31c39ae1abeb5b74873181fa5e8cb1b1b9fc1e954498d19eacade640301512a5

Analysis

max time kernel
150s
max time network
153s
platform
debian-12_armhf
resource
debian12-armhf-20260513-en
resource tags

arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
30/09/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bot.arm7n
Size 990KB
Sample260930-ph3dcstx9m
SHA256 31c39ae1abeb5b74873181fa5e8cb1b1b9fc1e954498d19eacade640301512a5
MD5 af1c6479b9af8ac6ba6b93bb8c361a43
SHA1 c4b151e2a9581e995a92910e7b75a1bd81f58a82
SHA512 686fb128b6e717a8a2b15fc2fbae92937ae2cc1678ecb05b25e3b4feb6b7c962b516747743a52dc8137f2c76373bc3b1ec9ad9c28324a0f3706c7a44732a5e65
SSDEEP 24576:+WmNVQHYP+SmAC+MqR9p4Wrii7j657yD/hGnmw:KdM4DmUj657yDAmw
TLSH
T16E254C55F890DF63C9C46B7AFA5E82A833234778C3D7720699148B343B97A1F0B3A645
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 2 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
833	sh
835	chmod

Checks hardware identifiers (DMI) 1 TTPs 4 IoCs

Checks DMI information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/sys/class/dmi/id/bios_vendor	bot.arm7n
File opened for reading	/sys/class/dmi/id/board_vendor	bot.arm7n
File opened for reading	/sys/class/dmi/id/product_name	bot.arm7n
File opened for reading	/sys/class/dmi/id/sys_vendor	bot.arm7n

Enumerates running processes
Discovers information about currently running processes on the system

Reads MAC address of network interface 2 TTPs 2 IoCs

Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.

defense_evasion discovery

System Network Connections Discovery

T1049

Wi-Fi Discovery

T1016.002

description	ioc	Process
File opened for reading	/sys/class/net/lo/address	bot.arm7n
File opened for reading	/sys/class/net/eth0/address	bot.arm7n

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	bot.arm7n

Reads CPU attributes 1 TTPs 1 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	bot.arm7n

Enumerates kernel/hardware configuration 1 TTPs 3 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/cgroup/memory.max	bot.arm7n
File opened for reading	/sys/fs/cgroup/memory/memory.limit_in_bytes	bot.arm7n
File opened for reading	/sys/class/net	bot.arm7n

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/52/status	pkill
File opened for reading	/proc/21/status	pkill
File opened for reading	/proc/928/stat	pkill
File opened for reading	/proc/52/stat	pkill
File opened for reading	/proc/11/ctty	pkill
File opened for reading	/proc/13/cmdline	pkill
File opened for reading	/proc/268/cmdline	pkill
File opened for reading	/proc/144/ctty	pkill
File opened for reading	/proc/34/ctty	pkill
File opened for reading	/proc/780/ctty	pkill
File opened for reading	/proc/22/status	pkill
File opened for reading	/proc/767/cmdline	pkill
File opened for reading	/proc/28/status	pkill
File opened for reading	/proc/958/cmdline	pkill
File opened for reading	/proc/15/status	pkill
File opened for reading	/proc/23/stat	pkill
File opened for reading	/proc/6/status	pkill
File opened for reading	/proc/351/status	pkill
File opened for reading	/proc/14/cmdline	pkill
File opened for reading	/proc/268/status	pkill
File opened for reading	/proc/47/stat	pkill
File opened for reading	/proc/144/ctty	pkill
File opened for reading	/proc/1017/ctty	pkill
File opened for reading	/proc/780/status	pkill
File opened for reading	/proc/4/stat	pkill
File opened for reading	/proc/1007/status	pkill
File opened for reading	/proc/204/cmdline	pkill
File opened for reading	/proc/17/cgroup	pkill
File opened for reading	/proc/29/cmdline	pkill
File opened for reading	/proc/351/cmdline	pkill
File opened for reading	/proc/23/ctty	pkill
File opened for reading	/proc/315/stat	pkill
File opened for reading	/proc/779/status	pkill
File opened for reading	/proc/836/cgroup	pkill
File opened for reading	/proc/351/cmdline	pkill
File opened for reading	/proc/21/status	pkill
File opened for reading	/proc/641/status	pkill
File opened for reading	/proc/22/cgroup	pkill
File opened for reading	/proc/11/stat	pkill
File opened for reading	/proc/43/cgroup	pkill
File opened for reading	/proc/22/ctty	pkill
File opened for reading	/proc/317/stat	pkill
File opened for reading	/proc/23/cgroup	pkill
File opened for reading	/proc/45/cmdline	pkill
File opened for reading	/proc/11/stat	pkill
File opened for reading	/proc/57/cgroup	pkill
File opened for reading	/proc/204/status	pkill
File opened for reading	/proc/22/ctty	pkill
File opened for reading	/proc/217/cmdline	pkill
File opened for reading	/proc/642/stat	pkill
File opened for reading	/proc/8/ctty	pkill
File opened for reading	/proc/767/cmdline	pkill
File opened for reading	/proc/333/cmdline	pkill
File opened for reading	/proc/16/cmdline	pkill
File opened for reading	/proc/8/cmdline	pkill
File opened for reading	/proc/896/ctty	pkill
File opened for reading	/proc/779/ctty	pkill
File opened for reading	/proc/74/cgroup	pkill
File opened for reading	/proc/8/stat	pkill
File opened for reading	/proc/8/cgroup	pkill
File opened for reading	/proc/15/stat	pkill
File opened for reading	/proc/810/stat	pkill
File opened for reading	/proc/399/cmdline	pkill
File opened for reading	/proc/882/status	pkill

System Network Configuration Discovery 1 TTPs 4 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1084	sh
1085	pkill
1038	sh
1039	pkill

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.zl	bot.arm7n

/tmp/bot.arm7n
/tmp/bot.arm7n
1⤵
- Checks hardware identifiers (DMI)
- Reads MAC address of network interface
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Writes file to tmp directory
PID:783
- /bin/sh
  sh -c -- "cp /proc/self/exe /var/.z 2>/dev/null && chmod +x /var/.z 2>/dev/null"
  2⤵
  - File and Directory Permissions Modification
  PID:833
- - /usr/bin/cp
    cp /proc/self/exe /var/.z
    3⤵
    PID:834
- - /usr/bin/chmod
    chmod +x /var/.z
    3⤵
    - File and Directory Permissions Modification
    PID:835
- /bin/sh
  sh -c -- "pkill -9 -x kavsvc 2>/dev/null &"
  2⤵
  PID:837
- /bin/sh
  sh -c -- "pkill -9 -x kavf4 2>/dev/null &"
  2⤵
  PID:839
- /bin/sh
  sh -c -- "pkill -9 -x kavguard 2>/dev/null &"
  2⤵
  PID:841
- /bin/sh
  sh -c -- "pkill -9 -x avp 2>/dev/null &"
  2⤵
  PID:843
- /bin/sh
  sh -c -- "pkill -9 -x avp5 2>/dev/null &"
  2⤵
  PID:845
- /bin/sh
  sh -c -- "pkill -9 -x avp6 2>/dev/null &"
  2⤵
  PID:847
- /bin/sh
  sh -c -- "pkill -9 -x msvsc 2>/dev/null &"
  2⤵
  PID:849
- /bin/sh
  sh -c -- "pkill -9 -x msasc 2>/dev/null &"
  2⤵
  PID:851
- /bin/sh
  sh -c -- "pkill -9 -x msmpeng 2>/dev/null &"
  2⤵
  PID:853
- /bin/sh
  sh -c -- "pkill -9 -x msseces 2>/dev/null &"
  2⤵
  PID:855
- /bin/sh
  sh -c -- "pkill -9 -x msseces.exe 2>/dev/null &"
  2⤵
  PID:857
- /bin/sh
  sh -c -- "pkill -9 -x avast 2>/dev/null &"
  2⤵
  PID:859
- /bin/sh
  sh -c -- "pkill -9 -x avast5 2>/dev/null &"
  2⤵
  PID:861
- /bin/sh
  sh -c -- "pkill -9 -x avast6 2>/dev/null &"
  2⤵
  PID:863
- /bin/sh
  sh -c -- "pkill -9 -x avastsvc 2>/dev/null &"
  2⤵
  PID:865
- /bin/sh
  sh -c -- "pkill -9 -x ash 2>/dev/null &"
  2⤵
  PID:867
- /bin/sh
  sh -c -- "pkill -9 -x ashmaisv 2>/dev/null &"
  2⤵
  PID:869
- /bin/sh
  sh -c -- "pkill -9 -x avgnt 2>/dev/null &"
  2⤵
  PID:871
- /bin/sh
  sh -c -- "pkill -9 -x avgnt.exe 2>/dev/null &"
  2⤵
  PID:873
- /bin/sh
  sh -c -- "pkill -9 -x avgnt2 2>/dev/null &"
  2⤵
  PID:875
- /bin/sh
  sh -c -- "pkill -9 -x avgnt3 2>/dev/null &"
  2⤵
  PID:877
- /bin/sh
  sh -c -- "pkill -9 -x clamd 2>/dev/null &"
  2⤵
  PID:879
- /bin/sh
  sh -c -- "pkill -9 -x clamdscan 2>/dev/null &"
  2⤵
  PID:881
- /bin/sh
  sh -c -- "pkill -9 -x clamonacc 2>/dev/null &"
  2⤵
  PID:883
- /bin/sh
  sh -c -- "pkill -9 -x f-prot 2>/dev/null &"
  2⤵
  PID:885
- /bin/sh
  sh -c -- "pkill -9 -x f-prot64 2>/dev/null &"
  2⤵
  PID:887
- /bin/sh
  sh -c -- "pkill -9 -x f-sport 2>/dev/null &"
  2⤵
  PID:889
- /bin/sh
  sh -c -- "pkill -9 -x f-sport64 2>/dev/null &"
  2⤵
  PID:891
- /bin/sh
  sh -c -- "pkill -9 -x smon 2>/dev/null &"
  2⤵
  PID:893
- /bin/sh
  sh -c -- "pkill -9 -x smon2 2>/dev/null &"
  2⤵
  PID:895
- /bin/sh
  sh -c -- "pkill -9 -x smon3 2>/dev/null &"
  2⤵
  PID:897
- /bin/sh
  sh -c -- "pkill -9 -x mcs 2>/dev/null &"
  2⤵
  PID:899
- /bin/sh
  sh -c -- "pkill -9 -x mcs2 2>/dev/null &"
  2⤵
  PID:901
- /bin/sh
  sh -c -- "pkill -9 -x mcs3 2>/dev/null &"
  2⤵
  PID:903
- /bin/sh
  sh -c -- "pkill -9 -x navpsv32 2>/dev/null &"
  2⤵
  PID:905
- /bin/sh
  sh -c -- "pkill -9 -x navpsv64 2>/dev/null &"
  2⤵
  PID:907
- /bin/sh
  sh -c -- "pkill -9 -x navw32 2>/dev/null &"
  2⤵
  PID:909
- /bin/sh
  sh -c -- "pkill -9 -x navw64 2>/dev/null &"
  2⤵
  PID:911
- /bin/sh
  sh -c -- "pkill -9 -x avp.exe 2>/dev/null &"
  2⤵
  PID:913
- /bin/sh
  sh -c -- "pkill -9 -x avpsvc.exe 2>/dev/null &"
  2⤵
  PID:915
- /bin/sh
  sh -c -- "pkill -9 -x avpcc.exe 2>/dev/null &"
  2⤵
  PID:917
- /bin/sh
  sh -c -- "pkill -9 -x avpm.exe 2>/dev/null &"
  2⤵
  PID:919
- /bin/sh
  sh -c -- "pkill -9 -x avp9.exe 2>/dev/null &"
  2⤵
  PID:921
- /bin/sh
  sh -c -- "pkill -9 -x avp10.exe 2>/dev/null &"
  2⤵
  PID:923
- /bin/sh
  sh -c -- "pkill -9 -x avp11.exe 2>/dev/null &"
  2⤵
  PID:925
- /bin/sh
  sh -c -- "pkill -9 -x avp12.exe 2>/dev/null &"
  2⤵
  PID:927
- /bin/sh
  sh -c -- "pkill -9 -x avp13.exe 2>/dev/null &"
  2⤵
  PID:929
- /bin/sh
  sh -c -- "pkill -9 -x avp14.exe 2>/dev/null &"
  2⤵
  PID:931
- /bin/sh
  sh -c -- "pkill -9 -x avp15.exe 2>/dev/null &"
  2⤵
  PID:933
- /bin/sh
  sh -c -- "pkill -9 -x avp16.exe 2>/dev/null &"
  2⤵
  PID:935
- /bin/sh
  sh -c -- "pkill -9 -x avp17.exe 2>/dev/null &"
  2⤵
  PID:937
- /bin/sh
  sh -c -- "pkill -9 -x avp18.exe 2>/dev/null &"
  2⤵
  PID:939
- /bin/sh
  sh -c -- "pkill -9 -x avp19.exe 2>/dev/null &"
  2⤵
  PID:941
- /bin/sh
  sh -c -- "pkill -9 -x avp20.exe 2>/dev/null &"
  2⤵
  PID:943
- /bin/sh
  sh -c -- "pkill -9 -x avp21.exe 2>/dev/null &"
  2⤵
  PID:945
- /bin/sh
  sh -c -- "pkill -9 -x avp22.exe 2>/dev/null &"
  2⤵
  PID:947
- /bin/sh
  sh -c -- "pkill -9 -x avp23.exe 2>/dev/null &"
  2⤵
  PID:949
- /bin/sh
  sh -c -- "pkill -9 -x avp24.exe 2>/dev/null &"
  2⤵
  PID:951
- /bin/sh
  sh -c -- "pkill -9 -x avp25.exe 2>/dev/null &"
  2⤵
  PID:953
- /bin/sh
  sh -c -- "pkill -9 -x avp26.exe 2>/dev/null &"
  2⤵
  PID:955
- /bin/sh
  sh -c -- "pkill -9 -x avp27.exe 2>/dev/null &"
  2⤵
  PID:957
- /bin/sh
  sh -c -- "pkill -9 -x avp28.exe 2>/dev/null &"
  2⤵
  PID:959
- /bin/sh
  sh -c -- "pkill -9 -x avp29.exe 2>/dev/null &"
  2⤵
  PID:961
- /bin/sh
  sh -c -- "pkill -9 -x avp30.exe 2>/dev/null &"
  2⤵
  PID:963
- /bin/sh
  sh -c -- "pkill -9 -x avp31.exe 2>/dev/null &"
  2⤵
  PID:965
- /bin/sh
  sh -c -- "pkill -9 -x avp32.exe 2>/dev/null &"
  2⤵
  PID:967
- /bin/sh
  sh -c -- "pkill -9 -x avp33.exe 2>/dev/null &"
  2⤵
  PID:969
- /bin/sh
  sh -c -- "pkill -9 -x avp34.exe 2>/dev/null &"
  2⤵
  PID:971
- /bin/sh
  sh -c -- "pkill -9 -x avp35.exe 2>/dev/null &"
  2⤵
  PID:973
- /bin/sh
  sh -c -- "pkill -9 -x avp36.exe 2>/dev/null &"
  2⤵
  PID:975
- /bin/sh
  sh -c -- "pkill -9 -x avp37.exe 2>/dev/null &"
  2⤵
  PID:977
- /bin/sh
  sh -c -- "pkill -9 -x avp38.exe 2>/dev/null &"
  2⤵
  PID:979
- /bin/sh
  sh -c -- "pkill -9 -x avp39.exe 2>/dev/null &"
  2⤵
  PID:981
- /bin/sh
  sh -c -- "pkill -9 -x avp40.exe 2>/dev/null &"
  2⤵
  PID:983
- /bin/sh
  sh -c -- "pkill -9 -x avp41.exe 2>/dev/null &"
  2⤵
  PID:985
- /bin/sh
  sh -c -- "pkill -9 -x avp42.exe 2>/dev/null &"
  2⤵
  PID:987
- /bin/sh
  sh -c -- "pkill -9 -x avp43.exe 2>/dev/null &"
  2⤵
  PID:989
- /bin/sh
  sh -c -- "pkill -9 -x avp44.exe 2>/dev/null &"
  2⤵
  PID:991
- /bin/sh
  sh -c -- "pkill -9 -x avp45.exe 2>/dev/null &"
  2⤵
  PID:993
- /bin/sh
  sh -c -- "pkill -9 -x avp46.exe 2>/dev/null &"
  2⤵
  PID:995
- /bin/sh
  sh -c -- "pkill -9 -x avp47.exe 2>/dev/null &"
  2⤵
  PID:997
- /bin/sh
  sh -c -- "pkill -9 -x avp48.exe 2>/dev/null &"
  2⤵
  PID:999
- /bin/sh
  sh -c -- "pkill -9 -x avp49.exe 2>/dev/null &"
  2⤵
  PID:1001
- /bin/sh
  sh -c -- "pkill -9 -x avp50.exe 2>/dev/null &"
  2⤵
  PID:1003
- /bin/sh
  sh -c -- "pkill -9 -f [f]alcond 2>/dev/null &"
  2⤵
  PID:1006
- /bin/sh
  sh -c -- "pkill -9 -f [f]alcon 2>/dev/null &"
  2⤵
  PID:1008
- /bin/sh
  sh -c -- "pkill -9 -f [c]sagent 2>/dev/null &"
  2⤵
  PID:1010
- /bin/sh
  sh -c -- "pkill -9 -f [c]rowdstrike 2>/dev/null &"
  2⤵
  PID:1012
- /bin/sh
  sh -c -- "pkill -9 -f [s]entinelagent 2>/dev/null &"
  2⤵
  PID:1014
- /bin/sh
  sh -c -- "pkill -9 -f [s]entinelhelper 2>/dev/null &"
  2⤵
  PID:1016
- /bin/sh
  sh -c -- "pkill -9 -f [s]1-agent 2>/dev/null &"
  2⤵
  PID:1018
- /bin/sh
  sh -c -- "pkill -9 -f [s]1-service 2>/dev/null &"
  2⤵
  PID:1020
- /bin/sh
  sh -c -- "pkill -9 -f [x]agt 2>/dev/null &"
  2⤵
  PID:1022
- /bin/sh
  sh -c -- "pkill -9 -f [c]bdefense 2>/dev/null &"
  2⤵
  PID:1024
- /bin/sh
  sh -c -- "pkill -9 -f [c]bagent 2>/dev/null &"
  2⤵
  PID:1026
- /bin/sh
  sh -c -- "pkill -9 -f [c]arbonblack 2>/dev/null &"
  2⤵
  PID:1028
- /bin/sh
  sh -c -- "pkill -9 -f [r]epwel 2>/dev/null &"
  2⤵
  PID:1030
- /bin/sh
  sh -c -- "pkill -9 -f [c]ylance 2>/dev/null &"
  2⤵
  PID:1032
- /bin/sh
  sh -c -- "pkill -9 -f [s]vcdiva 2>/dev/null &"
  2⤵
  PID:1034
- /bin/sh
  sh -c -- "pkill -9 -f [m]datp 2>/dev/null &"
  2⤵
  PID:1036
- /bin/sh
  sh -c -- "pkill -9 -f [m]dallaips 2>/dev/null &"
  2⤵
  - System Network Configuration Discovery
  PID:1038
- /bin/sh
  sh -c -- "pkill -9 -f [s]ensedata 2>/dev/null &"
  2⤵
  PID:1040
- /bin/sh
  sh -c -- "pkill -9 -f [s]ophos 2>/dev/null &"
  2⤵
  PID:1042
- /bin/sh
  sh -c -- "pkill -9 -f [s]avscanner 2>/dev/null &"
  2⤵
  PID:1044
- /bin/sh
  sh -c -- "pkill -9 -f [r]tvscan 2>/dev/null &"
  2⤵
  PID:1046
- /bin/sh
  sh -c -- "pkill -9 -f [s]ymantec 2>/dev/null &"
  2⤵
  PID:1048
- /bin/sh
  sh -c -- "pkill -9 -f [S]ymAux 2>/dev/null &"
  2⤵
  PID:1050
- /bin/sh
  sh -c -- "pkill -9 -f [t]rendmicro 2>/dev/null &"
  2⤵
  PID:1052
- /bin/sh
  sh -c -- "pkill -9 -f [d]s_agent 2>/dev/null &"
  2⤵
  PID:1054
- /bin/sh
  sh -c -- "pkill -9 -f [e]dragent 2>/dev/null &"
  2⤵
  PID:1056
- /bin/sh
  sh -c -- "pkill -9 -f [o]squeryd 2>/dev/null &"
  2⤵
  PID:1058
- /bin/sh
  sh -c -- "pkill -9 -f [s]ysmon 2>/dev/null &"
  2⤵
  PID:1060
- /bin/sh
  sh -c -- "pkill -9 -f [c]lamd 2>/dev/null &"
  2⤵
  PID:1062
- /bin/sh
  sh -c -- "pkill -9 -f [k]lscan 2>/dev/null &"
  2⤵
  PID:1064
- /bin/sh
  sh -c -- "pkill -9 -f [k]avfs 2>/dev/null &"
  2⤵
  PID:1066
- /bin/sh
  sh -c -- "pkill -9 -f [e]krn 2>/dev/null &"
  2⤵
  PID:1068
- /bin/sh
  sh -c -- "pkill -9 -f [e]sets 2>/dev/null &"
  2⤵
  PID:1070
- /bin/sh
  sh -c -- "pkill -9 -f [b]dagent 2>/dev/null &"
  2⤵
  PID:1072
- /bin/sh
  sh -c -- "pkill -9 -f [w]rsa 2>/dev/null &"
  2⤵
  PID:1074
- /bin/sh
  sh -c -- "pkill -9 -f [m]bam 2>/dev/null &"
  2⤵
  PID:1076
- /bin/sh
  sh -c -- "pkill -9 -f [m]alwarebytes 2>/dev/null &"
  2⤵
  PID:1078
- /bin/sh
  sh -c -- "pkill -9 -f [3]60tray 2>/dev/null &"
  2⤵
  PID:1080
- /bin/sh
  sh -c -- "pkill -9 -f [3]60safe 2>/dev/null &"
  2⤵
  PID:1082
- /bin/sh
  sh -c -- "pkill -9 -f [h]ipstray 2>/dev/null &"
  2⤵
  - System Network Configuration Discovery
  PID:1084
- /bin/sh
  sh -c -- "pkill -9 -f [u]sysdiag 2>/dev/null &"
  2⤵
  PID:1086
- /bin/sh
  sh -c -- "pkill -9 -f [q]axengine 2>/dev/null &"
  2⤵
  PID:1088

/usr/bin/pkill
pkill -9 -x kavsvc
1⤵
PID:838

/usr/bin/pkill
pkill -9 -x kavf4
1⤵
PID:840

/usr/bin/pkill
pkill -9 -x kavguard
1⤵
- Reads runtime system information
PID:842

/usr/bin/pkill
pkill -9 -x avp
1⤵
PID:844

/usr/bin/pkill
pkill -9 -x avp5
1⤵
PID:846

/usr/bin/pkill
pkill -9 -x avp6
1⤵
PID:848

/usr/bin/pkill
pkill -9 -x msvsc
1⤵
- Reads runtime system information
PID:850

/usr/bin/pkill
pkill -9 -x msasc
1⤵
PID:852

/usr/bin/pkill
pkill -9 -x msmpeng
1⤵
PID:854

/usr/bin/pkill
pkill -9 -x msseces
1⤵
- Reads runtime system information
PID:856

/usr/bin/pkill
pkill -9 -x msseces.exe
1⤵
- Reads runtime system information
PID:858

/usr/bin/pkill
pkill -9 -x avast
1⤵
PID:860

/usr/bin/pkill
pkill -9 -x avast5
1⤵
PID:862

/usr/bin/pkill
pkill -9 -x avast6
1⤵
PID:864

/usr/bin/pkill
pkill -9 -x avastsvc
1⤵
- Reads runtime system information
PID:866

/usr/bin/pkill
pkill -9 -x ash
1⤵
PID:868

/usr/bin/pkill
pkill -9 -x ashmaisv
1⤵
PID:870

/usr/bin/pkill
pkill -9 -x avgnt
1⤵
PID:872

/usr/bin/pkill
pkill -9 -x avgnt.exe
1⤵
- Reads runtime system information
PID:874

/usr/bin/pkill
pkill -9 -x avgnt2
1⤵
- Reads runtime system information
PID:876

/usr/bin/pkill
pkill -9 -x avgnt3
1⤵
- Reads runtime system information
PID:878

/usr/bin/pkill
pkill -9 -x clamd
1⤵
PID:880

/usr/bin/pkill
pkill -9 -x clamdscan
1⤵
PID:882

/usr/bin/pkill
pkill -9 -x clamonacc
1⤵
- Reads runtime system information
PID:884

/usr/bin/pkill
pkill -9 -x f-prot
1⤵
- Reads runtime system information
PID:886

/usr/bin/pkill
pkill -9 -x f-prot64
1⤵
PID:888

/usr/bin/pkill
pkill -9 -x f-sport
1⤵
- Reads runtime system information
PID:890

/usr/bin/pkill
pkill -9 -x f-sport64
1⤵
- Reads runtime system information
PID:892

/usr/bin/pkill
pkill -9 -x smon
1⤵
PID:894

/usr/bin/pkill
pkill -9 -x smon2
1⤵
PID:896

/usr/bin/pkill
pkill -9 -x smon3
1⤵
PID:898

/usr/bin/pkill
pkill -9 -x mcs
1⤵
PID:900

/usr/bin/pkill
pkill -9 -x mcs2
1⤵
PID:902

/usr/bin/pkill
pkill -9 -x mcs3
1⤵
PID:904

/usr/bin/pkill
pkill -9 -x navpsv32
1⤵
- Reads runtime system information
PID:906

/usr/bin/pkill
pkill -9 -x navpsv64
1⤵
PID:908

/usr/bin/pkill
pkill -9 -x navw32
1⤵
PID:910

/usr/bin/pkill
pkill -9 -x navw64
1⤵
PID:912

/usr/bin/pkill
pkill -9 -x avp.exe
1⤵
PID:914

/usr/bin/pkill
pkill -9 -x avpsvc.exe
1⤵
- Reads runtime system information
PID:916

/usr/bin/pkill
pkill -9 -x avpcc.exe
1⤵
PID:918

/usr/bin/pkill
pkill -9 -x avpm.exe
1⤵
- Reads runtime system information
PID:920

/usr/bin/pkill
pkill -9 -x avp9.exe
1⤵
- Reads runtime system information
PID:922

/usr/bin/pkill
pkill -9 -x avp10.exe
1⤵
- Reads runtime system information
PID:924

/usr/bin/pkill
pkill -9 -x avp11.exe
1⤵
PID:926

/usr/bin/pkill
pkill -9 -x avp12.exe
1⤵
- Reads runtime system information
PID:928

/usr/bin/pkill
pkill -9 -x avp13.exe
1⤵
PID:930

/usr/bin/pkill
pkill -9 -x avp14.exe
1⤵
PID:932

/usr/bin/pkill
pkill -9 -x avp15.exe
1⤵
PID:934

/usr/bin/pkill
pkill -9 -x avp16.exe
1⤵
- Reads runtime system information
PID:936

/usr/bin/pkill
pkill -9 -x avp17.exe
1⤵
PID:938

/usr/bin/pkill
pkill -9 -x avp18.exe
1⤵
- Reads runtime system information
PID:940

/usr/bin/pkill
pkill -9 -x avp19.exe
1⤵
- Reads runtime system information
PID:942

/usr/bin/pkill
pkill -9 -x avp20.exe
1⤵
PID:944

/usr/bin/pkill
pkill -9 -x avp21.exe
1⤵
PID:946

/usr/bin/pkill
pkill -9 -x avp22.exe
1⤵
PID:948

/usr/bin/pkill
pkill -9 -x avp23.exe
1⤵
PID:950

/usr/bin/pkill
pkill -9 -x avp24.exe
1⤵
PID:952

/usr/bin/pkill
pkill -9 -x avp25.exe
1⤵
- Reads runtime system information
PID:954

/usr/bin/pkill
pkill -9 -x avp26.exe
1⤵
PID:956

/usr/bin/pkill
pkill -9 -x avp27.exe
1⤵
PID:958

/usr/bin/pkill
pkill -9 -x avp28.exe
1⤵
PID:960

/usr/bin/pkill
pkill -9 -x avp29.exe
1⤵
- Reads runtime system information
PID:962

/usr/bin/pkill
pkill -9 -x avp30.exe
1⤵
PID:964

/usr/bin/pkill
pkill -9 -x avp31.exe
1⤵
PID:966

/usr/bin/pkill
pkill -9 -x avp32.exe
1⤵
- Reads runtime system information
PID:968

/usr/bin/pkill
pkill -9 -x avp33.exe
1⤵
PID:970

/usr/bin/pkill
pkill -9 -x avp34.exe
1⤵
- Reads runtime system information
PID:972

/usr/bin/pkill
pkill -9 -x avp35.exe
1⤵
PID:974

/usr/bin/pkill
pkill -9 -x avp36.exe
1⤵
- Reads runtime system information
PID:976

/usr/bin/pkill
pkill -9 -x avp37.exe
1⤵
- Reads runtime system information
PID:978

/usr/bin/pkill
pkill -9 -x avp38.exe
1⤵
PID:980

/usr/bin/pkill
pkill -9 -x avp39.exe
1⤵
- Reads runtime system information
PID:982

/usr/bin/pkill
pkill -9 -x avp40.exe
1⤵
PID:984

/usr/bin/pkill
pkill -9 -x avp41.exe
1⤵
PID:986

/usr/bin/pkill
pkill -9 -x avp42.exe
1⤵
- Reads runtime system information
PID:988

/usr/bin/pkill
pkill -9 -x avp43.exe
1⤵
PID:990

/usr/bin/pkill
pkill -9 -x avp44.exe
1⤵
- Reads runtime system information
PID:992

/usr/bin/pkill
pkill -9 -x avp45.exe
1⤵
- Reads runtime system information
PID:994

/usr/bin/pkill
pkill -9 -x avp46.exe
1⤵
- Reads runtime system information
PID:996

/usr/bin/pkill
pkill -9 -x avp47.exe
1⤵
PID:998

/usr/bin/pkill
pkill -9 -x avp48.exe
1⤵
PID:1000

/usr/bin/pkill
pkill -9 -x avp49.exe
1⤵
- Reads runtime system information
PID:1002

/usr/bin/pkill
pkill -9 -x avp50.exe
1⤵
- Reads runtime system information
PID:1004

/usr/bin/pkill
pkill -9 -f "[f]alcond"
1⤵
- Reads runtime system information
PID:1007

/usr/bin/pkill
pkill -9 -f "[f]alcon"
1⤵
- Reads runtime system information
PID:1009

/usr/bin/pkill
pkill -9 -f "[c]sagent"
1⤵
PID:1011

/usr/bin/pkill
pkill -9 -f "[c]rowdstrike"
1⤵
- Reads runtime system information
PID:1013

/usr/bin/pkill
pkill -9 -f "[s]entinelagent"
1⤵
PID:1015

/usr/bin/pkill
pkill -9 -f "[s]entinelhelper"
1⤵
- Reads runtime system information
PID:1017

/usr/bin/pkill
pkill -9 -f "[s]1-agent"
1⤵
- Reads runtime system information
PID:1019

/usr/bin/pkill
pkill -9 -f "[s]1-service"
1⤵
PID:1021

/usr/bin/pkill
pkill -9 -f "[x]agt"
1⤵
- Reads runtime system information
PID:1023

/usr/bin/pkill
pkill -9 -f "[c]bdefense"
1⤵
PID:1025

/usr/bin/pkill
pkill -9 -f "[c]bagent"
1⤵
- Reads runtime system information
PID:1027

/usr/bin/pkill
pkill -9 -f "[c]arbonblack"
1⤵
PID:1029

/usr/bin/pkill
pkill -9 -f "[r]epwel"
1⤵
PID:1031

/usr/bin/pkill
pkill -9 -f "[c]ylance"
1⤵
- Reads runtime system information
PID:1033

/usr/bin/pkill
pkill -9 -f "[s]vcdiva"
1⤵
PID:1035

/usr/bin/pkill
pkill -9 -f "[m]datp"
1⤵
- Reads runtime system information
PID:1037

/usr/bin/pkill
pkill -9 -f "[m]dallaips"
1⤵
- System Network Configuration Discovery
PID:1039

/usr/bin/pkill
pkill -9 -f "[s]ensedata"
1⤵
- Reads runtime system information
PID:1041

/usr/bin/pkill
pkill -9 -f "[s]ophos"
1⤵
PID:1043

/usr/bin/pkill
pkill -9 -f "[s]avscanner"
1⤵
PID:1045

/usr/bin/pkill
pkill -9 -f "[r]tvscan"
1⤵
- Reads runtime system information
PID:1047

/usr/bin/pkill
pkill -9 -f "[s]ymantec"
1⤵
PID:1049

/usr/bin/pkill
pkill -9 -f "[S]ymAux"
1⤵
- Reads runtime system information
PID:1051

/usr/bin/pkill
pkill -9 -f "[t]rendmicro"
1⤵
PID:1053

/usr/bin/pkill
pkill -9 -f "[d]s_agent"
1⤵
PID:1055

/usr/bin/pkill
pkill -9 -f "[e]dragent"
1⤵
PID:1057

/usr/bin/pkill
pkill -9 -f "[o]squeryd"
1⤵
- Reads runtime system information
PID:1059

/usr/bin/pkill
pkill -9 -f "[s]ysmon"
1⤵
- Reads runtime system information
PID:1061

/usr/bin/pkill
pkill -9 -f "[c]lamd"
1⤵
- Reads runtime system information
PID:1063

/usr/bin/pkill
pkill -9 -f "[k]lscan"
1⤵
PID:1065

/usr/bin/pkill
pkill -9 -f "[k]avfs"
1⤵
PID:1067

/usr/bin/pkill
pkill -9 -f "[e]krn"
1⤵
PID:1069

/usr/bin/pkill
pkill -9 -f "[e]sets"
1⤵
- Reads runtime system information
PID:1071

/usr/bin/pkill
pkill -9 -f "[b]dagent"
1⤵
PID:1073

/usr/bin/pkill
pkill -9 -f "[w]rsa"
1⤵
PID:1075

/usr/bin/pkill
pkill -9 -f "[m]bam"
1⤵
PID:1077

/usr/bin/pkill
pkill -9 -f "[m]alwarebytes"
1⤵
PID:1079

/usr/bin/pkill
pkill -9 -f "[3]60tray"
1⤵
PID:1081

/usr/bin/pkill
pkill -9 -f "[3]60safe"
1⤵
PID:1083

/usr/bin/pkill
pkill -9 -f "[h]ipstray"
1⤵
- System Network Configuration Discovery
PID:1085

/usr/bin/pkill
pkill -9 -f "[u]sysdiag"
1⤵
PID:1087

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads