4e6f69b011c2410f178a1b4528610207fc899727a3371674798a4a038e680b02

Analysis

max time kernel
15s
max time network
14s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
13/09/2026, 16:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5d81829595150eb5f702e5dcc8c0005e95e216e08947fed48b67c35c9ef73708_offset-manipulation.sh
Size 868KB
Sample260913-varvjszfmb
SHA256 4e6f69b011c2410f178a1b4528610207fc899727a3371674798a4a038e680b02
MD5 3cea63cccdf611efa49491728e94ef6d
SHA1 9b4b9773639c3bb8a889248237fa33a8e8cb3b8c
SHA512 97e3af9403f3ad80c61cbd2ecf42902764c3b46f501d43ccf185c5bdb019d51a040d8169374d81241a891aaa239ac4affc085f7869a71e1a47d919f0ab4a93ed
SSDEEP 24576:V4Y/f/tir8ZLQbdyUHiw5y3dSkohUv2653DmIfkej:z/o8ZatHiw5ycMVmKkej
TLSH
T117152338A11A8C74B949EC9CE9AB9E4429147027B609A003767D759C7FFC39CC16B37D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 2 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep

Enumerates kernel/hardware configuration 1 TTPs 4 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-user/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-user/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/11/cmdline	pgrep
File opened for reading	/proc/303/status	pgrep
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/3/cmdline	pgrep
File opened for reading	/proc/25/cmdline	pgrep
File opened for reading	/proc/27/cmdline	pgrep
File opened for reading	/proc/226/status	pgrep
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/self/stat	journalctl
File opened for reading	/proc/1/status	pgrep
File opened for reading	/proc/587/status	pgrep
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/22/status	pgrep
File opened for reading	/proc/8/cmdline	pgrep
File opened for reading	/proc/41/cmdline	pgrep
File opened for reading	/proc/226/status	pgrep
File opened for reading	/proc/11/status	pgrep
File opened for reading	/proc/15/status	pgrep
File opened for reading	/proc/25/status	pgrep
File opened for reading	/proc/42/cmdline	pgrep
File opened for reading	/proc/170/status	pgrep
File opened for reading	/proc/588/cmdline	pgrep
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/2/cmdline	pgrep
File opened for reading	/proc/109/status	pgrep
File opened for reading	/proc/170/cmdline	pgrep
File opened for reading	/proc/649/status	pgrep
File opened for reading	/proc/18/status	pgrep
File opened for reading	/proc/28/status	pgrep
File opened for reading	/proc/317/status	pgrep
File opened for reading	/proc/170/status	pgrep
File opened for reading	/proc/592/cmdline	pgrep
File opened for reading	/proc/593/cmdline	pgrep
File opened for reading	/proc/1000/cmdline	pgrep
File opened for reading	/proc/317/cmdline	pgrep
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/291/cmdline	pgrep
File opened for reading	/proc/645/cmdline	pgrep
File opened for reading	/proc/11/cmdline	pgrep
File opened for reading	/proc/17/status	pgrep
File opened for reading	/proc/23/cmdline	pgrep
File opened for reading	/proc/109/cmdline	pgrep
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/42/cmdline	pgrep
File opened for reading	/proc/16/cmdline	pgrep
File opened for reading	/proc/645/cmdline	pgrep
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/7/status	pgrep
File opened for reading	/proc/17/status	pgrep
File opened for reading	/proc/26/cmdline	pgrep
File opened for reading	/proc/107/cmdline	pgrep
File opened for reading	/proc/303/status	pgrep
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/1/cmdline	pgrep
File opened for reading	/proc/2/cmdline	pgrep
File opened for reading	/proc/9/status	pgrep
File opened for reading	/proc/19/cmdline	pgrep

System Network Configuration Discovery 1 TTPs 2 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
651	5d81829595150eb5f702e5dcc8c0005e95e216e08947fed48b67c35c9ef73708_offset-manipulation.sh
678	dirname

Writes file to tmp directory 4 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/sh-thd.I8d7B6	5d81829595150eb5f702e5dcc8c0005e95e216e08947fed48b67c35c9ef73708_offset-manipulation.sh
File opened for modification	/tmp/reports/scan_debian9-armhf-20260513-en-7_20260913_192142.txt	5d81829595150eb5f702e5dcc8c0005e95e216e08947fed48b67c35c9ef73708_offset-manipulation.sh
File opened for modification	/tmp/tmp.pOIk7nLWaJ	mktemp
File opened for modification	/tmp/tmp.pOIk7nLWaJ	5d81829595150eb5f702e5dcc8c0005e95e216e08947fed48b67c35c9ef73708_offset-manipulation.sh

/tmp/5d81829595150eb5f702e5dcc8c0005e95e216e08947fed48b67c35c9ef73708_offset-manipulation.sh
/tmp/5d81829595150eb5f702e5dcc8c0005e95e216e08947fed48b67c35c9ef73708_offset-manipulation.sh
1⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:651
- /bin/date
  date "+%s"
  2⤵
  PID:674
- /usr/bin/dirname
  dirname /tmp/5d81829595150eb5f702e5dcc8c0005e95e216e08947fed48b67c35c9ef73708_offset-manipulation.sh
  2⤵
  - System Network Configuration Discovery
  PID:678
- /bin/mkdir
  mkdir -p /tmp/reports
  2⤵
  - Reads runtime system information
  PID:681
- /bin/date
  date -u "+%Y%m%d_%H%M%S"
  2⤵
  PID:682
- /bin/hostname
  hostname
  2⤵
  PID:685
- /usr/bin/tr
  tr "[:upper:]" "[:lower:]"
  2⤵
  PID:686
- /usr/bin/tr
  tr -cd a-z0-9-
  2⤵
  PID:687
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:690
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:693
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:697
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:700
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:703
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:706
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:709
- /bin/date
  date -u "+%Y-%m-%d %H:%M:%S UTC"
  2⤵
  PID:710
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:713
- /bin/hostname
  hostname
  2⤵
  PID:714
- /usr/bin/whoami
  whoami
  2⤵
  PID:715
- /usr/bin/id
  id -u
  2⤵
  PID:716
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:719
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:722
- /usr/bin/id
  id -u
  2⤵
  PID:723
- /usr/bin/awk
  awk -F: "\$3>=500 && \$6!=\"\" {print \$6}" /etc/passwd
  2⤵
  - Reads runtime system information
  PID:725
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:728
- /bin/mktemp
  mktemp
  2⤵
  - Writes file to tmp directory
  PID:729
- /usr/bin/python3
  python3 -c " import site for p in site.getsitepackages(): print(p) try: print(site.getusersitepackages()) except: pass "
  2⤵
  PID:730
- /usr/bin/python
  python -c " import site for p in site.getsitepackages(): print(p) try: print(site.getusersitepackages()) except: pass "
  2⤵
  PID:732
- /usr/bin/python2
  python2 -c " import site for p in site.getsitepackages(): print(p) try: print(site.getusersitepackages()) except: pass "
  2⤵
  PID:736
- /usr/bin/find
  find /home -maxdepth 5 -path "*/Library" -prune -o -path "*/node_modules" -prune -o -path "*/.git" -prune -o -path "*/.cache" -prune -o -path "*/.Trash" -prune -o -path "*/docker/overlay2" -prune -o "(" -name site-packages -o -name dist-packages ")" -type d -print0
  2⤵
  PID:744
- /usr/bin/find
  find /root -maxdepth 5 -path "*/Library" -prune -o -path "*/node_modules" -prune -o -path "*/.git" -prune -o -path "*/.cache" -prune -o -path "*/.Trash" -prune -o -path "*/docker/overlay2" -prune -o "(" -name site-packages -o -name dist-packages ")" -type d -print0
  2⤵
  - Reads runtime system information
  PID:746
- /usr/bin/find
  find /opt -maxdepth 5 -path "*/Library" -prune -o -path "*/node_modules" -prune -o -path "*/.git" -prune -o -path "*/.cache" -prune -o -path "*/.Trash" -prune -o -path "*/docker/overlay2" -prune -o "(" -name site-packages -o -name dist-packages ")" -type d -print0
  2⤵
  PID:748
- /usr/bin/find
  find /srv -maxdepth 5 -path "*/Library" -prune -o -path "*/node_modules" -prune -o -path "*/.git" -prune -o -path "*/.cache" -prune -o -path "*/.Trash" -prune -o -path "*/docker/overlay2" -prune -o "(" -name site-packages -o -name dist-packages ")" -type d -print0
  2⤵
  PID:750
- /usr/bin/find
  find /tmp -maxdepth 5 -path "*/Library" -prune -o -path "*/node_modules" -prune -o -path "*/.git" -prune -o -path "*/.cache" -prune -o -path "*/.Trash" -prune -o -path "*/docker/overlay2" -prune -o "(" -name site-packages -o -name dist-packages ")" -type d -print0
  2⤵
  PID:752
- /usr/bin/find
  find /var/lib -maxdepth 5 -path "*/Library" -prune -o -path "*/node_modules" -prune -o -path "*/.git" -prune -o -path "*/.cache" -prune -o -path "*/.Trash" -prune -o -path "*/docker/overlay2" -prune -o "(" -name site-packages -o -name dist-packages ")" -type d -print0
  2⤵
  PID:755
- /usr/bin/find
  find /var/opt -maxdepth 5 -path "*/Library" -prune -o -path "*/node_modules" -prune -o -path "*/.git" -prune -o -path "*/.cache" -prune -o -path "*/.Trash" -prune -o -path "*/docker/overlay2" -prune -o "(" -name site-packages -o -name dist-packages ")" -type d -print0
  2⤵
  PID:760
- /usr/bin/find
  find /usr/local -maxdepth 5 -path "*/Library" -prune -o -path "*/node_modules" -prune -o -path "*/.git" -prune -o -path "*/.cache" -prune -o -path "*/.Trash" -prune -o -path "*/docker/overlay2" -prune -o "(" -name site-packages -o -name dist-packages ")" -type d -print0
  2⤵
  PID:763
- /usr/bin/find
  find /usr/lib -maxdepth 5 -path "*/Library" -prune -o -path "*/node_modules" -prune -o -path "*/.git" -prune -o -path "*/.cache" -prune -o -path "*/.Trash" -prune -o -path "*/docker/overlay2" -prune -o "(" -name site-packages -o -name dist-packages ")" -type d -print0
  2⤵
  PID:766
- /usr/bin/sort
  sort -zu
  2⤵
  PID:791
- /bin/rm
  rm -f /tmp/tmp.pOIk7nLWaJ
  2⤵
  PID:792
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:795
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:798
- /bin/date
  date "+%s"
  2⤵
  PID:801
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:804
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:807
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:810
- /bin/date
  date "+%s"
  2⤵
  PID:813
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  - Reads runtime system information
  PID:816
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:819
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:822
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:825
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  - Reads runtime system information
  PID:828
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:831
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:834
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:837
- /bin/date
  date "+%s"
  2⤵
  PID:840
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:843
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:846
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:849
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:852
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:855
- /bin/date
  date "+%s"
  2⤵
  PID:858
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:861
- /bin/systemctl
  systemctl --user is-active sysmon.service
  2⤵
  - Enumerates kernel/hardware configuration
  PID:862
- /bin/systemctl
  systemctl --user is-enabled sysmon.service
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:863
- /usr/bin/id
  id -u
  2⤵
  PID:864
- /bin/systemctl
  systemctl is-active sysmon.service
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:865
- /bin/systemctl
  systemctl is-enabled sysmon.service
  2⤵
  - Enumerates kernel/hardware configuration
  PID:866
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:873
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:877
- /bin/date
  date "+%s"
  2⤵
  PID:881
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:886
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:890
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:894
- /bin/date
  date "+%s"
  2⤵
  PID:899
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:903
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:907
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:912
- /bin/date
  date "+%s"
  2⤵
  PID:916
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:920
- /usr/bin/find
  find /usr/lib/python2.7/dist-packages/litellm -name "*.py" -type f -print0
  2⤵
  - Reads runtime system information
  PID:924
- /usr/bin/find
  find /usr/lib/python3/dist-packages/litellm -name "*.py" -type f -print0
  2⤵
  PID:927
- /usr/bin/find
  find /usr/local/lib/python2.7/dist-packages/litellm -name "*.py" -type f -print0
  2⤵
  PID:930
- /usr/bin/find
  find /usr/local/lib/python2.7/site-packages/litellm -name "*.py" -type f -print0
  2⤵
  PID:933
- /usr/bin/find
  find /usr/local/lib/python3.5/dist-packages/litellm -name "*.py" -type f -print0
  2⤵
  PID:936
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:941
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  - Reads runtime system information
  PID:946
- /bin/date
  date "+%s"
  2⤵
  PID:950
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:954
- /bin/grep
  grep -qi "sysmon\\.py\\|config/sysmon"
  2⤵
  PID:956
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:955
- /bin/grep
  grep -qi "sysmon\\.py\\|config/sysmon" /etc/cron.daily/apt-compat
  2⤵
  PID:957
- /bin/grep
  grep -qi "sysmon\\.py\\|config/sysmon" /etc/cron.daily/bsdmainutils
  2⤵
  PID:958
- /bin/grep
  grep -qi "sysmon\\.py\\|config/sysmon" /etc/cron.daily/dpkg
  2⤵
  PID:959
- /bin/grep
  grep -qi "sysmon\\.py\\|config/sysmon" /etc/cron.daily/exim4-base
  2⤵
  PID:960
- /bin/grep
  grep -qi "sysmon\\.py\\|config/sysmon" /etc/cron.daily/logrotate
  2⤵
  PID:961
- /bin/grep
  grep -qi "sysmon\\.py\\|config/sysmon" /etc/cron.daily/passwd
  2⤵
  PID:962
- /bin/grep
  grep -qi "sysmon\\.py\\|config/sysmon" /etc/crontab
  2⤵
  PID:963
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:966
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:969
- /bin/date
  date "+%s"
  2⤵
  PID:972
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:975
- /bin/grep
  grep -qi models.litellm.cloud /var/log/syslog
  2⤵
  PID:976
- /bin/grep
  grep -qi checkmarx.zone /var/log/syslog
  2⤵
  PID:977
- /bin/grep
  grep -qi models.litellm.cloud /var/log/messages
  2⤵
  PID:978
- /bin/grep
  grep -qi checkmarx.zone /var/log/messages
  2⤵
  PID:979
- /bin/grep
  grep -qi models.litellm.cloud /var/log/daemon.log
  2⤵
  PID:980
- /bin/grep
  grep -qi checkmarx.zone /var/log/daemon.log
  2⤵
  PID:981
- /bin/journalctl
  journalctl --no-pager -q --since "7 days ago"
  2⤵
  - Reads runtime system information
  PID:982
- /bin/grep
  grep -qi models.litellm.cloud
  2⤵
  PID:983
- /bin/grep
  grep -qi checkmarx.zone
  2⤵
  PID:985
- /bin/journalctl
  journalctl --no-pager -q --since "7 days ago"
  2⤵
  PID:984
- /bin/journalctl
  journalctl --no-pager -q -u sysmon.service --since "30 days ago"
  2⤵
  PID:986
- /bin/grep
  grep -qiE "(sysmon\\.py|telemetry|litellm|config/sysmon|pglog)"
  2⤵
  PID:987
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:990
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:993
- /bin/date
  date "+%s"
  2⤵
  PID:996
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:999
- /usr/bin/pgrep
  pgrep -f "sysmon\\.py"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1000
- /usr/bin/pgrep
  pgrep -f /tmp/pglog
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1001
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1004
- /usr/bin/getent
  getent hosts models.litellm.cloud
  2⤵
  PID:1003
- /usr/bin/getent
  getent hosts checkmarx.zone
  2⤵
  PID:1006
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  - Reads runtime system information
  PID:1007
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:1010
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:1013
- /bin/date
  date "+%s"
  2⤵
  PID:1016
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:1019
- /bin/grep
  grep -q models.litellm.cloud /etc/hosts
  2⤵
  PID:1020
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  - Reads runtime system information
  PID:1023
- /bin/grep
  grep -q checkmarx.zone /etc/hosts
  2⤵
  PID:1024
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:1027
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:1030
- /bin/date
  date "+%s"
  2⤵
  PID:1033
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:1036
- /usr/bin/find
  find -L /home -maxdepth 4 -path "*/Library" -prune -o -path "*/node_modules" -prune -o -path "*/.git" -prune -o -path "*/.cache" -prune -o "(" -name "requirements*.txt" -o -name constraints.txt -o -name Pipfile -o -name Pipfile.lock -o -name pyproject.toml -o -name setup.py -o -name setup.cfg -o -name poetry.lock -o -name pdm.lock -o -name uv.lock ")" -type f -print0
  2⤵
  - Reads runtime system information
  PID:1038
- /usr/bin/find
  find -L /root -maxdepth 4 -path "*/Library" -prune -o -path "*/node_modules" -prune -o -path "*/.git" -prune -o -path "*/.cache" -prune -o "(" -name "requirements*.txt" -o -name constraints.txt -o -name Pipfile -o -name Pipfile.lock -o -name pyproject.toml -o -name setup.py -o -name setup.cfg -o -name poetry.lock -o -name pdm.lock -o -name uv.lock ")" -type f -print0
  2⤵
  PID:1040
- /usr/bin/find
  find -L /opt -maxdepth 4 -path "*/Library" -prune -o -path "*/node_modules" -prune -o -path "*/.git" -prune -o -path "*/.cache" -prune -o "(" -name "requirements*.txt" -o -name constraints.txt -o -name Pipfile -o -name Pipfile.lock -o -name pyproject.toml -o -name setup.py -o -name setup.cfg -o -name poetry.lock -o -name pdm.lock -o -name uv.lock ")" -type f -print0
  2⤵
  PID:1042
- /usr/bin/find
  find -L /srv -maxdepth 4 -path "*/Library" -prune -o -path "*/node_modules" -prune -o -path "*/.git" -prune -o -path "*/.cache" -prune -o "(" -name "requirements*.txt" -o -name constraints.txt -o -name Pipfile -o -name Pipfile.lock -o -name pyproject.toml -o -name setup.py -o -name setup.cfg -o -name poetry.lock -o -name pdm.lock -o -name uv.lock ")" -type f -print0
  2⤵
  PID:1044
- /usr/bin/find
  find -L /var/lib -maxdepth 4 -path "*/Library" -prune -o -path "*/node_modules" -prune -o -path "*/.git" -prune -o -path "*/.cache" -prune -o "(" -name "requirements*.txt" -o -name constraints.txt -o -name Pipfile -o -name Pipfile.lock -o -name pyproject.toml -o -name setup.py -o -name setup.cfg -o -name poetry.lock -o -name pdm.lock -o -name uv.lock ")" -type f -print0
  2⤵
  PID:1046
- /usr/bin/find
  find -L /var/opt -maxdepth 4 -path "*/Library" -prune -o -path "*/node_modules" -prune -o -path "*/.git" -prune -o -path "*/.cache" -prune -o "(" -name "requirements*.txt" -o -name constraints.txt -o -name Pipfile -o -name Pipfile.lock -o -name pyproject.toml -o -name setup.py -o -name setup.cfg -o -name poetry.lock -o -name pdm.lock -o -name uv.lock ")" -type f -print0
  2⤵
  PID:1048
- /usr/bin/find
  find -L /tmp -maxdepth 4 -path "*/Library" -prune -o -path "*/node_modules" -prune -o -path "*/.git" -prune -o -path "*/.cache" -prune -o "(" -name "requirements*.txt" -o -name constraints.txt -o -name Pipfile -o -name Pipfile.lock -o -name pyproject.toml -o -name setup.py -o -name setup.cfg -o -name poetry.lock -o -name pdm.lock -o -name uv.lock ")" -type f -print0
  2⤵
  PID:1050
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:1053
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:1056
- /bin/date
  date "+%s"
  2⤵
  PID:1059
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:1062
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  - Reads runtime system information
  PID:1065
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  - Reads runtime system information
  PID:1068
- /bin/date
  date "+%s"
  2⤵
  PID:1071
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:1074
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:1077
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:1080
- /bin/date
  date "+%s"
  2⤵
  PID:1083
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:1086
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:1089
- /bin/date
  date "+%s"
  2⤵
  PID:1092
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:1095
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:1098
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:1101
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:1104
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:1107
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:1110
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:1113
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:1116
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:1119
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:1122
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:1125
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  - Reads runtime system information
  PID:1129
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:1132
- /bin/sed
  sed "s/\\[[0-9;]*m//g"
  2⤵
  PID:1135

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact