a3b4a22081d3e9338a4f3a8077689d3fcca2d17380e65f821075f9554f9e4140

Analysis

max time kernel
132s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
16/08/2026, 18:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
greppts3.sh
Size 1KB
Sample260816-wxnbbafb84
SHA256 a3b4a22081d3e9338a4f3a8077689d3fcca2d17380e65f821075f9554f9e4140
MD5 310f1ef878e0e63bb6ba9a18eabd1756
SHA1 0674a4876c997b5becce5b13188089fbfd784c46
SHA512 2265cd0de9612be24edf8e6633095d55d2840fe4926051ef00f2043e4af2d759b8b5b6060b4a1558b91dba1de30c413d4c01c9a7c1fb9e9e280ecf8dc6f99369
TLSH
T1AE21E10CC555ED7E3C20DC694DC021159089C08B9A63BF78B52C36D64FA821AF5758A9
MD5 SHA1 SHA512 TLSH

Score

6^/10

discovery

Malware Config

Signatures

Enumerates running processes
Discovers information about currently running processes on the system

Discovers running processes 1 TTPs 13 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
1007	ps
1012	ps
1152	ps
1277	ps
1017	ps
1142	ps
1147	ps
1282	ps
1287	ps
644	ps
871	ps
876	ps
881	ps

Reads CPU attributes 1 TTPs 31 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/5/cmdline	ps
File opened for reading	/proc/13/cmdline	ps
File opened for reading	/proc/13/stat	ps
File opened for reading	/proc/13/status	ps
File opened for reading	/proc/296/stat	ps
File opened for reading	/proc/583/status	ps
File opened for reading	/proc/7/status	ps
File opened for reading	/proc/4/status	ps
File opened for reading	/proc/576/cmdline	ps
File opened for reading	/proc/583/stat	ps
File opened for reading	/proc/8/stat	ps
File opened for reading	/proc/138/cmdline	ps
File opened for reading	/proc/28/status	ps
File opened for reading	/proc/29/cmdline	ps
File opened for reading	/proc/2/cmdline	ps
File opened for reading	/proc/317/stat	ps
File opened for reading	/proc/filesystems	kill
File opened for reading	/proc/2/cmdline	pkill
File opened for reading	/proc/21/status	ps
File opened for reading	/proc/11/cmdline	ps
File opened for reading	/proc/24/stat	ps
File opened for reading	/proc/564/status	pkill
File opened for reading	/proc/29/status	pkill
File opened for reading	/proc/300/status	ps
File opened for reading	/proc/14/status	ps
File opened for reading	/proc/576/cmdline	ps
File opened for reading	/proc/29/stat	ps
File opened for reading	/proc/27/cmdline	pkill
File opened for reading	/proc/5/stat	ps
File opened for reading	/proc/106/cmdline	ps
File opened for reading	/proc/107/stat	ps
File opened for reading	/proc/18/status	ps
File opened for reading	/proc/13/stat	ps
File opened for reading	/proc/96/cmdline	ps
File opened for reading	/proc/107/cmdline	ps
File opened for reading	/proc/151/cmdline	ps
File opened for reading	/proc/224/cmdline	ps
File opened for reading	/proc/2/status	pkill
File opened for reading	/proc/1/status	ps
File opened for reading	/proc/134/status	ps
File opened for reading	/proc/158/cmdline	ps
File opened for reading	/proc/14/status	pkill
File opened for reading	/proc/290/cmdline	ps
File opened for reading	/proc/288/cmdline	ps
File opened for reading	/proc/151/cmdline	ps
File opened for reading	/proc/224/stat	ps
File opened for reading	/proc/18/status	ps
File opened for reading	/proc/42/status	ps
File opened for reading	/proc/648/status	pkill
File opened for reading	/proc/133/cmdline	ps
File opened for reading	/proc/288/cmdline	ps
File opened for reading	/proc/21/stat	ps
File opened for reading	/proc/106/status	ps
File opened for reading	/proc/896/cmdline	ps
File opened for reading	/proc/8/stat	ps
File opened for reading	/proc/326/cmdline	pkill
File opened for reading	/proc/106/cmdline	ps
File opened for reading	/proc/168/status	ps
File opened for reading	/proc/22/cmdline	ps
File opened for reading	/proc/133/cmdline	ps
File opened for reading	/proc/290/cmdline	ps
File opened for reading	/proc/1290/stat	ps
File opened for reading	/proc/6/status	ps
File opened for reading	/proc/14/status	ps

System Network Configuration Discovery 1 TTPs 5 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
646	grep
883	grep
1019	grep
1154	grep
1289	grep

/tmp/greppts3.sh
/tmp/greppts3.sh
1⤵
PID:642
- /bin/grep
  grep "@pts"
  2⤵
  PID:645
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:644
- /bin/grep
  grep -v "grep\\|scripts\\|agetty"
  2⤵
  - System Network Configuration Discovery
  PID:646
- /bin/grep
  grep -v "grep\\|\\["
  2⤵
  PID:667
- /bin/grep
  grep rediserver
  2⤵
  PID:666
- /bin/ps
  ps -fe
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:665
- /usr/bin/pkill
  pkill rediserver
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:673
- /bin/sleep
  sleep 30
  2⤵
  PID:676
- /usr/bin/nohup
  nohup ./rediserver
  2⤵
  PID:675
- /tmp/rediserver
  ./rediserver
  2⤵
  PID:675
- /bin/rm
  rm -f "/var/tmp/*"
  2⤵
  PID:762
- /bin/readlink
  readlink -f /proc/10/exe
  2⤵
  PID:763
- /bin/readlink
  readlink -f /proc/104/exe
  2⤵
  PID:764
- /bin/readlink
  readlink -f /proc/106/exe
  2⤵
  PID:765
- /bin/readlink
  readlink -f /proc/107/exe
  2⤵
  PID:766
- /bin/readlink
  readlink -f /proc/11/exe
  2⤵
  PID:767
- /bin/readlink
  readlink -f /proc/12/exe
  2⤵
  PID:768
- /bin/readlink
  readlink -f /proc/13/exe
  2⤵
  PID:769
- /bin/readlink
  readlink -f /proc/133/exe
  2⤵
  PID:770
- /bin/readlink
  readlink -f /proc/134/exe
  2⤵
  PID:771
- /bin/readlink
  readlink -f /proc/138/exe
  2⤵
  PID:772
- /bin/readlink
  readlink -f /proc/14/exe
  2⤵
  PID:773
- /bin/readlink
  readlink -f /proc/15/exe
  2⤵
  PID:774
- /bin/readlink
  readlink -f /proc/151/exe
  2⤵
  PID:775
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:777
- /bin/readlink
  readlink -f /proc/158/exe
  2⤵
  PID:778
- /bin/readlink
  readlink -f /proc/16/exe
  2⤵
  PID:779
- /bin/readlink
  readlink -f /proc/168/exe
  2⤵
  PID:780
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:782
- /bin/readlink
  readlink -f /proc/17/exe
  2⤵
  PID:783
- /bin/readlink
  readlink -f /proc/18/exe
  2⤵
  PID:784
- /bin/readlink
  readlink -f /proc/19/exe
  2⤵
  PID:785
- /bin/readlink
  readlink -f /proc/2/exe
  2⤵
  PID:786
- /bin/readlink
  readlink -f /proc/20/exe
  2⤵
  PID:787
- /bin/readlink
  readlink -f /proc/21/exe
  2⤵
  PID:788
- /bin/readlink
  readlink -f /proc/22/exe
  2⤵
  PID:789
- /bin/readlink
  readlink -f /proc/224/exe
  2⤵
  PID:790
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:792
- /bin/readlink
  readlink -f /proc/23/exe
  2⤵
  PID:793
- /bin/readlink
  readlink -f /proc/24/exe
  2⤵
  PID:794
- /bin/readlink
  readlink -f /proc/25/exe
  2⤵
  PID:795
- /bin/readlink
  readlink -f /proc/26/exe
  2⤵
  PID:796
- /bin/readlink
  readlink -f /proc/27/exe
  2⤵
  PID:797
- /bin/readlink
  readlink -f /proc/277/exe
  2⤵
  PID:798
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:800
- /bin/readlink
  readlink -f /proc/28/exe
  2⤵
  PID:801
- /bin/readlink
  readlink -f /proc/288/exe
  2⤵
  PID:802
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:804
- /bin/readlink
  readlink -f /proc/29/exe
  2⤵
  PID:805
- /bin/readlink
  readlink -f /proc/290/exe
  2⤵
  PID:806
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:808
- /bin/readlink
  readlink -f /proc/295/exe
  2⤵
  PID:809
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:811
- /bin/readlink
  readlink -f /proc/296/exe
  2⤵
  PID:812
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:814
- /bin/readlink
  readlink -f /proc/3/exe
  2⤵
  PID:815
- /bin/readlink
  readlink -f /proc/300/exe
  2⤵
  PID:816
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:818
- /bin/readlink
  readlink -f /proc/317/exe
  2⤵
  PID:819
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:821
- /bin/readlink
  readlink -f /proc/319/exe
  2⤵
  PID:822
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:824
- /bin/readlink
  readlink -f /proc/326/exe
  2⤵
  PID:825
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:827
- /bin/readlink
  readlink -f /proc/4/exe
  2⤵
  PID:828
- /bin/readlink
  readlink -f /proc/41/exe
  2⤵
  PID:829
- /bin/readlink
  readlink -f /proc/42/exe
  2⤵
  PID:830
- /bin/readlink
  readlink -f /proc/43/exe
  2⤵
  PID:831
- /bin/readlink
  readlink -f /proc/5/exe
  2⤵
  PID:832
- /bin/readlink
  readlink -f /proc/564/exe
  2⤵
  PID:833
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:835
- /bin/readlink
  readlink -f /proc/576/exe
  2⤵
  PID:836
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:838
- /bin/readlink
  readlink -f /proc/578/exe
  2⤵
  PID:839
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:841
- /bin/readlink
  readlink -f /proc/583/exe
  2⤵
  PID:842
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:844
- /bin/readlink
  readlink -f /proc/584/exe
  2⤵
  PID:845
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:847
- /bin/readlink
  readlink -f /proc/6/exe
  2⤵
  PID:848
- /bin/readlink
  readlink -f /proc/639/exe
  2⤵
  PID:849
- /bin/readlink
  readlink -f /proc/640/exe
  2⤵
  PID:850
- /bin/readlink
  readlink -f /proc/641/exe
  2⤵
  PID:851
- /bin/readlink
  readlink -f /proc/642/exe
  2⤵
  PID:852
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:854
- /bin/readlink
  readlink -f /proc/652/exe
  2⤵
  PID:855
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:857
- /bin/readlink
  readlink -f /proc/7/exe
  2⤵
  PID:858
- /bin/readlink
  readlink -f /proc/74/exe
  2⤵
  PID:859
- /bin/readlink
  readlink -f /proc/761/exe
  2⤵
  PID:860
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:862
- /bin/readlink
  readlink -f /proc/8/exe
  2⤵
  PID:863
- /bin/readlink
  readlink -f /proc/9/exe
  2⤵
  PID:864
- /bin/readlink
  readlink -f /proc/96/exe
  2⤵
  PID:865
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:866
- /usr/bin/awk
  awk "{if(\$3>=70.0) print \$2}"
  2⤵
  PID:868
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:869
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:870
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:870
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:870
- - /usr/bin/kill
    kill -9
    3⤵
    PID:870
- - /sbin/kill
    kill -9
    3⤵
    PID:870
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:870
- /bin/grep
  grep -v "grep\\|kworkerd\\|npm\\|java\\|tomcat\\|postgres\\|rediserver\\|main\\|mysql\\|systemd\\|kworker\\|docker\\|bad_process\\|Xorg\\|python\\|rsync\\|compiz\\|jenkins\\|nginx\\|apache\\|php-fpm\\|jboss"
  2⤵
  PID:867
- /bin/grep
  grep -v grep
  2⤵
  PID:872
- /bin/grep
  grep "{rediserver}\\|xmrig\\|987645.top\\|test2.sh\\|supportxmr\\|c3pool\\|vmlunix\\|node-f} node\\|javap"
  2⤵
  PID:873
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:871
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:874
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:875
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:880
- /bin/grep
  grep "wget\\|curl\\|wgat\\|wd1\\|import\\|cual\\|/usr/local/bin/node /var/tmp/\\|/usr/local/bin/node /tmp/"
  2⤵
  PID:878
- /bin/grep
  grep -v "grep\\|183.97\\|ccrms"
  2⤵
  PID:877
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:876
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:879
- /bin/grep
  grep "@pts"
  2⤵
  PID:882
- /bin/grep
  grep -v "grep\\|scripts\\|agetty"
  2⤵
  - System Network Configuration Discovery
  PID:883
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:881
- /bin/grep
  grep -v "grep\\|\\["
  2⤵
  PID:886
- /bin/grep
  grep rediserver
  2⤵
  PID:885
- /bin/ps
  ps -fe
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:884
- /usr/bin/pkill
  pkill rediserver
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:887
- /bin/sleep
  sleep 30
  2⤵
  PID:889
- /usr/bin/nohup
  nohup ./rediserver
  2⤵
  PID:888
- /tmp/rediserver
  ./rediserver
  2⤵
  PID:888
- /bin/rm
  rm -f "/var/tmp/*"
  2⤵
  PID:897
- /bin/readlink
  readlink -f /proc/10/exe
  2⤵
  PID:898
- /bin/readlink
  readlink -f /proc/104/exe
  2⤵
  PID:899
- /bin/readlink
  readlink -f /proc/106/exe
  2⤵
  PID:900
- /bin/readlink
  readlink -f /proc/107/exe
  2⤵
  PID:901
- /bin/readlink
  readlink -f /proc/11/exe
  2⤵
  PID:902
- /bin/readlink
  readlink -f /proc/12/exe
  2⤵
  PID:903
- /bin/readlink
  readlink -f /proc/13/exe
  2⤵
  PID:904
- /bin/readlink
  readlink -f /proc/133/exe
  2⤵
  PID:905
- /bin/readlink
  readlink -f /proc/134/exe
  2⤵
  PID:906
- /bin/readlink
  readlink -f /proc/138/exe
  2⤵
  PID:907
- /bin/readlink
  readlink -f /proc/14/exe
  2⤵
  PID:908
- /bin/readlink
  readlink -f /proc/15/exe
  2⤵
  PID:909
- /bin/readlink
  readlink -f /proc/151/exe
  2⤵
  PID:910
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:912
- /bin/readlink
  readlink -f /proc/158/exe
  2⤵
  PID:913
- /bin/readlink
  readlink -f /proc/16/exe
  2⤵
  PID:914
- /bin/readlink
  readlink -f /proc/168/exe
  2⤵
  PID:915
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:917
- /bin/readlink
  readlink -f /proc/17/exe
  2⤵
  PID:918
- /bin/readlink
  readlink -f /proc/18/exe
  2⤵
  PID:919
- /bin/readlink
  readlink -f /proc/19/exe
  2⤵
  PID:920
- /bin/readlink
  readlink -f /proc/2/exe
  2⤵
  PID:921
- /bin/readlink
  readlink -f /proc/20/exe
  2⤵
  PID:922
- /bin/readlink
  readlink -f /proc/21/exe
  2⤵
  PID:923
- /bin/readlink
  readlink -f /proc/22/exe
  2⤵
  PID:924
- /bin/readlink
  readlink -f /proc/224/exe
  2⤵
  PID:925
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:927
- /bin/readlink
  readlink -f /proc/23/exe
  2⤵
  PID:928
- /bin/readlink
  readlink -f /proc/24/exe
  2⤵
  PID:929
- /bin/readlink
  readlink -f /proc/25/exe
  2⤵
  PID:930
- /bin/readlink
  readlink -f /proc/26/exe
  2⤵
  PID:931
- /bin/readlink
  readlink -f /proc/27/exe
  2⤵
  PID:932
- /bin/readlink
  readlink -f /proc/277/exe
  2⤵
  PID:933
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:935
- /bin/readlink
  readlink -f /proc/28/exe
  2⤵
  PID:936
- /bin/readlink
  readlink -f /proc/288/exe
  2⤵
  PID:937
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:939
- /bin/readlink
  readlink -f /proc/29/exe
  2⤵
  PID:940
- /bin/readlink
  readlink -f /proc/290/exe
  2⤵
  PID:941
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:943
- /bin/readlink
  readlink -f /proc/295/exe
  2⤵
  PID:944
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:946
- /bin/readlink
  readlink -f /proc/296/exe
  2⤵
  PID:947
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:949
- /bin/readlink
  readlink -f /proc/3/exe
  2⤵
  PID:950
- /bin/readlink
  readlink -f /proc/300/exe
  2⤵
  PID:951
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:953
- /bin/readlink
  readlink -f /proc/317/exe
  2⤵
  PID:954
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:956
- /bin/readlink
  readlink -f /proc/319/exe
  2⤵
  PID:957
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:959
- /bin/readlink
  readlink -f /proc/326/exe
  2⤵
  PID:960
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:962
- /bin/readlink
  readlink -f /proc/4/exe
  2⤵
  PID:963
- /bin/readlink
  readlink -f /proc/41/exe
  2⤵
  PID:964
- /bin/readlink
  readlink -f /proc/42/exe
  2⤵
  PID:965
- /bin/readlink
  readlink -f /proc/43/exe
  2⤵
  PID:966
- /bin/readlink
  readlink -f /proc/5/exe
  2⤵
  PID:967
- /bin/readlink
  readlink -f /proc/564/exe
  2⤵
  PID:968
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:970
- /bin/readlink
  readlink -f /proc/576/exe
  2⤵
  PID:971
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:973
- /bin/readlink
  readlink -f /proc/578/exe
  2⤵
  PID:974
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:976
- /bin/readlink
  readlink -f /proc/583/exe
  2⤵
  PID:977
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:979
- /bin/readlink
  readlink -f /proc/584/exe
  2⤵
  PID:980
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:982
- /bin/readlink
  readlink -f /proc/6/exe
  2⤵
  PID:983
- /bin/readlink
  readlink -f /proc/639/exe
  2⤵
  PID:984
- /bin/readlink
  readlink -f /proc/640/exe
  2⤵
  PID:985
- /bin/readlink
  readlink -f /proc/641/exe
  2⤵
  PID:986
- /bin/readlink
  readlink -f /proc/642/exe
  2⤵
  PID:987
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:989
- /bin/readlink
  readlink -f /proc/652/exe
  2⤵
  PID:990
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:992
- /bin/readlink
  readlink -f /proc/7/exe
  2⤵
  PID:993
- /bin/readlink
  readlink -f /proc/74/exe
  2⤵
  PID:994
- /bin/readlink
  readlink -f /proc/8/exe
  2⤵
  PID:995
- /bin/readlink
  readlink -f /proc/890/exe
  2⤵
  PID:996
- /bin/readlink
  readlink -f /proc/896/exe
  2⤵
  PID:997
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:999
- /bin/readlink
  readlink -f /proc/9/exe
  2⤵
  PID:1000
- /bin/readlink
  readlink -f /proc/96/exe
  2⤵
  PID:1001
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1005
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1006
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1006
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1006
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1006
- - /sbin/kill
    kill -9
    3⤵
    PID:1006
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:1006
- /bin/grep
  grep -v "grep\\|kworkerd\\|npm\\|java\\|tomcat\\|postgres\\|rediserver\\|main\\|mysql\\|systemd\\|kworker\\|docker\\|bad_process\\|Xorg\\|python\\|rsync\\|compiz\\|jenkins\\|nginx\\|apache\\|php-fpm\\|jboss"
  2⤵
  PID:1003
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1002
- /usr/bin/awk
  awk "{if(\$3>=70.0) print \$2}"
  2⤵
  PID:1004
- /bin/grep
  grep "{rediserver}\\|xmrig\\|987645.top\\|test2.sh\\|supportxmr\\|c3pool\\|vmlunix\\|node-f} node\\|javap"
  2⤵
  PID:1009
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1010
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1011
- /bin/grep
  grep -v grep
  2⤵
  PID:1008
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:1007
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1015
- /bin/grep
  grep "wget\\|curl\\|wgat\\|wd1\\|import\\|cual\\|/usr/local/bin/node /var/tmp/\\|/usr/local/bin/node /tmp/"
  2⤵
  PID:1014
- /bin/grep
  grep -v "grep\\|183.97\\|ccrms"
  2⤵
  PID:1013
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  PID:1012
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1016
- /bin/grep
  grep -v "grep\\|scripts\\|agetty"
  2⤵
  - System Network Configuration Discovery
  PID:1019
- /bin/grep
  grep "@pts"
  2⤵
  PID:1018
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:1017
- /bin/grep
  grep rediserver
  2⤵
  PID:1021
- /bin/grep
  grep -v "grep\\|\\["
  2⤵
  PID:1022
- /bin/ps
  ps -fe
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1020
- /usr/bin/pkill
  pkill rediserver
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1023
- /bin/sleep
  sleep 30
  2⤵
  PID:1025
- /usr/bin/nohup
  nohup ./rediserver
  2⤵
  PID:1024
- /tmp/rediserver
  ./rediserver
  2⤵
  PID:1024
- /bin/rm
  rm -f "/var/tmp/*"
  2⤵
  PID:1032
- /bin/readlink
  readlink -f /proc/10/exe
  2⤵
  PID:1033
- /bin/readlink
  readlink -f /proc/1031/exe
  2⤵
  PID:1034
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:1036
- /bin/readlink
  readlink -f /proc/104/exe
  2⤵
  PID:1037
- /bin/readlink
  readlink -f /proc/106/exe
  2⤵
  PID:1038
- /bin/readlink
  readlink -f /proc/107/exe
  2⤵
  PID:1039
- /bin/readlink
  readlink -f /proc/11/exe
  2⤵
  PID:1040
- /bin/readlink
  readlink -f /proc/12/exe
  2⤵
  PID:1041
- /bin/readlink
  readlink -f /proc/13/exe
  2⤵
  PID:1042
- /bin/readlink
  readlink -f /proc/133/exe
  2⤵
  PID:1043
- /bin/readlink
  readlink -f /proc/134/exe
  2⤵
  PID:1044
- /bin/readlink
  readlink -f /proc/138/exe
  2⤵
  PID:1045
- /bin/readlink
  readlink -f /proc/14/exe
  2⤵
  PID:1046
- /bin/readlink
  readlink -f /proc/15/exe
  2⤵
  PID:1047
- /bin/readlink
  readlink -f /proc/151/exe
  2⤵
  PID:1048
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:1050
- /bin/readlink
  readlink -f /proc/158/exe
  2⤵
  PID:1051
- /bin/readlink
  readlink -f /proc/16/exe
  2⤵
  PID:1052
- /bin/readlink
  readlink -f /proc/168/exe
  2⤵
  PID:1053
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:1055
- /bin/readlink
  readlink -f /proc/17/exe
  2⤵
  PID:1056
- /bin/readlink
  readlink -f /proc/18/exe
  2⤵
  PID:1057
- /bin/readlink
  readlink -f /proc/19/exe
  2⤵
  PID:1058
- /bin/readlink
  readlink -f /proc/2/exe
  2⤵
  PID:1059
- /bin/readlink
  readlink -f /proc/20/exe
  2⤵
  PID:1060
- /bin/readlink
  readlink -f /proc/21/exe
  2⤵
  PID:1061
- /bin/readlink
  readlink -f /proc/22/exe
  2⤵
  PID:1062
- /bin/readlink
  readlink -f /proc/224/exe
  2⤵
  PID:1063
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:1065
- /bin/readlink
  readlink -f /proc/23/exe
  2⤵
  PID:1066
- /bin/readlink
  readlink -f /proc/24/exe
  2⤵
  PID:1067
- /bin/readlink
  readlink -f /proc/25/exe
  2⤵
  PID:1068
- /bin/readlink
  readlink -f /proc/26/exe
  2⤵
  PID:1069
- /bin/readlink
  readlink -f /proc/27/exe
  2⤵
  PID:1070
- /bin/readlink
  readlink -f /proc/277/exe
  2⤵
  PID:1071
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:1073
- /bin/readlink
  readlink -f /proc/28/exe
  2⤵
  PID:1074
- /bin/readlink
  readlink -f /proc/288/exe
  2⤵
  PID:1075
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:1077
- /bin/readlink
  readlink -f /proc/29/exe
  2⤵
  PID:1078
- /bin/readlink
  readlink -f /proc/290/exe
  2⤵
  PID:1079
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:1081
- /bin/readlink
  readlink -f /proc/295/exe
  2⤵
  PID:1082
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:1084
- /bin/readlink
  readlink -f /proc/296/exe
  2⤵
  PID:1085
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:1087
- /bin/readlink
  readlink -f /proc/3/exe
  2⤵
  PID:1088
- /bin/readlink
  readlink -f /proc/300/exe
  2⤵
  PID:1089
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:1091
- /bin/readlink
  readlink -f /proc/317/exe
  2⤵
  PID:1092
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:1094
- /bin/readlink
  readlink -f /proc/319/exe
  2⤵
  PID:1095
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:1097
- /bin/readlink
  readlink -f /proc/326/exe
  2⤵
  PID:1098
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:1100
- /bin/readlink
  readlink -f /proc/4/exe
  2⤵
  PID:1101
- /bin/readlink
  readlink -f /proc/41/exe
  2⤵
  PID:1102
- /bin/readlink
  readlink -f /proc/42/exe
  2⤵
  PID:1103
- /bin/readlink
  readlink -f /proc/43/exe
  2⤵
  PID:1104
- /bin/readlink
  readlink -f /proc/5/exe
  2⤵
  PID:1105
- /bin/readlink
  readlink -f /proc/564/exe
  2⤵
  PID:1106
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:1108
- /bin/readlink
  readlink -f /proc/576/exe
  2⤵
  PID:1109
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:1111
- /bin/readlink
  readlink -f /proc/578/exe
  2⤵
  PID:1112
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:1114
- /bin/readlink
  readlink -f /proc/583/exe
  2⤵
  PID:1115
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:1117
- /bin/readlink
  readlink -f /proc/584/exe
  2⤵
  PID:1118
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:1120
- /bin/readlink
  readlink -f /proc/6/exe
  2⤵
  PID:1121
- /bin/readlink
  readlink -f /proc/639/exe
  2⤵
  PID:1122
- /bin/readlink
  readlink -f /proc/640/exe
  2⤵
  PID:1123
- /bin/readlink
  readlink -f /proc/641/exe
  2⤵
  PID:1124
- /bin/readlink
  readlink -f /proc/642/exe
  2⤵
  PID:1125
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:1127
- /bin/readlink
  readlink -f /proc/652/exe
  2⤵
  PID:1128
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:1130
- /bin/readlink
  readlink -f /proc/7/exe
  2⤵
  PID:1131
- /bin/readlink
  readlink -f /proc/74/exe
  2⤵
  PID:1132
- /bin/readlink
  readlink -f /proc/8/exe
  2⤵
  PID:1133
- /bin/readlink
  readlink -f /proc/890/exe
  2⤵
  PID:1134
- /bin/readlink
  readlink -f /proc/9/exe
  2⤵
  PID:1135
- /bin/readlink
  readlink -f /proc/96/exe
  2⤵
  PID:1136
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1140
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1141
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1141
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1141
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1141
- - /sbin/kill
    kill -9
    3⤵
    PID:1141
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:1141
- /bin/grep
  grep -v "grep\\|kworkerd\\|npm\\|java\\|tomcat\\|postgres\\|rediserver\\|main\\|mysql\\|systemd\\|kworker\\|docker\\|bad_process\\|Xorg\\|python\\|rsync\\|compiz\\|jenkins\\|nginx\\|apache\\|php-fpm\\|jboss"
  2⤵
  PID:1138
- /usr/bin/awk
  awk "{if(\$3>=70.0) print \$2}"
  2⤵
  PID:1139
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1137
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1145
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1146
- /bin/grep
  grep -v grep
  2⤵
  PID:1143
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:1142
- /bin/grep
  grep "{rediserver}\\|xmrig\\|987645.top\\|test2.sh\\|supportxmr\\|c3pool\\|vmlunix\\|node-f} node\\|javap"
  2⤵
  PID:1144
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1151
- /bin/grep
  grep "wget\\|curl\\|wgat\\|wd1\\|import\\|cual\\|/usr/local/bin/node /var/tmp/\\|/usr/local/bin/node /tmp/"
  2⤵
  PID:1149
- /bin/grep
  grep -v "grep\\|183.97\\|ccrms"
  2⤵
  PID:1148
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:1147
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1150
- /bin/grep
  grep -v "grep\\|scripts\\|agetty"
  2⤵
  - System Network Configuration Discovery
  PID:1154
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:1152
- /bin/grep
  grep "@pts"
  2⤵
  PID:1153
- /bin/grep
  grep -v "grep\\|\\["
  2⤵
  PID:1157
- /bin/grep
  grep rediserver
  2⤵
  PID:1156
- /bin/ps
  ps -fe
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1155
- /usr/bin/pkill
  pkill rediserver
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1158
- /bin/sleep
  sleep 30
  2⤵
  PID:1160
- /usr/bin/nohup
  nohup ./rediserver
  2⤵
  PID:1159
- /tmp/rediserver
  ./rediserver
  2⤵
  PID:1159
- /bin/rm
  rm -f "/var/tmp/*"
  2⤵
  PID:1167
- /bin/readlink
  readlink -f /proc/10/exe
  2⤵
  PID:1168
- /bin/readlink
  readlink -f /proc/104/exe
  2⤵
  PID:1169
- /bin/readlink
  readlink -f /proc/106/exe
  2⤵
  PID:1170
- /bin/readlink
  readlink -f /proc/107/exe
  2⤵
  PID:1171
- /bin/readlink
  readlink -f /proc/11/exe
  2⤵
  PID:1172
- /bin/readlink
  readlink -f /proc/1166/exe
  2⤵
  PID:1173
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:1175
- /bin/readlink
  readlink -f /proc/12/exe
  2⤵
  PID:1176
- /bin/readlink
  readlink -f /proc/13/exe
  2⤵
  PID:1177
- /bin/readlink
  readlink -f /proc/133/exe
  2⤵
  PID:1178
- /bin/readlink
  readlink -f /proc/134/exe
  2⤵
  PID:1179
- /bin/readlink
  readlink -f /proc/138/exe
  2⤵
  PID:1180
- /bin/readlink
  readlink -f /proc/14/exe
  2⤵
  PID:1181
- /bin/readlink
  readlink -f /proc/15/exe
  2⤵
  PID:1182
- /bin/readlink
  readlink -f /proc/151/exe
  2⤵
  PID:1183
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:1185
- /bin/readlink
  readlink -f /proc/158/exe
  2⤵
  PID:1186
- /bin/readlink
  readlink -f /proc/16/exe
  2⤵
  PID:1187
- /bin/readlink
  readlink -f /proc/168/exe
  2⤵
  PID:1188
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:1190
- /bin/readlink
  readlink -f /proc/17/exe
  2⤵
  PID:1191
- /bin/readlink
  readlink -f /proc/18/exe
  2⤵
  PID:1192
- /bin/readlink
  readlink -f /proc/19/exe
  2⤵
  PID:1193
- /bin/readlink
  readlink -f /proc/2/exe
  2⤵
  PID:1194
- /bin/readlink
  readlink -f /proc/20/exe
  2⤵
  PID:1195
- /bin/readlink
  readlink -f /proc/21/exe
  2⤵
  PID:1196
- /bin/readlink
  readlink -f /proc/22/exe
  2⤵
  PID:1197
- /bin/readlink
  readlink -f /proc/224/exe
  2⤵
  PID:1198
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:1200
- /bin/readlink
  readlink -f /proc/23/exe
  2⤵
  PID:1201
- /bin/readlink
  readlink -f /proc/24/exe
  2⤵
  PID:1202
- /bin/readlink
  readlink -f /proc/25/exe
  2⤵
  PID:1203
- /bin/readlink
  readlink -f /proc/26/exe
  2⤵
  PID:1204
- /bin/readlink
  readlink -f /proc/27/exe
  2⤵
  PID:1205
- /bin/readlink
  readlink -f /proc/277/exe
  2⤵
  PID:1206
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:1208
- /bin/readlink
  readlink -f /proc/28/exe
  2⤵
  PID:1209
- /bin/readlink
  readlink -f /proc/288/exe
  2⤵
  PID:1210
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:1212
- /bin/readlink
  readlink -f /proc/29/exe
  2⤵
  PID:1213
- /bin/readlink
  readlink -f /proc/290/exe
  2⤵
  PID:1214
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:1216
- /bin/readlink
  readlink -f /proc/295/exe
  2⤵
  PID:1217
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:1219
- /bin/readlink
  readlink -f /proc/296/exe
  2⤵
  PID:1220
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:1222
- /bin/readlink
  readlink -f /proc/3/exe
  2⤵
  PID:1223
- /bin/readlink
  readlink -f /proc/300/exe
  2⤵
  PID:1224
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:1226
- /bin/readlink
  readlink -f /proc/317/exe
  2⤵
  PID:1227
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:1229
- /bin/readlink
  readlink -f /proc/319/exe
  2⤵
  PID:1230
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:1232
- /bin/readlink
  readlink -f /proc/326/exe
  2⤵
  PID:1233
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:1235
- /bin/readlink
  readlink -f /proc/4/exe
  2⤵
  PID:1236
- /bin/readlink
  readlink -f /proc/41/exe
  2⤵
  PID:1237
- /bin/readlink
  readlink -f /proc/42/exe
  2⤵
  PID:1238
- /bin/readlink
  readlink -f /proc/43/exe
  2⤵
  PID:1239
- /bin/readlink
  readlink -f /proc/5/exe
  2⤵
  PID:1240
- /bin/readlink
  readlink -f /proc/564/exe
  2⤵
  PID:1241
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:1243
- /bin/readlink
  readlink -f /proc/576/exe
  2⤵
  PID:1244
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:1246
- /bin/readlink
  readlink -f /proc/578/exe
  2⤵
  PID:1247
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:1249
- /bin/readlink
  readlink -f /proc/583/exe
  2⤵
  PID:1250
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:1252
- /bin/readlink
  readlink -f /proc/584/exe
  2⤵
  PID:1253
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:1255
- /bin/readlink
  readlink -f /proc/6/exe
  2⤵
  PID:1256
- /bin/readlink
  readlink -f /proc/639/exe
  2⤵
  PID:1257
- /bin/readlink
  readlink -f /proc/640/exe
  2⤵
  PID:1258
- /bin/readlink
  readlink -f /proc/641/exe
  2⤵
  PID:1259
- /bin/readlink
  readlink -f /proc/642/exe
  2⤵
  PID:1260
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:1262
- /bin/readlink
  readlink -f /proc/652/exe
  2⤵
  PID:1263
- /bin/grep
  grep -Eqi "rediserver|/postgres\$"
  2⤵
  PID:1265
- /bin/readlink
  readlink -f /proc/7/exe
  2⤵
  PID:1266
- /bin/readlink
  readlink -f /proc/74/exe
  2⤵
  PID:1267
- /bin/readlink
  readlink -f /proc/8/exe
  2⤵
  PID:1268
- /bin/readlink
  readlink -f /proc/890/exe
  2⤵
  PID:1269
- /bin/readlink
  readlink -f /proc/9/exe
  2⤵
  PID:1270
- /bin/readlink
  readlink -f /proc/96/exe
  2⤵
  PID:1271
- /usr/bin/awk
  awk "{if(\$3>=70.0) print \$2}"
  2⤵
  PID:1274
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1275
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1276
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1276
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1276
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1276
- - /sbin/kill
    kill -9
    3⤵
    PID:1276
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1276
- /bin/grep
  grep -v "grep\\|kworkerd\\|npm\\|java\\|tomcat\\|postgres\\|rediserver\\|main\\|mysql\\|systemd\\|kworker\\|docker\\|bad_process\\|Xorg\\|python\\|rsync\\|compiz\\|jenkins\\|nginx\\|apache\\|php-fpm\\|jboss"
  2⤵
  PID:1273
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1272
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1281
- /bin/grep
  grep "{rediserver}\\|xmrig\\|987645.top\\|test2.sh\\|supportxmr\\|c3pool\\|vmlunix\\|node-f} node\\|javap"
  2⤵
  PID:1279
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1280
- /bin/grep
  grep -v grep
  2⤵
  PID:1278
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:1277
- /bin/grep
  grep "wget\\|curl\\|wgat\\|wd1\\|import\\|cual\\|/usr/local/bin/node /var/tmp/\\|/usr/local/bin/node /tmp/"
  2⤵
  PID:1284
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1285
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1286
- /bin/grep
  grep -v "grep\\|183.97\\|ccrms"
  2⤵
  PID:1283
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:1282
- /bin/grep
  grep -v "grep\\|scripts\\|agetty"
  2⤵
  - System Network Configuration Discovery
  PID:1289
- /bin/grep
  grep "@pts"
  2⤵
  PID:1288
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:1287
- /bin/grep
  grep -v "grep\\|\\["
  2⤵
  PID:1292
- /bin/ps
  ps -fe
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1290
- /bin/grep
  grep rediserver
  2⤵
  PID:1291
- /usr/bin/pkill
  pkill rediserver
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1293
- /bin/sleep
  sleep 30
  2⤵
  PID:1295
- /usr/bin/nohup
  nohup ./rediserver
  2⤵
  PID:1294
- /tmp/rediserver
  ./rediserver
  2⤵
  PID:1294

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads