3f67aaa79b36b33d0b6bf22fc842f3eada9ebff6670fc3aae51308c5d0292e24

Analysis

max time kernel
149s
max time network
150s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
13/08/2026, 02:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
x86_64.elf
Size 160KB
Sample260813-dcffvszfpd
SHA256 3f67aaa79b36b33d0b6bf22fc842f3eada9ebff6670fc3aae51308c5d0292e24
MD5 2ea35c891f2704dd9745dbb41fc645af
SHA1 383d72e22c4e956090a44a9545cdea5c45ac41a6
SHA512 99b3ab18d7305a00339947706259698b68f76652ba2fe13e3dc70975aba4b8ce265cbcb234150494043646c1fbe09f6f746eba2cfb590740e066dc9bb9903bad
SSDEEP 3072:hY9w/G9y7C8bCZmhHKbH1ZAloKtFbfpljwz4nPzTM/Vj5E:XnnHkVqrV5nY5E
TLSH
T151F36B26B4C1D4FDC8D9C1B84BEEE236E972F0595134B11F17C4AE262E9DF206B6D620
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

Indicator Removal: Clear Command History 1 TTPs 2 IoCs

Adversaries may remove indicators of compromise from the host to evade detection.

defense_evasion

Clear Command History

T1070.003

pid	Process
1634	service
1667	systemctl

Deletes itself 1 IoCs

pid	Process
1542	x86_64.elf

Deletes system logs 1 TTPs 3 IoCs

Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File deleted	/var/log/messages	x86_64.elf
File truncated	/var/log/messages	sh
File deleted	/var/log/syslog	x86_64.elf

Disables AppArmor Mandatory Access Control 1 TTPs 64 IoCs

Stops or disables AppArmor via systemctl, removing mandatory access control restrictions on process capabilities and file access.

Disable or Modify Tools

T1562.001

pid	Process
1678	systemctl
1679	systemctl
1693	systemctl
1709	systemctl
1664	systemctl
1641	systemctl
1652	systemctl
1653	systemctl
1634	systemctl
1685	systemctl
1708	systemctl
1712	systemctl
1657	systemctl
1687	systemctl
1669	systemctl
1718	systemctl
1723	systemctl
1698	systemctl
1727	systemctl
1649	systemctl
1689	systemctl
1669	systemctl
1711	systemctl
1722	systemctl
1698	systemctl
1669	systemctl
1721	systemctl
1698	systemctl
1585	systemctl
1646	systemctl
1654	systemctl
1634	systemctl
1674	systemctl
1677	systemctl
1669	systemctl
1696	systemctl
1585	systemctl
1662	systemctl
1686	systemctl
1713	systemctl
1656	systemctl
1634	systemctl
1676	systemctl
1680	systemctl
1684	systemctl
1688	systemctl
1714	systemctl
1724	systemctl
1694	systemctl
1585	systemctl
1585	systemctl
1651	systemctl
1691	systemctl
1692	systemctl
1698	systemctl
1585	systemctl
1659	systemctl
1634	systemctl
1715	systemctl
1717	systemctl
1719	systemctl
1698	systemctl
1632	systemctl
1637	systemctl

Flushes firewall rules 1 TTPs 35 IoCs

Flushes/ disables firewall rules inside the Linux kernel.

defense_evasion

Disable or Modify System Firewall

T1562.004

pid	Process
1669	systemctl
1708	systemctl
1711	systemctl
1715	systemctl
1669	systemctl
1669	systemctl
1709	systemctl
1712	systemctl
1720	systemctl
1724	systemctl
1669	systemctl
1710	systemctl
1719	systemctl
1721	systemctl
1722	systemctl
1698	systemctl
1696	systemctl
1701	systemctl
1718	systemctl
1698	systemctl
1698	systemctl
1727	systemctl
1707	systemctl
1714	systemctl
1716	systemctl
1717	systemctl
1713	systemctl
1723	systemctl
1698	systemctl
1698	systemctl
1698	systemctl
1669	systemctl
1669	systemctl
1703	systemctl
1706	systemctl

Modifies the /etc/hosts DNS resolution file 1 TTPs 1 IoCs

Modifying the /etc/hosts name-resolution file changes IP routing, which can facilitate traffic hijacking or the blocking of (security update) endpoints.

Adversary-in-the-Middle

T1557

description	ioc	Process
File opened for modification	/etc/hosts	x86_64.elf

Checks hardware identifiers (DMI) 1 TTPs 2 IoCs

Checks DMI information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/sys/class/dmi/id/product_name	x86_64.elf
File opened for reading	/sys/class/dmi/id/sys_vendor	x86_64.elf

Deletes log files 1 TTPs 7 IoCs

Deletes log files on the system.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File deleted	/var/log/wtmp	x86_64.elf
File deleted	/var/log/btmp	x86_64.elf
File deleted	/var/log/lastlog	x86_64.elf
File deleted	/var/log/auth.log	x86_64.elf
File deleted	/var/log/secure	x86_64.elf
File truncated	/var/log/auth.log	sh
File truncated	/var/log/secure	sh

Disables SELinux 1 TTPs 1 IoCs

Disables SELinux security module.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
1582	setenforce

Enumerates running processes
Discovers information about currently running processes on the system

Changes its process name 7 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	t.me/flylegit	1542	x86_64.elf
Changes the process name, possibly in an attempt to hide itself	[jbd2/sda1]	1542	x86_64.elf
Changes the process name, possibly in an attempt to hide itself	[kcompactd0]	1542	x86_64.elf
Changes the process name, possibly in an attempt to hide itself	[ext4-rsv-conver]	1728	x86_64.elf
Changes the process name, possibly in an attempt to hide itself	[kcompactd0]	1728	x86_64.elf
Changes the process name, possibly in an attempt to hide itself	[rcu_sched]	1728	x86_64.elf
Changes the process name, possibly in an attempt to hide itself	[rcu_sched]	1728	x86_64.elf

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	x86_64.elf

Reads CPU attributes 1 TTPs 2 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/170/comm	x86_64.elf
File opened for reading	/proc/990/cmdline	x86_64.elf
File opened for reading	/proc/214/cmdline	pkill
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/214/cmdline	x86_64.elf
File opened for reading	/proc/579/status	pkill
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/36/cmdline	x86_64.elf
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/31/cmdline	pkill
File opened for reading	/proc/1182/cmdline	x86_64.elf
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/1511/comm	x86_64.elf
File opened for reading	/proc/178/cmdline	x86_64.elf
File opened for reading	/proc/84/status	pkill
File opened for reading	/proc/174/cmdline	pkill
File opened for reading	/proc/963/status	pkill
File opened for reading	/proc/1112/status	pkill
File opened for reading	/proc/1578/cmdline	pkill
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/1924/cmdline	x86_64.elf
File opened for reading	/proc/30/comm	x86_64.elf
File opened for reading	/proc/327/cmdline	x86_64.elf
File opened for reading	/proc/35/status	pkill
File opened for reading	/proc/1532/status	pkill
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/1361/comm	x86_64.elf
File opened for reading	/proc/12/status	pkill
File opened for reading	/proc/174/status	pkill
File opened for reading	/proc/1532/cmdline	pkill
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/2060/comm	x86_64.elf
File opened for reading	/proc/474/comm	x86_64.elf
File opened for reading	/proc/920/cmdline	x86_64.elf
File opened for reading	/proc/734/status	pkill
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/550/cmdline	pkill
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/2108/cmdline	x86_64.elf
File opened for reading	/proc/1035/comm	x86_64.elf
File opened for reading	/proc/175/cmdline	x86_64.elf
File opened for reading	/proc/449/cmdline	pkill
File opened for reading	/proc/672/status	pkill
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/927/comm	x86_64.elf
File opened for reading	/proc/82/status	pkill

/tmp/x86_64.elf
/tmp/x86_64.elf
1⤵
- Deletes itself
- Deletes system logs
- Modifies the /etc/hosts DNS resolution file
- Checks hardware identifiers (DMI)
- Deletes log files
- Changes its process name
- Checks CPU configuration
- Reads runtime system information
PID:1540
- /bin/sh
  sh -c "iptables -A INPUT -p tcp --dport 22 -j DROP 2>/dev/null"
  2⤵
  PID:1549
- - /sbin/iptables
    iptables -A INPUT -p tcp --dport 22 -j DROP
    3⤵
    PID:1550
- /bin/sh
  sh -c "ln -sf /tmp/x86_64.elf /usr/sbin/rsyslogd 2>/dev/null"
  2⤵
  PID:1548
- - /bin/ln
    ln -sf /tmp/x86_64.elf /usr/sbin/rsyslogd
    3⤵
    PID:1551
- /bin/sh
  sh -c "iptables -A INPUT -p tcp --dport 23 -j DROP 2>/dev/null"
  2⤵
  PID:1558
- - /sbin/iptables
    iptables -A INPUT -p tcp --dport 23 -j DROP
    3⤵
    PID:1559
- /bin/sh
  sh -c "iptables -A INPUT -p tcp --dport 2323 -j DROP 2>/dev/null"
  2⤵
  PID:1560
- - /sbin/iptables
    iptables -A INPUT -p tcp --dport 2323 -j DROP
    3⤵
    PID:1561
- /bin/sh
  sh -c "echo '' > /var/log/auth.log 2>/dev/null"
  2⤵
  - Deletes log files
  PID:1562
- /bin/sh
  sh -c "iptables -A INPUT -p tcp --dport 21 -j DROP 2>/dev/null"
  2⤵
  PID:1563
- - /sbin/iptables
    iptables -A INPUT -p tcp --dport 21 -j DROP
    3⤵
    PID:1564
- /bin/sh
  sh -c "echo '' > /var/log/secure 2>/dev/null"
  2⤵
  - Deletes log files
  PID:1565
- /bin/sh
  sh -c "iptables -A INPUT -p tcp --dport 5900 -j DROP 2>/dev/null"
  2⤵
  PID:1566
- - /sbin/iptables
    iptables -A INPUT -p tcp --dport 5900 -j DROP
    3⤵
    PID:1567
- /bin/sh
  sh -c "echo '' > /var/log/messages 2>/dev/null"
  2⤵
  - Deletes system logs
  PID:1568
- /bin/sh
  sh -c "iptables -A INPUT -p tcp --dport 3389 -j DROP 2>/dev/null"
  2⤵
  PID:1569
- - /sbin/iptables
    iptables -A INPUT -p tcp --dport 3389 -j DROP
    3⤵
    PID:1570
- /bin/sh
  sh -c "history -c 2>/dev/null"
  2⤵
  PID:1572
- /bin/sh
  sh -c "pkill -9 sshd telnetd dropbear 2>/dev/null"
  2⤵
  PID:1573
- - /usr/bin/pkill
    pkill -9 sshd telnetd dropbear
    3⤵
    - Reads CPU attributes
    PID:1574
- /bin/sh
  sh -c "echo 0 > /selinux/enforce 2>/dev/null"
  2⤵
  PID:1575
- /bin/sh
  sh -c "pkill -9 ftpd 2>/dev/null"
  2⤵
  PID:1576
- - /usr/bin/pkill
    pkill -9 ftpd
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1578
- /bin/sh
  sh -c "setenforce 0 2>/dev/null"
  2⤵
  PID:1577
- - /usr/sbin/setenforce
    setenforce 0
    3⤵
    - Disables SELinux
    PID:1582
- /bin/sh
  sh -c "service apparmor stop 2>/dev/null"
  2⤵
  PID:1583
- - /usr/sbin/service
    service apparmor stop
    3⤵
    PID:1585
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:1586
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:1587
  - - /bin/systemctl
      systemctl --quiet is-active multi-user.target
      4⤵
      PID:1588
  - - /bin/systemctl
      systemctl list-unit-files --full "--type=socket"
      4⤵
      PID:1592
  - - /bin/sed
      sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
      4⤵
      PID:1593
  - - /bin/systemctl
      systemctl -p Triggers show acpid.socket
      4⤵
      PID:1595
  - - /bin/systemctl
      systemctl -p Triggers show apport-forward.socket
      4⤵
      Reads runtime system information
      PID:1598
  - - /bin/systemctl
      systemctl -p Triggers show avahi-daemon.socket
      4⤵
      Reads runtime system information
      PID:1599
  - - /bin/systemctl
      systemctl -p Triggers show cups.socket
      4⤵
      PID:1600
  - - /bin/systemctl
      systemctl -p Triggers show dbus.socket
      4⤵
      Reads runtime system information
      PID:1601
  - - /bin/systemctl
      systemctl -p Triggers show saned.socket
      4⤵
      PID:1602
  - - /bin/systemctl
      systemctl -p Triggers show snapd.socket
      4⤵
      PID:1603
  - - /bin/systemctl
      systemctl -p Triggers show ssh.socket
      4⤵
      PID:1604
  - - /bin/systemctl
      systemctl -p Triggers show syslog.socket
      4⤵
      PID:1605
  - - /bin/systemctl
      systemctl -p Triggers show systemd-fsckd.socket
      4⤵
      PID:1608
  - - /bin/systemctl
      systemctl -p Triggers show systemd-initctl.socket
      4⤵
      Reads runtime system information
      PID:1609
  - - /bin/systemctl
      systemctl -p Triggers show systemd-journald-audit.socket
      4⤵
      Reads runtime system information
      PID:1610
  - - /bin/systemctl
      systemctl -p Triggers show systemd-journald-dev-log.socket
      4⤵
      PID:1611
  - - /bin/systemctl
      systemctl -p Triggers show systemd-journald.socket
      4⤵
      PID:1612
  - - /bin/systemctl
      systemctl -p Triggers show systemd-networkd.socket
      4⤵
      Reads runtime system information
      PID:1613
  - - /bin/systemctl
      systemctl -p Triggers show systemd-rfkill.socket
      4⤵
      Reads runtime system information
      PID:1614
  - - /bin/systemctl
      systemctl -p Triggers show systemd-udevd-control.socket
      4⤵
      Reads runtime system information
      PID:1615
  - - /bin/systemctl
      systemctl -p Triggers show systemd-udevd-kernel.socket
      4⤵
      PID:1616
  - - /bin/systemctl
      systemctl -p Triggers show uuidd.socket
      4⤵
      Reads runtime system information
      PID:1619
- - /usr/local/sbin/systemctl
    systemctl stop apparmor.service
    3⤵
    - Disables AppArmor Mandatory Access Control
    PID:1585
- - /usr/local/bin/systemctl
    systemctl stop apparmor.service
    3⤵
    - Disables AppArmor Mandatory Access Control
    PID:1585
- - /usr/sbin/systemctl
    systemctl stop apparmor.service
    3⤵
    - Disables AppArmor Mandatory Access Control
    PID:1585
- - /usr/bin/systemctl
    systemctl stop apparmor.service
    3⤵
    PID:1585
- - /sbin/systemctl
    systemctl stop apparmor.service
    3⤵
    - Disables AppArmor Mandatory Access Control
    PID:1585
- - /bin/systemctl
    systemctl stop apparmor.service
    3⤵
    - Disables AppArmor Mandatory Access Control
    PID:1585
- /bin/sh
  sh -c "systemctl stop apparmor 2>/dev/null"
  2⤵
  PID:1631
- - /bin/systemctl
    systemctl stop apparmor
    3⤵
    - Disables AppArmor Mandatory Access Control
    PID:1632
- /bin/sh
  sh -c "service auditd stop 2>/dev/null"
  2⤵
  PID:1633
- - /usr/sbin/service
    service auditd stop
    3⤵
    - Indicator Removal: Clear Command History
    PID:1634
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:1635
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:1636
  - - /bin/systemctl
      systemctl --quiet is-active multi-user.target
      4⤵
      Disables AppArmor Mandatory Access Control
      PID:1637
  - - /bin/sed
      sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
      4⤵
      PID:1642
  - - /bin/systemctl
      systemctl list-unit-files --full "--type=socket"
      4⤵
      Disables AppArmor Mandatory Access Control
      PID:1641
  - - /bin/systemctl
      systemctl -p Triggers show acpid.socket
      4⤵
      Disables AppArmor Mandatory Access Control
      PID:1646
  - - /bin/systemctl
      systemctl -p Triggers show apport-forward.socket
      4⤵
      Reads runtime system information
      PID:1647
  - - /bin/systemctl
      systemctl -p Triggers show avahi-daemon.socket
      4⤵
      PID:1648
  - - /bin/systemctl
      systemctl -p Triggers show cups.socket
      4⤵
      Disables AppArmor Mandatory Access Control
      PID:1649
  - - /bin/systemctl
      systemctl -p Triggers show dbus.socket
      4⤵
      PID:1650
  - - /bin/systemctl
      systemctl -p Triggers show saned.socket
      4⤵
      Disables AppArmor Mandatory Access Control
      Reads runtime system information
      PID:1651
  - - /bin/systemctl
      systemctl -p Triggers show snapd.socket
      4⤵
      Disables AppArmor Mandatory Access Control
      PID:1652
  - - /bin/systemctl
      systemctl -p Triggers show ssh.socket
      4⤵
      Disables AppArmor Mandatory Access Control
      Reads runtime system information
      PID:1653
  - - /bin/systemctl
      systemctl -p Triggers show syslog.socket
      4⤵
      Disables AppArmor Mandatory Access Control
      PID:1654
  - - /bin/systemctl
      systemctl -p Triggers show systemd-fsckd.socket
      4⤵
      PID:1655
  - - /bin/systemctl
      systemctl -p Triggers show systemd-initctl.socket
      4⤵
      Disables AppArmor Mandatory Access Control
      PID:1656
  - - /bin/systemctl
      systemctl -p Triggers show systemd-journald-audit.socket
      4⤵
      Disables AppArmor Mandatory Access Control
      PID:1657
  - - /bin/systemctl
      systemctl -p Triggers show systemd-journald-dev-log.socket
      4⤵
      PID:1658
  - - /bin/systemctl
      systemctl -p Triggers show systemd-journald.socket
      4⤵
      Disables AppArmor Mandatory Access Control
      PID:1659
  - - /bin/systemctl
      systemctl -p Triggers show systemd-networkd.socket
      4⤵
      PID:1660
  - - /bin/systemctl
      systemctl -p Triggers show systemd-rfkill.socket
      4⤵
      PID:1661
  - - /bin/systemctl
      systemctl -p Triggers show systemd-udevd-control.socket
      4⤵
      Disables AppArmor Mandatory Access Control
      PID:1662
  - - /bin/systemctl
      systemctl -p Triggers show systemd-udevd-kernel.socket
      4⤵
      Reads runtime system information
      PID:1663
  - - /bin/systemctl
      systemctl -p Triggers show uuidd.socket
      4⤵
      Disables AppArmor Mandatory Access Control
      Reads runtime system information
      PID:1664
- - /usr/local/sbin/systemctl
    systemctl stop auditd.service
    3⤵
    PID:1634
- - /usr/local/bin/systemctl
    systemctl stop auditd.service
    3⤵
    - Disables AppArmor Mandatory Access Control
    PID:1634
- - /usr/sbin/systemctl
    systemctl stop auditd.service
    3⤵
    PID:1634
- - /usr/bin/systemctl
    systemctl stop auditd.service
    3⤵
    - Disables AppArmor Mandatory Access Control
    PID:1634
- - /sbin/systemctl
    systemctl stop auditd.service
    3⤵
    - Disables AppArmor Mandatory Access Control
    PID:1634
- - /bin/systemctl
    systemctl stop auditd.service
    3⤵
    - Disables AppArmor Mandatory Access Control
    PID:1634
- /bin/sh
  sh -c "systemctl stop auditd 2>/dev/null"
  2⤵
  PID:1666
- - /bin/systemctl
    systemctl stop auditd
    3⤵
    - Indicator Removal: Clear Command History
    PID:1667
- /bin/sh
  sh -c "service firewalld stop 2>/dev/null"
  2⤵
  PID:1668
- - /usr/sbin/service
    service firewalld stop
    3⤵
    PID:1669
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:1670
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:1671
  - - /bin/systemctl
      systemctl --quiet is-active multi-user.target
      4⤵
      PID:1672
  - - /bin/sed
      sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
      4⤵
      PID:1675
  - - /bin/systemctl
      systemctl list-unit-files --full "--type=socket"
      4⤵
      Disables AppArmor Mandatory Access Control
      PID:1674
  - - /bin/systemctl
      systemctl -p Triggers show acpid.socket
      4⤵
      Disables AppArmor Mandatory Access Control
      PID:1676
  - - /bin/systemctl
      systemctl -p Triggers show apport-forward.socket
      4⤵
      Disables AppArmor Mandatory Access Control
      PID:1677
  - - /bin/systemctl
      systemctl -p Triggers show avahi-daemon.socket
      4⤵
      Disables AppArmor Mandatory Access Control
      Reads runtime system information
      PID:1678
  - - /bin/systemctl
      systemctl -p Triggers show cups.socket
      4⤵
      Disables AppArmor Mandatory Access Control
      PID:1679
  - - /bin/systemctl
      systemctl -p Triggers show dbus.socket
      4⤵
      Disables AppArmor Mandatory Access Control
      PID:1680
  - - /bin/systemctl
      systemctl -p Triggers show saned.socket
      4⤵
      PID:1681
  - - /bin/systemctl
      systemctl -p Triggers show snapd.socket
      4⤵
      PID:1682
  - - /bin/systemctl
      systemctl -p Triggers show ssh.socket
      4⤵
      PID:1683
  - - /bin/systemctl
      systemctl -p Triggers show syslog.socket
      4⤵
      Disables AppArmor Mandatory Access Control
      PID:1684
  - - /bin/systemctl
      systemctl -p Triggers show systemd-fsckd.socket
      4⤵
      Disables AppArmor Mandatory Access Control
      PID:1685
  - - /bin/systemctl
      systemctl -p Triggers show systemd-initctl.socket
      4⤵
      Disables AppArmor Mandatory Access Control
      PID:1686
  - - /bin/systemctl
      systemctl -p Triggers show systemd-journald-audit.socket
      4⤵
      Disables AppArmor Mandatory Access Control
      Reads runtime system information
      PID:1687
  - - /bin/systemctl
      systemctl -p Triggers show systemd-journald-dev-log.socket
      4⤵
      Disables AppArmor Mandatory Access Control
      PID:1688
  - - /bin/systemctl
      systemctl -p Triggers show systemd-journald.socket
      4⤵
      Disables AppArmor Mandatory Access Control
      PID:1689
  - - /bin/systemctl
      systemctl -p Triggers show systemd-networkd.socket
      4⤵
      Reads runtime system information
      PID:1690
  - - /bin/systemctl
      systemctl -p Triggers show systemd-rfkill.socket
      4⤵
      Disables AppArmor Mandatory Access Control
      PID:1691
  - - /bin/systemctl
      systemctl -p Triggers show systemd-udevd-control.socket
      4⤵
      Disables AppArmor Mandatory Access Control
      PID:1692
  - - /bin/systemctl
      systemctl -p Triggers show systemd-udevd-kernel.socket
      4⤵
      Disables AppArmor Mandatory Access Control
      Reads runtime system information
      PID:1693
  - - /bin/systemctl
      systemctl -p Triggers show uuidd.socket
      4⤵
      Disables AppArmor Mandatory Access Control
      PID:1694
- - /usr/local/sbin/systemctl
    systemctl stop firewalld.service
    3⤵
    - Disables AppArmor Mandatory Access Control
    - Flushes firewall rules
    PID:1669
- - /usr/local/bin/systemctl
    systemctl stop firewalld.service
    3⤵
    - Flushes firewall rules
    PID:1669
- - /usr/sbin/systemctl
    systemctl stop firewalld.service
    3⤵
    - Flushes firewall rules
    PID:1669
- - /usr/bin/systemctl
    systemctl stop firewalld.service
    3⤵
    - Disables AppArmor Mandatory Access Control
    - Flushes firewall rules
    PID:1669
- - /sbin/systemctl
    systemctl stop firewalld.service
    3⤵
    - Disables AppArmor Mandatory Access Control
    - Flushes firewall rules
    PID:1669
- - /bin/systemctl
    systemctl stop firewalld.service
    3⤵
    - Disables AppArmor Mandatory Access Control
    - Flushes firewall rules
    PID:1669
- /bin/sh
  sh -c "systemctl stop firewalld 2>/dev/null"
  2⤵
  PID:1695
- - /bin/systemctl
    systemctl stop firewalld
    3⤵
    - Disables AppArmor Mandatory Access Control
    - Flushes firewall rules
    PID:1696
- /bin/sh
  sh -c "service ufw stop 2>/dev/null"
  2⤵
  PID:1697
- - /usr/sbin/service
    service ufw stop
    3⤵
    PID:1698
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:1699
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:1700
  - - /bin/systemctl
      systemctl --quiet is-active multi-user.target
      4⤵
      Flushes firewall rules
      PID:1701
  - - /bin/sed
      sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
      4⤵
      PID:1704
  - - /bin/systemctl
      systemctl list-unit-files --full "--type=socket"
      4⤵
      Flushes firewall rules
      PID:1703
  - - /bin/systemctl
      systemctl -p Triggers show acpid.socket
      4⤵
      Flushes firewall rules
      PID:1706
  - - /bin/systemctl
      systemctl -p Triggers show apport-forward.socket
      4⤵
      Flushes firewall rules
      PID:1707
  - - /bin/systemctl
      systemctl -p Triggers show avahi-daemon.socket
      4⤵
      Disables AppArmor Mandatory Access Control
      Flushes firewall rules
      Reads runtime system information
      PID:1708
  - - /bin/systemctl
      systemctl -p Triggers show cups.socket
      4⤵
      Disables AppArmor Mandatory Access Control
      Flushes firewall rules
      Reads runtime system information
      PID:1709
  - - /bin/systemctl
      systemctl -p Triggers show dbus.socket
      4⤵
      Flushes firewall rules
      PID:1710
  - - /bin/systemctl
      systemctl -p Triggers show saned.socket
      4⤵
      Disables AppArmor Mandatory Access Control
      Flushes firewall rules
      PID:1711
  - - /bin/systemctl
      systemctl -p Triggers show snapd.socket
      4⤵
      Disables AppArmor Mandatory Access Control
      Flushes firewall rules
      PID:1712
  - - /bin/systemctl
      systemctl -p Triggers show ssh.socket
      4⤵
      Disables AppArmor Mandatory Access Control
      Flushes firewall rules
      PID:1713
  - - /bin/systemctl
      systemctl -p Triggers show syslog.socket
      4⤵
      Disables AppArmor Mandatory Access Control
      Flushes firewall rules
      Reads runtime system information
      PID:1714
  - - /bin/systemctl
      systemctl -p Triggers show systemd-fsckd.socket
      4⤵
      Disables AppArmor Mandatory Access Control
      Flushes firewall rules
      PID:1715
  - - /bin/systemctl
      systemctl -p Triggers show systemd-initctl.socket
      4⤵
      Flushes firewall rules
      PID:1716
  - - /bin/systemctl
      systemctl -p Triggers show systemd-journald-audit.socket
      4⤵
      Disables AppArmor Mandatory Access Control
      Flushes firewall rules
      Reads runtime system information
      PID:1717
  - - /bin/systemctl
      systemctl -p Triggers show systemd-journald-dev-log.socket
      4⤵
      Disables AppArmor Mandatory Access Control
      Flushes firewall rules
      Reads runtime system information
      PID:1718
  - - /bin/systemctl
      systemctl -p Triggers show systemd-journald.socket
      4⤵
      Disables AppArmor Mandatory Access Control
      Flushes firewall rules
      PID:1719
  - - /bin/systemctl
      systemctl -p Triggers show systemd-networkd.socket
      4⤵
      Flushes firewall rules
      Reads runtime system information
      PID:1720
  - - /bin/systemctl
      systemctl -p Triggers show systemd-rfkill.socket
      4⤵
      Disables AppArmor Mandatory Access Control
      Flushes firewall rules
      Reads runtime system information
      PID:1721
  - - /bin/systemctl
      systemctl -p Triggers show systemd-udevd-control.socket
      4⤵
      Disables AppArmor Mandatory Access Control
      Flushes firewall rules
      PID:1722
  - - /bin/systemctl
      systemctl -p Triggers show systemd-udevd-kernel.socket
      4⤵
      Disables AppArmor Mandatory Access Control
      Flushes firewall rules
      PID:1723
  - - /bin/systemctl
      systemctl -p Triggers show uuidd.socket
      4⤵
      Disables AppArmor Mandatory Access Control
      Flushes firewall rules
      PID:1724
- - /usr/local/sbin/systemctl
    systemctl stop ufw.service
    3⤵
    - Disables AppArmor Mandatory Access Control
    - Flushes firewall rules
    PID:1698
- - /usr/local/bin/systemctl
    systemctl stop ufw.service
    3⤵
    - Flushes firewall rules
    PID:1698
- - /usr/sbin/systemctl
    systemctl stop ufw.service
    3⤵
    - Disables AppArmor Mandatory Access Control
    - Flushes firewall rules
    PID:1698
- - /usr/bin/systemctl
    systemctl stop ufw.service
    3⤵
    - Disables AppArmor Mandatory Access Control
    - Flushes firewall rules
    PID:1698
- - /sbin/systemctl
    systemctl stop ufw.service
    3⤵
    - Disables AppArmor Mandatory Access Control
    - Flushes firewall rules
    PID:1698
- - /bin/systemctl
    systemctl stop ufw.service
    3⤵
    - Disables AppArmor Mandatory Access Control
    - Flushes firewall rules
    PID:1698
- /bin/sh
  sh -c "systemctl stop ufw 2>/dev/null"
  2⤵
  PID:1726
- - /bin/systemctl
    systemctl stop ufw
    3⤵
    - Disables AppArmor Mandatory Access Control
    - Flushes firewall rules
    PID:1727
- /bin/sh
  sh -c "ln -sf /tmp/x86_64.elf (deleted) /usr/bin/cron 2>/dev/null"
  2⤵
  PID:1861
- /bin/sh
  sh -c "ln -sf /tmp/x86_64.elf (deleted) /usr/sbin/rsyslogd 2>/dev/null"
  2⤵
  PID:1985
- /bin/sh
  sh -c "ln -sf /tmp/x86_64.elf (deleted) /usr/sbin/rsyslogd 2>/dev/null"
  2⤵
  PID:2109
- /bin/sh
  sh -c "ln -sf /tmp/x86_64.elf (deleted) /usr/bin/cron 2>/dev/null"
  2⤵
  PID:2233

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Command History

T1070.003

Clear Linux or Mac System Logs

T1070.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Adversary-in-the-Middle

T1557

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Adversary-in-the-Middle

T1557

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

auth.log

Path /var/log/auth.log
Size 1B
SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads