin/grep
  grep -a donate-level /proc/12/exe
  2⤵
  PID:1032
- /bin/grep
  grep "/var/lib/postgresql|/var/tmp\\|/tmp\\|/dev/shm\\|deleted"
  2⤵
  PID:1035
- /bin/grep
  grep exe
  2⤵
  PID:1034
- /bin/ls
  ls -al /proc/12
  2⤵
  PID:1033
- /bin/grep
  grep rediserver
  2⤵
  PID:1037
- /bin/ls
  ls -al /proc/13
  2⤵
  PID:1036
- /bin/grep
  grep -a donate-level /proc/13/exe
  2⤵
  PID:1038
- /bin/grep
  grep exe
  2⤵
  PID:1040
- /bin/grep
  grep "/var/lib/postgresql|/var/tmp\\|/tmp\\|/dev/shm\\|deleted"
  2⤵
  PID:1041
- /bin/ls
  ls -al /proc/13
  2⤵
  PID:1039
- /bin/grep
  grep rediserver
  2⤵
  PID:1043
- /bin/ls
  ls -al /proc/137
  2⤵
  PID:1042
- /bin/grep
  grep -a donate-level /proc/137/exe
  2⤵
  PID:1044
- /bin/grep
  grep exe
  2⤵
  PID:1046
- /bin/ls
  ls -al /proc/137
  2⤵
  PID:1045
- /bin/grep
  grep "/var/lib/postgresql|/var/tmp\\|/tmp\\|/dev/shm\\|deleted"
  2⤵
  PID:1047
- /bin/grep
  grep rediserver
  2⤵
  PID:1049
- /bin/ls
  ls -al /proc/138
  2⤵
  PID:1048
- /bin/grep
  grep -a donate-level /proc/138/exe
  2⤵
  PID:1050
- /bin/grep
  grep "/var/lib/postgresql|/var/tmp\\|/tmp\\|/dev/shm\\|deleted"
  2⤵
  PID:1053
- /bin/grep
  grep exe
  2⤵
  PID:1052
- /bin/ls
  ls -al /proc/138
  2⤵
  PID:1051
- /bin/grep
  grep rediserver
  2⤵
  PID:1055
- /bin/ls
  ls -al /proc/14
  2⤵
  PID:1054
- /bin/grep
  grep -a donate-level /proc/14/exe
  2⤵
  PID:1056
- /bin/grep
  grep "/var/lib/postgresql|/var/tmp\\|/tmp\\|/dev/shm\\|deleted"
  2⤵
  PID:1059
- /bin/grep
  grep exe
  2⤵
  PID:1058
- /bin/ls
  ls -al /proc/14
  2⤵
  PID:1057
- /bin/ls
  ls -al /proc/147
  2⤵
  PID:1060
- /bin/grep
  grep rediserver
  2⤵
  PID:1061
- /bin/grep
  grep -a donate-level /proc/147/exe
  2⤵
  PID:1062
- /bin/grep
  grep "/var/lib/postgresql|/var/tmp\\|/tmp\\|/dev/shm\\|deleted"
  2⤵
  PID:1065
- /bin/grep
  grep exe
  2⤵
  PID:1064
- /bin/ls
  ls -al /proc/147
  2⤵
  PID:1063
- /bin/grep
  grep rediserver
  2⤵
  PID:1067
- /bin/ls
  ls -al /proc/15
  2⤵
  PID:1066
- /bin/grep
  grep -a donate-level /proc/15/exe
  2⤵
  PID:1068
- /bin/grep
  grep "/var/lib/postgresql|/var/tmp\\|/tmp\\|/dev/shm\\|deleted"
  2⤵
  PID:1071
- /bin/grep
  grep exe
  2⤵
  PID:1070
- /bin/ls
  ls -al /proc/15
  2⤵
  PID:1069
- /bin/grep
  grep rediserver
  2⤵
  PID:1073
- /bin/ls
  ls -al /proc/157
  2⤵
  PID:1072
- /bin/grep
  grep -a donate-level /proc/157/exe
  2⤵
  PID:1074
- /bin/grep
  grep "/var/lib/postgresql|/var/tmp\\|/tmp\\|/dev/shm\\|deleted"
  2⤵
  PID:1077
- /bin/grep
  grep exe
  2⤵
  PID:1076
- /bin/ls
  ls -al /proc/157
  2⤵
  PID:1075
- /bin/grep
  grep rediserver
  2⤵
  PID:1079
- /bin/ls
  ls -al /proc/159
  2⤵
  PID:1078
- /bin/grep
  grep -a donate-level /proc/159/exe
  2⤵
  PID:1080
- /bin/grep
  grep exe
  2⤵
  PID:1082
- /bin/grep
  grep "/var/lib/postgresql|/var/tmp\\|/tmp\\|/dev/shm\\|deleted"
  2⤵
  PID:1083
- /bin/ls
  ls -al /proc/159
  2⤵
  PID:1081
- /bin/grep
  grep rediserver
  2⤵
  PID:1085
- /bin/ls
  ls -al /proc/16
  2⤵
  PID:1084
- /bin/grep
  grep -a donate-level /proc/16/exe
  2⤵
  PID:1086
- /bin/grep
  grep exe
  2⤵
  PID:1088
- /bin/grep
  grep "/var/lib/postgresql|/var/tmp\\|/tmp\\|/dev/shm\\|deleted"
  2⤵
  PID:1089
- /bin/ls
  ls -al /proc/16
  2⤵
  PID:1087
- /bin/ls
  ls -al /proc/168
  2⤵
  PID:1090
- /bin/grep
  grep rediserver
  2⤵
  PID:1091
- /bin/grep
  grep -a donate-level /proc/168/exe
  2⤵
  PID:1092
- /bin/grep
  grep "/var/lib/postgresql|/var/tmp\\|/tmp\\|/dev/shm\\|deleted"
  2⤵
  PID:1095
- /bin/ls
  ls -al /proc/168
  2⤵
  PID:1093
- /bin/grep
  grep exe
  2⤵
  PID:1094
- /bin/grep
  grep rediserver
  2⤵
  PID:1097
- /bin/ls
  ls -al /proc/17
  2⤵
  PID:1096
- /bin/grep
  grep -a donate-level /proc/17/exe
  2⤵
  PID:1098
- /bin/grep
  grep exe
  2⤵
  PID:1100
- /bin/ls
  ls -al /proc/17
  2⤵
  PID:1099
- /bin/grep
  grep "/var/lib/postgresql|/var/tmp\\|/tmp\\|/dev/shm\\|deleted"
  2⤵
  PID:1101
- /bin/grep
  grep rediserver
  2⤵
  PID:1103
- /bin/ls
  ls -al /proc/18
  2⤵
  PID:1102
- /bin/grep
  grep -a donate-level /proc/18/exe
  2⤵
  PID:1104
- /bin/grep
  grep "/var/lib/postgresql|/var/tmp\\|/tmp\\|/dev/shm\\|deleted"
  2⤵
  PID:1107
- /bin/ls
  ls -al /proc/18
  2⤵
  PID:1105
- /bin/grep
  grep exe
  2⤵
  PID:1106
- /bin/grep
  grep rediserver
  2⤵
  PID:1109
- /bin/ls
  ls -al /proc/19
  2⤵
  PID:1108
- /bin/grep
  grep -a donate-level /proc/19/exe
  2⤵
  PID:1110
- /bin/grep
  grep exe
  2⤵
  PID:1112
- /bin/ls
  ls -al /proc/19
  2⤵
  PID:1111
- /bin/grep
  grep "/var/lib/postgresql|/var/tmp\\|/tmp\\|/dev/shm\\|deleted"
  2⤵
  PID:1113
- /bin/ls
  ls -al /proc/2
  2⤵
  PID:1114
- /bin/grep
  grep rediserver
  2⤵
  PID:1115
- /bin/grep
  grep -a donate-level /proc/2/exe
  2⤵
  PID:1116
- /bin/grep
  grep "/var/lib/postgresql|/var/tmp\\|/tmp\\|/dev/shm\\|deleted"
  2⤵
  PID:1119
- /bin/grep
  grep exe
  2⤵
  PID:1118
- /bin/ls
  ls -al /proc/2
  2⤵
  PID:1117
- /bin/grep
  grep rediserver
  2⤵
  PID:1121
- /bin/ls
  ls -al /proc/20
  2⤵
  PID:1120
- /bin/grep
  grep -a donate-level /proc/20/exe
  2⤵
  PID:1122
- /bin/grep
  grep "/var/lib/postgresql|/var/tmp\\|/tmp\\|/dev/shm\\|deleted"
  2⤵
  PID:1125
- /bin/grep
  grep exe
  2⤵
  PID:1124
- /bin/ls
  ls -al /proc/20
  2⤵
  PID:1123
- /bin/grep
  grep rediserver
  2⤵
  PID:1127
- /bin/ls
  ls -al /proc/21
  2⤵
  PID:1126
- /bin/grep
  grep -a donate-level /proc/21/exe
  2⤵
  PID:1128
- /bin/grep
  grep "/var/lib/postgresql|/var/tmp\\|/tmp\\|/dev/shm\\|deleted"
  2⤵
  PID:1131
- /bin/grep
  grep exe
  2⤵
  PID:1130
- /bin/ls
  ls -al /proc/21
  2⤵
  PID:1129
- /bin/grep
  grep rediserver
  2⤵
  PID:1133
- /bin/ls
  ls -al /proc/22
  2⤵
  PID:1132
- /bin/grep
  grep -a donate-level /proc/22/exe
  2⤵
  PID:1134
- /bin/grep
  grep exe
  2⤵
  PID:1136
- /bin/grep
  grep "/var/lib/postgresql|/var/tmp\\|/tmp\\|/dev/shm\\|deleted"
  2⤵
  PID:1137
- /bin/ls
  ls -al /proc/22
  2⤵
  PID:1135
- /bin/grep
  grep rediserver
  2⤵
  PID:1139
- /bin/ls
  ls -al /proc/23
  2⤵
  PID:1138
- /bin/grep
  grep -a donate-level /proc/23/exe
  2⤵
  PID:1140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp.gHqjo4

Path /var/spool/cron/crontabs/tmp.gHqjo4
Size 254B
SHA256 6b2085cc21346089a6a1304901dca400dfdfb77607dd29c9e446972d4ed06bbd
MD5 e012b8d6535600a30b43223d7923751e
SHA1 44950bd463faa8010aa0464f01cbffdd3865364f
SHA512 3003235bce01082595e8945a2304b15fe3bd528dce682bb843546ded7dca486282bfa7ff9692bba10bd464bdbc92ecf081772567f76e37b56b2248080d75f8fc
TLSH
T1F2D095B72F103C342E518709501F011D6942913D805D6F40D0DD5404011735B3750D71
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads