0f519b9347f0956a4d251873bf70235eb76d0260a8d6ba9289bf5faed84039c1

Analysis

max time kernel
150s
max time network
154s
platform
debian-12_armhf
resource
debian12-armhf-20260127-en
resource tags

arch:armhfimage:debian12-armhf-20260127-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
24/09/2026, 22:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
xdzlewkx.armv7.elf
Size 990KB
Sample260924-2jd4datdpe
SHA256 0f519b9347f0956a4d251873bf70235eb76d0260a8d6ba9289bf5faed84039c1
MD5 a036cfdcd7a8c8c49630a6178f33e4be
SHA1 a2a6a14a4275de6074816d48769975d5b8d28bc6
SHA512 36411373c25037903cb872b89dbce209e1ce3a471b7d8875cd7d309907bdddf13a00eb4ad27d2517ba500ba1874a32cad9447f9cd81496a3964c432c80f6eb28
SSDEEP 24576:0njsG7Gt/l3w+85fEylUkz09sXbU6k7hU/hGnJj:0La/mbUYA6U6k7hUAJj
TLSH
T1B1254B55F8909F63C5D46B7AF65E82A833234778C3E7720699148B383BD7A1F0B3A641
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 2 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
913	sh
915	chmod

Checks hardware identifiers (DMI) 1 TTPs 4 IoCs

Checks DMI information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/sys/class/dmi/id/bios_vendor	xdzlewkx.armv7.elf
File opened for reading	/sys/class/dmi/id/board_vendor	xdzlewkx.armv7.elf
File opened for reading	/sys/class/dmi/id/product_name	xdzlewkx.armv7.elf
File opened for reading	/sys/class/dmi/id/sys_vendor	xdzlewkx.armv7.elf

Enumerates running processes
Discovers information about currently running processes on the system

Reads MAC address of network interface 2 TTPs 2 IoCs

Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.

defense_evasion discovery

System Network Connections Discovery

T1049

Wi-Fi Discovery

T1016.002

description	ioc	Process
File opened for reading	/sys/class/net/lo/address	xdzlewkx.armv7.elf
File opened for reading	/sys/class/net/eth0/address	xdzlewkx.armv7.elf

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	xdzlewkx.armv7.elf

Reads CPU attributes 1 TTPs 1 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	xdzlewkx.armv7.elf

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/class/net	xdzlewkx.armv7.elf

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/5/stat	pkill
File opened for reading	/proc/2/cmdline	pkill
File opened for reading	/proc/348/cmdline	pkill
File opened for reading	/proc/20/cmdline	pkill
File opened for reading	/proc/56/cgroup	pkill
File opened for reading	/proc/864/cmdline	pkill
File opened for reading	/proc/348/status	pkill
File opened for reading	/proc/27/cmdline	pkill
File opened for reading	/proc/254/stat	pkill
File opened for reading	/proc/8/status	pkill
File opened for reading	/proc/864/cmdline	pkill
File opened for reading	/proc/362/cgroup	pkill
File opened for reading	/proc/338/cgroup	pkill
File opened for reading	/proc/805/cgroup	pkill
File opened for reading	/proc/2/ctty	pkill
File opened for reading	/proc/5/cmdline	pkill
File opened for reading	/proc/381/ctty	pkill
File opened for reading	/proc/643/stat	pkill
File opened for reading	/proc/12/cgroup	pkill
File opened for reading	/proc/73/cgroup	pkill
File opened for reading	/proc/193/ctty	pkill
File opened for reading	/proc/805/stat	pkill
File opened for reading	/proc/800/cgroup	pkill
File opened for reading	/proc/18/status	pkill
File opened for reading	/proc/24/ctty	pkill
File opened for reading	/proc/36/cmdline	pkill
File opened for reading	/proc/676/stat	pkill
File opened for reading	/proc/367/stat	pkill
File opened for reading	/proc/9/cgroup	pkill
File opened for reading	/proc/319/status	pkill
File opened for reading	/proc/624/cgroup	pkill
File opened for reading	/proc/2/status	pkill
File opened for reading	/proc/13/cgroup	pkill
File opened for reading	/proc/23/cmdline	pkill
File opened for reading	/proc/775/cmdline	pkill
File opened for reading	/proc/345/ctty	pkill
File opened for reading	/proc/624/stat	pkill
File opened for reading	/proc/10/cmdline	pkill
File opened for reading	/proc/254/status	pkill
File opened for reading	/proc/15/cgroup	pkill
File opened for reading	/proc/143/cmdline	pkill
File opened for reading	/proc/338/status	pkill
File opened for reading	/proc/57/status	pkill
File opened for reading	/proc/643/status	pkill
File opened for reading	/proc/643/cmdline	pkill
File opened for reading	/proc/8/cmdline	pkill
File opened for reading	/proc/313/status	pkill
File opened for reading	/proc/367/cmdline	pkill
File opened for reading	/proc/25/stat	pkill
File opened for reading	/proc/367/stat	pkill
File opened for reading	/proc/4/cgroup	pkill
File opened for reading	/proc/46/cmdline	pkill
File opened for reading	/proc/51/cmdline	pkill
File opened for reading	/proc/683/cgroup	pkill
File opened for reading	/proc/198/cmdline	pkill
File opened for reading	/proc/200/cgroup	pkill
File opened for reading	/proc/348/cmdline	pkill
File opened for reading	/proc/44/cmdline	pkill
File opened for reading	/proc/642/status	pkill
File opened for reading	/proc/683/status	pkill
File opened for reading	/proc/29/cmdline	pkill
File opened for reading	/proc/193/status	pkill
File opened for reading	/proc/1058/ctty	pkill
File opened for reading	/proc/319/ctty	pkill

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.zl	xdzlewkx.armv7.elf

/tmp/xdzlewkx.armv7.elf
/tmp/xdzlewkx.armv7.elf
1⤵
- Checks hardware identifiers (DMI)
- Reads MAC address of network interface
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Writes file to tmp directory
PID:805
- /bin/sh
  sh -c -- "cp /proc/self/exe /var/.z 2>/dev/null && chmod +x /var/.z 2>/dev/null"
  2⤵
  - File and Directory Permissions Modification
  PID:913
- - /usr/bin/cp
    cp /proc/self/exe /var/.z
    3⤵
    PID:914
- - /usr/bin/chmod
    chmod +x /var/.z
    3⤵
    - File and Directory Permissions Modification
    PID:915
- /bin/sh
  sh -c -- "pkill -9 -x kavsvc 2>/dev/null &"
  2⤵
  PID:917
- /bin/sh
  sh -c -- "pkill -9 -x kavf4 2>/dev/null &"
  2⤵
  PID:919
- /bin/sh
  sh -c -- "pkill -9 -x kavguard 2>/dev/null &"
  2⤵
  PID:921
- /bin/sh
  sh -c -- "pkill -9 -x avp 2>/dev/null &"
  2⤵
  PID:923
- /bin/sh
  sh -c -- "pkill -9 -x avp5 2>/dev/null &"
  2⤵
  PID:925
- /bin/sh
  sh -c -- "pkill -9 -x avp6 2>/dev/null &"
  2⤵
  PID:927
- /bin/sh
  sh -c -- "pkill -9 -x msvsc 2>/dev/null &"
  2⤵
  PID:929
- /bin/sh
  sh -c -- "pkill -9 -x msasc 2>/dev/null &"
  2⤵
  PID:931
- /bin/sh
  sh -c -- "pkill -9 -x msmpeng 2>/dev/null &"
  2⤵
  PID:933
- /bin/sh
  sh -c -- "pkill -9 -x msseces 2>/dev/null &"
  2⤵
  PID:935
- /bin/sh
  sh -c -- "pkill -9 -x msseces.exe 2>/dev/null &"
  2⤵
  PID:937
- /bin/sh
  sh -c -- "pkill -9 -x avast 2>/dev/null &"
  2⤵
  PID:939
- /bin/sh
  sh -c -- "pkill -9 -x avast5 2>/dev/null &"
  2⤵
  PID:941
- /bin/sh
  sh -c -- "pkill -9 -x avast6 2>/dev/null &"
  2⤵
  PID:943
- /bin/sh
  sh -c -- "pkill -9 -x avastsvc 2>/dev/null &"
  2⤵
  PID:945
- /bin/sh
  sh -c -- "pkill -9 -x ash 2>/dev/null &"
  2⤵
  PID:947
- /bin/sh
  sh -c -- "pkill -9 -x ashmaisv 2>/dev/null &"
  2⤵
  PID:949
- /bin/sh
  sh -c -- "pkill -9 -x avgnt 2>/dev/null &"
  2⤵
  PID:951
- /bin/sh
  sh -c -- "pkill -9 -x avgnt.exe 2>/dev/null &"
  2⤵
  PID:953
- /bin/sh
  sh -c -- "pkill -9 -x avgnt2 2>/dev/null &"
  2⤵
  PID:955
- /bin/sh
  sh -c -- "pkill -9 -x avgnt3 2>/dev/null &"
  2⤵
  PID:957
- /bin/sh
  sh -c -- "pkill -9 -x clamd 2>/dev/null &"
  2⤵
  PID:959
- /bin/sh
  sh -c -- "pkill -9 -x clamdscan 2>/dev/null &"
  2⤵
  PID:961
- /bin/sh
  sh -c -- "pkill -9 -x clamonacc 2>/dev/null &"
  2⤵
  PID:963
- /bin/sh
  sh -c -- "pkill -9 -x f-prot 2>/dev/null &"
  2⤵
  PID:965
- /bin/sh
  sh -c -- "pkill -9 -x f-prot64 2>/dev/null &"
  2⤵
  PID:967
- /bin/sh
  sh -c -- "pkill -9 -x f-sport 2>/dev/null &"
  2⤵
  PID:969
- /bin/sh
  sh -c -- "pkill -9 -x f-sport64 2>/dev/null &"
  2⤵
  PID:971
- /bin/sh
  sh -c -- "pkill -9 -x smon 2>/dev/null &"
  2⤵
  PID:973
- /bin/sh
  sh -c -- "pkill -9 -x smon2 2>/dev/null &"
  2⤵
  PID:975
- /bin/sh
  sh -c -- "pkill -9 -x smon3 2>/dev/null &"
  2⤵
  PID:977
- /bin/sh
  sh -c -- "pkill -9 -x mcs 2>/dev/null &"
  2⤵
  PID:979
- /bin/sh
  sh -c -- "pkill -9 -x mcs2 2>/dev/null &"
  2⤵
  PID:981
- /bin/sh
  sh -c -- "pkill -9 -x mcs3 2>/dev/null &"
  2⤵
  PID:983
- /bin/sh
  sh -c -- "pkill -9 -x navpsv32 2>/dev/null &"
  2⤵
  PID:985
- /bin/sh
  sh -c -- "pkill -9 -x navpsv64 2>/dev/null &"
  2⤵
  PID:987
- /bin/sh
  sh -c -- "pkill -9 -x navw32 2>/dev/null &"
  2⤵
  PID:989
- /bin/sh
  sh -c -- "pkill -9 -x navw64 2>/dev/null &"
  2⤵
  PID:991
- /bin/sh
  sh -c -- "pkill -9 -x avp.exe 2>/dev/null &"
  2⤵
  PID:993
- /bin/sh
  sh -c -- "pkill -9 -x avpsvc.exe 2>/dev/null &"
  2⤵
  PID:995
- /bin/sh
  sh -c -- "pkill -9 -x avpcc.exe 2>/dev/null &"
  2⤵
  PID:997
- /bin/sh
  sh -c -- "pkill -9 -x avpm.exe 2>/dev/null &"
  2⤵
  PID:999
- /bin/sh
  sh -c -- "pkill -9 -x avp9.exe 2>/dev/null &"
  2⤵
  PID:1001
- /bin/sh
  sh -c -- "pkill -9 -x avp10.exe 2>/dev/null &"
  2⤵
  PID:1003
- /bin/sh
  sh -c -- "pkill -9 -x avp11.exe 2>/dev/null &"
  2⤵
  PID:1005
- /bin/sh
  sh -c -- "pkill -9 -x avp12.exe 2>/dev/null &"
  2⤵
  PID:1007
- /bin/sh
  sh -c -- "pkill -9 -x avp13.exe 2>/dev/null &"
  2⤵
  PID:1009
- /bin/sh
  sh -c -- "pkill -9 -x avp14.exe 2>/dev/null &"
  2⤵
  PID:1011
- /bin/sh
  sh -c -- "pkill -9 -x avp15.exe 2>/dev/null &"
  2⤵
  PID:1013
- /bin/sh
  sh -c -- "pkill -9 -x avp16.exe 2>/dev/null &"
  2⤵
  PID:1015
- /bin/sh
  sh -c -- "pkill -9 -x avp17.exe 2>/dev/null &"
  2⤵
  PID:1017
- /bin/sh
  sh -c -- "pkill -9 -x avp18.exe 2>/dev/null &"
  2⤵
  PID:1019
- /bin/sh
  sh -c -- "pkill -9 -x avp19.exe 2>/dev/null &"
  2⤵
  PID:1021
- /bin/sh
  sh -c -- "pkill -9 -x avp20.exe 2>/dev/null &"
  2⤵
  PID:1023
- /bin/sh
  sh -c -- "pkill -9 -x avp21.exe 2>/dev/null &"
  2⤵
  PID:1025
- /bin/sh
  sh -c -- "pkill -9 -x avp22.exe 2>/dev/null &"
  2⤵
  PID:1027
- /bin/sh
  sh -c -- "pkill -9 -x avp23.exe 2>/dev/null &"
  2⤵
  PID:1029
- /bin/sh
  sh -c -- "pkill -9 -x avp24.exe 2>/dev/null &"
  2⤵
  PID:1031
- /bin/sh
  sh -c -- "pkill -9 -x avp25.exe 2>/dev/null &"
  2⤵
  PID:1033
- /bin/sh
  sh -c -- "pkill -9 -x avp26.exe 2>/dev/null &"
  2⤵
  PID:1035
- /bin/sh
  sh -c -- "pkill -9 -x avp27.exe 2>/dev/null &"
  2⤵
  PID:1037
- /bin/sh
  sh -c -- "pkill -9 -x avp28.exe 2>/dev/null &"
  2⤵
  PID:1039
- /bin/sh
  sh -c -- "pkill -9 -x avp29.exe 2>/dev/null &"
  2⤵
  PID:1041
- /bin/sh
  sh -c -- "pkill -9 -x avp30.exe 2>/dev/null &"
  2⤵
  PID:1043
- /bin/sh
  sh -c -- "pkill -9 -x avp31.exe 2>/dev/null &"
  2⤵
  PID:1045
- /bin/sh
  sh -c -- "pkill -9 -x avp32.exe 2>/dev/null &"
  2⤵
  PID:1047
- /bin/sh
  sh -c -- "pkill -9 -x avp33.exe 2>/dev/null &"
  2⤵
  PID:1049
- /bin/sh
  sh -c -- "pkill -9 -x avp34.exe 2>/dev/null &"
  2⤵
  PID:1051
- /bin/sh
  sh -c -- "pkill -9 -x avp35.exe 2>/dev/null &"
  2⤵
  PID:1053
- /bin/sh
  sh -c -- "pkill -9 -x avp36.exe 2>/dev/null &"
  2⤵
  PID:1055
- /bin/sh
  sh -c -- "pkill -9 -x avp37.exe 2>/dev/null &"
  2⤵
  PID:1057
- /bin/sh
  sh -c -- "pkill -9 -x avp38.exe 2>/dev/null &"
  2⤵
  PID:1059
- /bin/sh
  sh -c -- "pkill -9 -x avp39.exe 2>/dev/null &"
  2⤵
  PID:1061
- /bin/sh
  sh -c -- "pkill -9 -x avp40.exe 2>/dev/null &"
  2⤵
  PID:1063
- /bin/sh
  sh -c -- "pkill -9 -x avp41.exe 2>/dev/null &"
  2⤵
  PID:1065
- /bin/sh
  sh -c -- "pkill -9 -x avp42.exe 2>/dev/null &"
  2⤵
  PID:1067
- /bin/sh
  sh -c -- "pkill -9 -x avp43.exe 2>/dev/null &"
  2⤵
  PID:1069
- /bin/sh
  sh -c -- "pkill -9 -x avp44.exe 2>/dev/null &"
  2⤵
  PID:1071
- /bin/sh
  sh -c -- "pkill -9 -x avp45.exe 2>/dev/null &"
  2⤵
  PID:1073
- /bin/sh
  sh -c -- "pkill -9 -x avp46.exe 2>/dev/null &"
  2⤵
  PID:1075
- /bin/sh
  sh -c -- "pkill -9 -x avp47.exe 2>/dev/null &"
  2⤵
  PID:1077
- /bin/sh
  sh -c -- "pkill -9 -x avp48.exe 2>/dev/null &"
  2⤵
  PID:1079
- /bin/sh
  sh -c -- "pkill -9 -x avp49.exe 2>/dev/null &"
  2⤵
  PID:1081
- /bin/sh
  sh -c -- "pkill -9 -x avp50.exe 2>/dev/null &"
  2⤵
  PID:1083
- /bin/sh
  sh -c -- "pkill -9 -f [f]alcond 2>/dev/null &"
  2⤵
  PID:1086
- /bin/sh
  sh -c -- "pkill -9 -f [f]alcon 2>/dev/null &"
  2⤵
  PID:1088
- /bin/sh
  sh -c -- "pkill -9 -f [c]sagent 2>/dev/null &"
  2⤵
  PID:1090
- /bin/sh
  sh -c -- "pkill -9 -f [c]rowdstrike 2>/dev/null &"
  2⤵
  PID:1092
- /bin/sh
  sh -c -- "pkill -9 -f [s]entinelagent 2>/dev/null &"
  2⤵
  PID:1094
- /bin/sh
  sh -c -- "pkill -9 -f [s]entinelhelper 2>/dev/null &"
  2⤵
  PID:1096
- /bin/sh
  sh -c -- "pkill -9 -f [s]1-agent 2>/dev/null &"
  2⤵
  PID:1098
- /bin/sh
  sh -c -- "pkill -9 -f [s]1-service 2>/dev/null &"
  2⤵
  PID:1100
- /bin/sh
  sh -c -- "pkill -9 -f [x]agt 2>/dev/null &"
  2⤵
  PID:1102
- /bin/sh
  sh -c -- "pkill -9 -f [c]bdefense 2>/dev/null &"
  2⤵
  PID:1104
- /bin/sh
  sh -c -- "pkill -9 -f [c]bagent 2>/dev/null &"
  2⤵
  PID:1106
- /bin/sh
  sh -c -- "pkill -9 -f [c]arbonblack 2>/dev/null &"
  2⤵
  PID:1108
- /bin/sh
  sh -c -- "pkill -9 -f [r]epwel 2>/dev/null &"
  2⤵
  PID:1110
- /bin/sh
  sh -c -- "pkill -9 -f [c]ylance 2>/dev/null &"
  2⤵
  PID:1112
- /bin/sh
  sh -c -- "pkill -9 -f [s]vcdiva 2>/dev/null &"
  2⤵
  PID:1114

/usr/bin/pkill
pkill -9 -x kavsvc
1⤵
- Reads runtime system information
PID:918

/usr/bin/pkill
pkill -9 -x kavf4
1⤵
PID:920

/usr/bin/pkill
pkill -9 -x kavguard
1⤵
PID:922

/usr/bin/pkill
pkill -9 -x avp
1⤵
PID:924

/usr/bin/pkill
pkill -9 -x avp5
1⤵
- Reads runtime system information
PID:926

/usr/bin/pkill
pkill -9 -x avp6
1⤵
PID:928

/usr/bin/pkill
pkill -9 -x msvsc
1⤵
PID:930

/usr/bin/pkill
pkill -9 -x msasc
1⤵
PID:932

/usr/bin/pkill
pkill -9 -x msmpeng
1⤵
- Reads runtime system information
PID:934

/usr/bin/pkill
pkill -9 -x msseces
1⤵
- Reads runtime system information
PID:936

/usr/bin/pkill
pkill -9 -x msseces.exe
1⤵
PID:938

/usr/bin/pkill
pkill -9 -x avast
1⤵
- Reads runtime system information
PID:940

/usr/bin/pkill
pkill -9 -x avast5
1⤵
- Reads runtime system information
PID:942

/usr/bin/pkill
pkill -9 -x avast6
1⤵
- Reads runtime system information
PID:944

/usr/bin/pkill
pkill -9 -x avastsvc
1⤵
PID:946

/usr/bin/pkill
pkill -9 -x ash
1⤵
- Reads runtime system information
PID:948

/usr/bin/pkill
pkill -9 -x ashmaisv
1⤵
PID:950

/usr/bin/pkill
pkill -9 -x avgnt
1⤵
PID:952

/usr/bin/pkill
pkill -9 -x avgnt.exe
1⤵
PID:954

/usr/bin/pkill
pkill -9 -x avgnt2
1⤵
- Reads runtime system information
PID:956

/usr/bin/pkill
pkill -9 -x avgnt3
1⤵
PID:958

/usr/bin/pkill
pkill -9 -x clamd
1⤵
PID:960

/usr/bin/pkill
pkill -9 -x clamdscan
1⤵
- Reads runtime system information
PID:962

/usr/bin/pkill
pkill -9 -x clamonacc
1⤵
PID:964

/usr/bin/pkill
pkill -9 -x f-prot
1⤵
- Reads runtime system information
PID:966

/usr/bin/pkill
pkill -9 -x f-prot64
1⤵
PID:968

/usr/bin/pkill
pkill -9 -x f-sport
1⤵
PID:970

/usr/bin/pkill
pkill -9 -x f-sport64
1⤵
PID:972

/usr/bin/pkill
pkill -9 -x smon
1⤵
- Reads runtime system information
PID:974

/usr/bin/pkill
pkill -9 -x smon2
1⤵
PID:976

/usr/bin/pkill
pkill -9 -x smon3
1⤵
- Reads runtime system information
PID:978

/usr/bin/pkill
pkill -9 -x mcs
1⤵
- Reads runtime system information
PID:980

/usr/bin/pkill
pkill -9 -x mcs2
1⤵
- Reads runtime system information
PID:982

/usr/bin/pkill
pkill -9 -x mcs3
1⤵
- Reads runtime system information
PID:984

/usr/bin/pkill
pkill -9 -x navpsv32
1⤵
- Reads runtime system information
PID:986

/usr/bin/pkill
pkill -9 -x navpsv64
1⤵
- Reads runtime system information
PID:988

/usr/bin/pkill
pkill -9 -x navw32
1⤵
- Reads runtime system information
PID:990

/usr/bin/pkill
pkill -9 -x navw64
1⤵
- Reads runtime system information
PID:992

/usr/bin/pkill
pkill -9 -x avp.exe
1⤵
PID:994

/usr/bin/pkill
pkill -9 -x avpsvc.exe
1⤵
- Reads runtime system information
PID:996

/usr/bin/pkill
pkill -9 -x avpcc.exe
1⤵
- Reads runtime system information
PID:998

/usr/bin/pkill
pkill -9 -x avpm.exe
1⤵
PID:1000

/usr/bin/pkill
pkill -9 -x avp9.exe
1⤵
PID:1002

/usr/bin/pkill
pkill -9 -x avp10.exe
1⤵
PID:1004

/usr/bin/pkill
pkill -9 -x avp11.exe
1⤵
PID:1006

/usr/bin/pkill
pkill -9 -x avp12.exe
1⤵
PID:1008

/usr/bin/pkill
pkill -9 -x avp13.exe
1⤵
PID:1010

/usr/bin/pkill
pkill -9 -x avp14.exe
1⤵
PID:1012

/usr/bin/pkill
pkill -9 -x avp15.exe
1⤵
PID:1014

/usr/bin/pkill
pkill -9 -x avp16.exe
1⤵
PID:1016

/usr/bin/pkill
pkill -9 -x avp17.exe
1⤵
PID:1018

/usr/bin/pkill
pkill -9 -x avp18.exe
1⤵
PID:1020

/usr/bin/pkill
pkill -9 -x avp19.exe
1⤵
- Reads runtime system information
PID:1022

/usr/bin/pkill
pkill -9 -x avp20.exe
1⤵
- Reads runtime system information
PID:1024

/usr/bin/pkill
pkill -9 -x avp21.exe
1⤵
PID:1026

/usr/bin/pkill
pkill -9 -x avp22.exe
1⤵
- Reads runtime system information
PID:1028

/usr/bin/pkill
pkill -9 -x avp23.exe
1⤵
- Reads runtime system information
PID:1030

/usr/bin/pkill
pkill -9 -x avp24.exe
1⤵
PID:1032

/usr/bin/pkill
pkill -9 -x avp25.exe
1⤵
- Reads runtime system information
PID:1034

/usr/bin/pkill
pkill -9 -x avp26.exe
1⤵
PID:1036

/usr/bin/pkill
pkill -9 -x avp27.exe
1⤵
- Reads runtime system information
PID:1038

/usr/bin/pkill
pkill -9 -x avp28.exe
1⤵
- Reads runtime system information
PID:1040

/usr/bin/pkill
pkill -9 -x avp29.exe
1⤵
- Reads runtime system information
PID:1042

/usr/bin/pkill
pkill -9 -x avp30.exe
1⤵
PID:1044

/usr/bin/pkill
pkill -9 -x avp31.exe
1⤵
- Reads runtime system information
PID:1046

/usr/bin/pkill
pkill -9 -x avp32.exe
1⤵
- Reads runtime system information
PID:1048

/usr/bin/pkill
pkill -9 -x avp33.exe
1⤵
- Reads runtime system information
PID:1050

/usr/bin/pkill
pkill -9 -x avp34.exe
1⤵
- Reads runtime system information
PID:1052

/usr/bin/pkill
pkill -9 -x avp35.exe
1⤵
PID:1054

/usr/bin/pkill
pkill -9 -x avp36.exe
1⤵
PID:1056

/usr/bin/pkill
pkill -9 -x avp37.exe
1⤵
- Reads runtime system information
PID:1058

/usr/bin/pkill
pkill -9 -x avp38.exe
1⤵
- Reads runtime system information
PID:1060

/usr/bin/pkill
pkill -9 -x avp39.exe
1⤵
PID:1062

/usr/bin/pkill
pkill -9 -x avp40.exe
1⤵
- Reads runtime system information
PID:1064

/usr/bin/pkill
pkill -9 -x avp41.exe
1⤵
- Reads runtime system information
PID:1066

/usr/bin/pkill
pkill -9 -x avp42.exe
1⤵
- Reads runtime system information
PID:1068

/usr/bin/pkill
pkill -9 -x avp43.exe
1⤵
- Reads runtime system information
PID:1070

/usr/bin/pkill
pkill -9 -x avp44.exe
1⤵
PID:1072

/usr/bin/pkill
pkill -9 -x avp45.exe
1⤵
- Reads runtime system information
PID:1074

/usr/bin/pkill
pkill -9 -x avp46.exe
1⤵
PID:1076

/usr/bin/pkill
pkill -9 -x avp47.exe
1⤵
PID:1078

/usr/bin/pkill
pkill -9 -x avp48.exe
1⤵
PID:1080

/usr/bin/pkill
pkill -9 -x avp49.exe
1⤵
PID:1082

/usr/bin/pkill
pkill -9 -x avp50.exe
1⤵
- Reads runtime system information
PID:1084

/usr/bin/pkill
pkill -9 -f "[f]alcond"
1⤵
PID:1087

/usr/bin/pkill
pkill -9 -f "[f]alcon"
1⤵
PID:1089

/usr/bin/pkill
pkill -9 -f "[c]sagent"
1⤵
- Reads runtime system information
PID:1091

/usr/bin/pkill
pkill -9 -f "[c]rowdstrike"
1⤵
- Reads runtime system information
PID:1093

/usr/bin/pkill
pkill -9 -f "[s]entinelagent"
1⤵
- Reads runtime system information
PID:1095

/usr/bin/pkill
pkill -9 -f "[s]entinelhelper"
1⤵
PID:1097

/usr/bin/pkill
pkill -9 -f "[s]1-agent"
1⤵
PID:1099

/usr/bin/pkill
pkill -9 -f "[s]1-service"
1⤵
PID:1101

/usr/bin/pkill
pkill -9 -f "[x]agt"
1⤵
PID:1103

/usr/bin/pkill
pkill -9 -f "[c]bdefense"
1⤵
PID:1105

/usr/bin/pkill
pkill -9 -f "[c]bagent"
1⤵
PID:1107

/usr/bin/pkill
pkill -9 -f "[c]arbonblack"
1⤵
PID:1109

/usr/bin/pkill
pkill -9 -f "[r]epwel"
1⤵
PID:1111

/usr/bin/pkill
pkill -9 -f "[c]ylance"
1⤵
PID:1113

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads